HIPAA Notice of
Privacy Practices

1. Important Scope Limitation

Valere Regenerative does not collect Protected Health Information (PHI) through its public website.

• Website forms, inquiry submissions, and digital communications through this Site are not HIPAA-covered systems
• You should not submit medical records, diagnostic information, lab results, or sensitive health data through this website
• PHI is collected only after you become a Valerian and submit information through our designated HIPAA-compliant patient management system

This distinction is intentional and important. This Notice governs PHI collected within our clinical systems — not general website visitor data, which is covered by our separate Privacy Policy.

2. Our HIPAA Obligations

Under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), Valere Regenerative is required to:

• Maintain the privacy of your PHI
• Provide you with this Notice of our legal duties and privacy practices
• Abide by the terms of the Notice currently in effect
• Notify you in the event of a breach of your unsecured PHI as required by applicable law

3. How We Collect & Store PHI

Valere Regenerative uses a HIPAA-regulated patient management system to collect, store, and manage PHI related to patient care.

• PHI is collected only within designated HIPAA-compliant clinical systems — not through the public website
• Our patient management platform is independently responsible for maintaining its own HIPAA compliance and security controls
• Valere Regenerative accesses PHI only as permitted for treatment, payment, and healthcare operations

4. How We May Use and Disclose PHI

A. Treatment

To provide, coordinate, or manage your healthcare and related services, including sharing information with other providers involved in your care where clinically appropriate.

B. Payment

To process payment for services rendered, including internal billing and accounting activities. As Valere Regenerative is a private-pay practice, standard insurance billing does not apply.

C. Healthcare Operations

For clinic operations such as quality assessment, compliance activities, training, and administrative management.

5. Other Permitted Uses & Disclosures

We may also use or disclose your PHI without authorization in limited circumstances permitted or required by law, including:

• As required by law or regulation
• For public health activities and reporting
• For health oversight and regulatory activities
• In response to valid legal proceedings or law enforcement requests
• To prevent or lessen a serious and imminent threat to health or safety
• For workers' compensation purposes as required

All such disclosures are made in accordance with HIPAA requirements and applicable Texas law.

6. Uses & Disclosures Requiring Your Authorization

We will not use or disclose your PHI for purposes outside those described above without your written authorization, including:

• Marketing communications involving your PHI
• Sale of your PHI
• Most uses of psychotherapy notes
• Any other use not otherwise permitted by HIPAA

You may revoke any authorization at any time by notifying us in writing. Revocation is effective for future disclosures only and does not affect disclosures already made in reliance on your authorization.

7. Your Rights Regarding Your PHI

You have the right to:

• Access and copy your PHI — request a copy of your health information in our designated record set, including in electronic format where applicable
• Request amendment — request correction of inaccurate or incomplete PHI
• Request restrictions — request limits on certain uses or disclosures of your PHI; we are required to honor restrictions on disclosures to health plans for services you have paid for in full out of pocket
• Request confidential communications — request that we communicate with you in a specific way or at a specific location
• Receive an accounting of disclosures — obtain a list of certain disclosures we have made of your PHI
• Receive a paper copy of this Notice — upon request, even if you agreed to receive it electronically

All requests must be submitted in writing. Contact our Privacy Officer using the information below.

8. Communication Limitations

Electronic communications outside designated HIPAA-compliant systems — including standard email, SMS, and website messages — may not be fully secure. Valere Regenerative limits PHI communication to secure systems whenever required, but cannot guarantee security outside designated platforms. Do not transmit sensitive health information through general communication channels unless directed to do so by your care team.

9. Data Safeguards

Valere Regenerative maintains administrative, technical, and physical safeguards to protect PHI accessed through its systems, in accordance with applicable HIPAA Security Rule requirements. No system is immune to risk. Our patient management platform maintains its own safeguards independently. Valere Regenerative is not responsible for third-party system failures outside its control.

10. Complaints & Non-Retaliation

If you believe your privacy rights have been violated, you may file a complaint with Valere Regenerative by contacting our Privacy Officer, or with the U.S. Department of Health and Human Services Office for Civil Rights at hhs.gov/ocr/privacy/hipaa/complaints or toll-free at 1-877-696-6775. Valere Regenerative will not retaliate against you for filing a complaint.

11. Changes to This Notice

Valere Regenerative reserves the right to modify this Notice. Changes will be effective for all PHI we maintain. The most current version will be posted on our website and made available upon request. Material changes will be communicated to established Valerians.