Notice of Privacy Practices

Your Information. Your Rights. Our Responsibilities.

Effective Date: October 14, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED, AND HOW YOU CAN ACCESS THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

At Ayur Integrative Medicine, we respect the privacy and confidentiality of your health information.

This Notice of Privacy Practices explains how Ayur Integrative Medicine ("Ayur," "we," "us," or "our") may use and disclose protected health information (PHI), your rights regarding that information, and our responsibilities under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), its implementing regulations, and applicable California privacy laws.

This notice applies to protected health information maintained by Ayur Integrative Medicine in connection with its healthcare services, including in-person and eligible virtual consultations.

1. Your Rights Regarding Your Health Information

You have important rights regarding the health information we maintain about you.

Right to Access Your Medical Records

You may request to inspect or obtain an electronic or paper copy of your medical records and other protected health information maintained in a designated record set.

We will generally provide the requested information within 30 days, subject to applicable requirements and permitted extensions.

We may charge a reasonable, cost-based fee where permitted by law. Applicable California law may provide additional access rights or shorter response periods.

Right to Request Corrections

If you believe information in your medical records is inaccurate or incomplete, you may request an amendment.

We will review your request and respond within the timeframe required by applicable law, generally within 60 days under HIPAA, subject to permitted extensions.

If we deny your request, we will explain the reason in writing and inform you of your additional rights.

Right to Request Confidential Communications

You may request that we communicate with you in a particular way or at a different location.

For example, you may ask us to contact you through a particular telephone number or send correspondence to a designated address.

We will accommodate reasonable requests in accordance with applicable law.

Right to Request Restrictions

You may ask us to restrict certain uses or disclosures of your health information for treatment, payment, or healthcare operations.

We are not generally required to agree to every requested restriction.

However, if you pay for a healthcare service in full out of pocket, you may request that we not disclose information about that service to your health plan for payment or healthcare operations. We must honor that request unless disclosure is otherwise required by law.

Right to an Accounting of Disclosures

You may request an accounting of certain disclosures of your protected health information made during the six years preceding your request.

The accounting will not necessarily include disclosures for treatment, payment, healthcare operations, or other categories excluded by applicable law.

One accounting within a 12-month period will generally be provided free of charge. Additional requests may be subject to a reasonable, cost-based fee.

Right to Receive a Copy of This Notice

You may request a paper copy of this Notice of Privacy Practices at any time, even if you previously agreed to receive it electronically.

We will provide a copy promptly.

Right to Choose a Personal Representative

If you have authorized someone to make healthcare decisions on your behalf, or if an individual otherwise has legal authority to act for you, that person may exercise applicable privacy rights on your behalf.

We may require documentation establishing that authority before acting on a request.

Special rules under California law may apply to minors, confidential medical services, and certain sensitive healthcare information.

Right to File a Complaint

If you believe your privacy rights have been violated, you may file a complaint with Ayur Integrative Medicine or the U.S. Department of Health and Human Services.

We will not retaliate against you for submitting a complaint or exercising your privacy rights.

2. How We May Use and Disclose Your Health Information

HIPAA allows certain uses and disclosures of protected health information without your written authorization.

Other uses and disclosures require your authorization or must meet additional legal conditions.

Treatment

We may use and disclose your health information to provide, coordinate, or manage your medical care.

For example, Dr. Malathi Acharya may review your medical history, laboratory results, medications, and clinical assessments to develop an individualized treatment plan.

We may also share relevant information with other healthcare professionals involved in your treatment, including primary care physicians, specialists, laboratories, or other authorized healthcare providers.

Such disclosures remain subject to applicable privacy protections, including any heightened requirements for specific categories of health information.

Payment

We may use and disclose your health information as necessary to obtain or process payment for healthcare services.

This may include preparing invoices, processing eligible claims, verifying coverage, or responding to payment-related inquiries.

If you pay for a service entirely out of pocket and request that the information not be shared with your health plan for payment or healthcare operations, we will honor that restriction unless otherwise required by law.

Healthcare Operations

We may use and disclose health information for legitimate healthcare operations, including:

• Quality assessment and improvement
• Clinical and administrative review
• Staff training and supervision
• Practice management and scheduling
• Regulatory compliance
• Patient service coordination
• Reviewing and improving healthcare delivery

For example, we may review clinical and operational information to improve patient scheduling, care coordination, or the quality of our services.

3. Additional Uses and Disclosures Permitted or Required by Law

In certain circumstances, we may use or disclose protected health information without your written authorization, subject to applicable legal requirements.

Public Health Activities

We may disclose information to authorized public health agencies for activities such as disease reporting, public health investigations, adverse event reporting, or other legally permitted public health purposes.

Health and Safety

We may disclose information when permitted or required by law to prevent or reduce a serious threat to health or safety.

Abuse, Neglect, or Domestic Violence

We may disclose information to appropriate authorities when required or permitted by law concerning suspected abuse, neglect, or domestic violence.

Health Oversight Activities

We may disclose information to authorized agencies conducting legally permitted audits, investigations, inspections, or regulatory oversight.

Legal Proceedings

We may disclose protected health information in response to lawful judicial or administrative proceedings, court orders, subpoenas, or other legal processes, but only when the applicable legal requirements are satisfied.

Additional restrictions may apply to certain medical information under California or federal law.

Law Enforcement

We may disclose information to law enforcement officials when legally required or permitted, subject to applicable restrictions.

Research

We may use or disclose health information for research when an applicable legal basis permits the activity, including a valid authorization, appropriate institutional review board or privacy board waiver, or another permitted HIPAA pathway.

Medical Examiners and Funeral Directors

We may disclose relevant health information to coroners, medical examiners, or funeral directors as authorized by law.

Organ and Tissue Donation

Where applicable, we may disclose health information to organizations involved in organ, eye, or tissue donation in accordance with legal requirements.

Workers' Compensation

We may disclose health information when authorized or required by workers' compensation laws or similar programs.

Government Functions

Certain disclosures may be permitted for legally authorized military, national security, protective services, or other government functions.

Required by Law

We will disclose protected health information when required to do so by applicable federal, state, or local law.

4. Your Choices About Sharing Information

In certain situations, you may tell us how you prefer your health information to be used or disclosed.

Family Members and Others Involved in Your Care

With your agreement, or when otherwise permitted by law, we may share information relevant to your care or payment for your care with family members, close friends, caregivers, or other individuals you identify.

If you are unable to express a preference, we may disclose relevant information when permitted by law and when we determine that doing so is in your best interest.

Disaster Relief

We may share limited information with authorized disaster relief organizations when permitted by law to help notify family members or others involved in your care.

Fundraising

If Ayur conducts fundraising activities using protected health information, we will comply with applicable notice, authorization, and opt-out requirements.

You may opt out of qualifying fundraising communications.

Additional rules apply to fundraising communications involving certain substance use disorder records.

5. Uses and Disclosures Requiring Your Written Authorization

Certain uses and disclosures of protected health information generally require your prior written authorization.

These include:

Marketing

We will obtain your written authorization before using or disclosing protected health information for marketing when required by HIPAA or applicable California law.

Certain communications about treatment, care coordination, and healthcare-related services may be permitted without authorization under applicable legal exceptions.

Sale of Protected Health Information

We will not sell protected health information without the authorization required by applicable law.

Psychotherapy Notes

Most uses and disclosures of psychotherapy notes, as specifically defined under HIPAA, require separate written authorization, subject to limited legal exceptions.

Other Uses and Disclosures

Uses and disclosures not described in this notice or otherwise permitted or required by law will be made only with appropriate authorization.

Revoking Authorization

You may revoke a written authorization at any time by notifying us in writing.

Revocation does not apply retroactively to actions already taken in reliance on a valid authorization, and certain legal exceptions may apply.

6. Additional Protections for Sensitive Medical Information

Certain types of health information may receive additional protections under federal or California law.

These may include:

• Mental and behavioral health records
• Substance use disorder treatment records
• HIV-related medical information
• Certain genetic information
• Reproductive and sexual health information
• Medical information involving minors
• Other specially protected medical records

Where applicable state or federal law provides stronger confidentiality protections than HIPAA, we will follow the more protective requirements.

We will obtain written authorization or satisfy another valid legal basis before using or disclosing specially protected information when required by law.

7. Substance Use Disorder Records

Certain substance use disorder (SUD) patient records are subject to additional confidentiality protections under 42 CFR Part 2.

If we receive or maintain records protected by Part 2, we will handle those records in accordance with the applicable confidentiality requirements.

Where permitted, Part 2 records may be used or disclosed for treatment, payment, or healthcare operations pursuant to a valid patient consent or another lawful basis.

Part 2 records may not be used or disclosed in civil, criminal, administrative, or legislative proceedings against you without your written consent or a court order accompanied by a subpoena or other legal mandate, as required by applicable law.

Additional restrictions may apply to redisclosure, legal proceedings, and other uses of these records.

If your Part 2 records are used for fundraising communications, you will receive the notice and choice required by applicable law before such communications.

We will respect any additional patient rights and confidentiality requirements applicable to Part 2 records.

8. Electronic Health Records and Patient Portal

Ayur Integrative Medicine uses electronic systems to support patient care, scheduling, and practice administration.

Our patient portal is available through Practice Better:

https://ayurintegrativemedicine.practicebetter.io/

Depending on the services you receive, authorized electronic systems may support:

• Appointment scheduling
• Secure patient communications
• Intake and assessment forms
• Medical documentation
• Care plans and follow-up information
• Payment and administrative functions

We take steps required by applicable law to protect electronic protected health information.

Where required, external service providers that create, receive, maintain, or transmit protected health information on our behalf must have appropriate contractual safeguards, including business associate agreements when applicable.

Patients should use authorized secure communication channels when transmitting medical records or other sensitive health information.

9. Communications and Appointment Reminders

We may use your contact information to communicate about your healthcare, including:

• Appointment confirmations
• Scheduling changes
• Follow-up communications
• Treatment-related information
• Administrative matters
• Healthcare services relevant to your care

Communication methods may include telephone, email, electronic patient portal messages, or other approved channels.

We will respect reasonable requests for confidential communications and follow applicable consent and privacy requirements.

Please notify us if you would like to request an alternative communication method.

10. Our Legal Responsibilities

Ayur Integrative Medicine is required, to the extent it is subject to HIPAA, to:

• Maintain the privacy of protected health information
• Apply appropriate safeguards to protect the confidentiality, integrity, and availability of electronic protected health information
• Provide patients with notice of our legal duties and privacy practices
• Follow the terms of the Notice of Privacy Practices currently in effect
• Notify affected individuals of breaches of unsecured protected health information when required by law
• Respect applicable patient privacy rights
• Obtain required authorizations before using or disclosing information for purposes that require authorization

We limit access to protected health information according to appropriate professional, operational, and legal requirements.

We will not use or disclose your protected health information in a manner inconsistent with applicable law or this notice.

11. Changes to This Notice

We reserve the right to revise this Notice of Privacy Practices in accordance with applicable law.

Revised terms may apply to protected health information we already maintain as well as information received in the future.

When we make a material change, we will update the notice and make the current version available through our practice and website.

The effective date will appear at the beginning of the notice.

You may request a copy of the current notice at any time.

12. Questions and Privacy Complaints

If you have questions about this notice, wish to exercise your privacy rights, or want to submit a privacy complaint, please contact:

Please do not include sensitive medical information in an ordinary email. Contact our practice to request an appropriate secure communication method.

You may also file a complaint with the:

You will not be penalized or retaliated against for filing a complaint.

13. Availability of This Notice

This Notice of Privacy Practices is available:

• On our website at www.ayur.today
• Upon request from our practice
• In paper format, upon request
• Through our patient intake or registration procedures, as applicable

We will provide this notice to patients in accordance with applicable HIPAA requirements.

---

Ayur Integrative Medicine
Dr. Malathi Acharya, MD
© 2026 Ayur Integrative Medicine. All rights reserved.