Notice of Privacy Practices

Effective date: August 4, 2026

Reflections (“we,” “us,” “our”) is required by law to protect the privacy of your health information, to give you this notice explaining our legal duties and privacy practices, and to follow the terms of the notice currently in effect.

How we may use and share your health information

For treatment. We use your health information to provide and coordinate your care. For example, a provider reviews your intake form, medical history, medications and allergies before prescribing, and may share relevant details with a compounding or dispensing pharmacy, a laboratory, or another clinician involved in your care.

For payment. We use your health information to bill and collect payment for services and products, including verifying eligibility and processing transactions.

For health care operations. We use your health information to run the practice — reviewing quality of care, training, scheduling, and administration.

Appointment reminders and follow-up. We may contact you by phone, text message, or email about appointments, your treatment plan, refills, forms we need from you, and other health matters. Text message and email are not fully secure. You may ask us to contact you a different way, or at a different number or address, and we will accommodate reasonable requests.

Business associates. We use outside companies for scheduling, records, payments, messaging and similar services. Where they handle your health information on our behalf, we require a written agreement obligating them to protect it.

Other uses and disclosures permitted or required by law

We may use or share your health information without your authorization in these circumstances, subject to the limits the law places on each:

• When required by federal, state or local law
• For public health activities, including reporting disease, injury, or product problems to the FDA
• To report suspected abuse, neglect, or domestic violence
• For health oversight activities such as audits, licensure and investigations
• In response to a court or administrative order, subpoena, or other lawful process
• To law enforcement in the limited circumstances the law allows
• To coroners, medical examiners and funeral directors
• For organ and tissue donation
• For approved research, where privacy protections are in place
• To prevent a serious and imminent threat to the health or safety of you or others
• For workers’ compensation claims
• For specialized government functions, including military and national security

Uses that always require your written authorization

• Most uses and disclosures of psychotherapy notes
• Use or disclosure of your health information for marketing
• Any sale of your health information
• Any other use or disclosure not described in this notice

If you give us written authorization, you may revoke it in writing at any time. Revoking it stops future uses and disclosures, but does not undo anything we already did while the authorization was in effect.

Your rights

Get a copy of your record. You may inspect and request a copy of your medical and billing records, usually within 30 days of your request. We may charge a reasonable, cost-based fee.

Ask us to correct your record. If you believe something in your record is incorrect or incomplete, you may ask us to amend it. We may deny the request, and if we do we will tell you why in writing.

Request confidential communications. You may ask us to contact you in a specific way or at a specific address. We will accommodate reasonable requests.

Ask us to limit what we use or share. You may request a restriction on how we use or share your information. We are not required to agree, except in one case: if you pay for a service in full, out of pocket, you may require us not to share information about that service with a health plan.

Get a list of disclosures. You may request an accounting of certain disclosures we made in the six years before your request.

Get a paper copy of this notice. You may ask for a paper copy at any time, even if you agreed to receive it electronically.

Be notified of a breach. We will notify you if a breach occurs that compromises the privacy or security of your health information.

Choose someone to act for you. If you have given someone medical power of attorney, or if someone is your legal guardian, that person can exercise these rights on your behalf.

Our responsibilities

• We are required by law to protect the privacy and security of your health information
• We will let you know promptly if a breach occurs that may have compromised it
• We must follow the duties and privacy practices described in this notice and give you a copy
• We will not use or share your information other than as described here unless you tell us we can, in writing

Complaints

If you believe your privacy rights have been violated, you may complain to us using the contact details below. You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights — 200 Independence Avenue SW, Washington, D.C. 20201, or at hhs.gov/ocr/complaints.

We will not retaliate against you for filing a complaint.

Changes to this notice

We may change this notice at any time. The new notice will apply to all health information we already hold as well as information we receive in the future. The current version is always posted on this page, with its effective date.

Contact us

Privacy Officer — Reflections
Johnson City, Tennessee
Phone: 423-900-2994 (calls only)
Email: info@reflectionsaesthetics.co

This notice applies to the health information Reflections creates and keeps about you.