HIPAA Notice of Privacy Practices

MedPilot LLC (operating the "ByeAcne" brand) is required by law to maintain the privacy of your Protected Health Information (PHI), to provide you with this Notice of our legal duties and privacy practices with respect to PHI, and to abide by the terms of this Notice currently in effect.

We are required to notify you in the event of a breach of your unsecured PHI.

The following categories describe the ways we may use and disclose your health information:

• Treatment: We may use and disclose your PHI to provide, coordinate, or manage your healthcare. This includes sharing information with the licensed physician assigned to your consultation and, with your consent, with your pharmacy to fulfill a prescription.
• Payment: We may use and disclose your PHI to bill and collect payment for services. We do not submit claims to insurance carriers.
• Healthcare operations: We may use and disclose your PHI for quality assessment, training, compliance activities, and improving our platform, in accordance with HIPAA.
• As required by law: We will disclose your PHI when required by federal, state, or local law, or in response to a valid court order or subpoena.
• Public health activities: We may disclose PHI to authorized public health authorities as required or permitted by law.

Other uses and disclosures of your PHI not described in this Notice will be made only with your written authorization. You may revoke any such authorization in writing at any time. Revocation does not affect uses or disclosures we made in reliance on your authorization before we received your revocation.

• Right to inspect and copy: You have the right to inspect and obtain a copy of your PHI that we maintain in your medical record. Submit requests to privacy@byeacne.co. We may charge a reasonable fee for copies.
• Right to amend: You have the right to request that we amend your PHI if you believe it is incorrect or incomplete. We may deny your request in certain circumstances.
• Right to an accounting of disclosures: You have the right to request a list of disclosures we have made of your PHI for purposes other than treatment, payment, or operations, for the 6 years prior to your request.
• Right to request restrictions: You have the right to request restrictions on how we use or disclose your PHI. We are not required to agree to your request except in limited circumstances.
• Right to confidential communications: You have the right to request that we communicate with you about your health information in a specific way.
• Right to a paper copy of this notice: You have the right to a paper copy of this Notice at any time. Email privacy@byeacne.co to request one.

We protect your PHI using administrative, physical, and technical safeguards in accordance with the HIPAA Security Rule. All PHI is encrypted at rest (AES-256) and in transit (TLS 1.3). Access to PHI is restricted to authorized personnel with a legitimate need. We conduct regular risk assessments and maintain a comprehensive HIPAA compliance program.

We reserve the right to change this Notice and make the new provisions effective for all PHI we maintain. We will post the revised Notice on our website. The effective date will appear at the top of this page.

If you believe your privacy rights have been violated, you may file a complaint with ByeAcne by contacting our Privacy Officer at privacy@byeacne.co, or with the U.S. Department of Health and Human Services Office for Civil Rights at hhs.gov/ocr. We will not retaliate against you for filing a complaint.

MedPilot LLC (ByeAcne) — Privacy Officer
privacy@byeacne.co