Notice of Privacy Practices

About This Notice

Vella Method is owned and operated by Brandie Baier, FNP-C, MSN, a licensed nurse practitioner in the State of Arizona. We are required by federal law (HIPAA) and Arizona law to maintain the privacy of your Protected Health Information (PHI), to provide you with this Notice of our legal duties and privacy practices, and to follow the terms of the Notice currently in effect.

This Notice applies to all PHI we create or maintain about you, including health information we receive from other healthcare providers and information we generate as part of your care at Vella Method.

1. How We May Use and Disclose Your PHI Without Authorization

HIPAA permits us to use and disclose your PHI without your written authorization for the following purposes:

For Treatment

We may use your PHI to provide, coordinate, and manage your healthcare. For example, we may share your medical history with another provider involved in your care, consult with specialists, or use your records to determine appropriate treatments.

For Payment

We may use and disclose your PHI to obtain payment for the services we provide. This may include verifying eligibility, processing payments, and communicating with payment processors. If you apply for Cherry financing, we do not share your PHI with Cherry — financing applications are submitted directly by you.

For Healthcare Operations

We may use your PHI to support the business activities of our practice, including quality assessment, staff training, licensing, accreditation, business planning, and customer service.

To Business Associates

We share PHI with vendors who perform services on our behalf — including Aesthetic Record (our HIPAA-compliant practice management and EMR platform), our payment processor, and our website host. Each of these vendors has signed a Business Associate Agreement (BAA) obligating them to protect your PHI under HIPAA.

For Appointment Reminders & Treatment Communications

We may contact you to remind you of upcoming appointments, follow up after treatment, or share information about treatment alternatives or other health-related services that may be of interest to you. You may ask us to limit these communications.

As Required by Law

We will disclose your PHI when required by federal, state, or local law, including:

• Court orders, subpoenas, or other lawful legal process
• Public health activities, such as reporting of communicable diseases
• Reporting of suspected abuse, neglect, or domestic violence (as required under Arizona law)
• Health oversight activities by government agencies
• Law enforcement purposes as permitted or required by law
• Reporting to coroners, medical examiners, or funeral directors as needed
• Workers' compensation claims
• To avert a serious threat to health or safety

2. Uses and Disclosures That Require Your Written Authorization

For uses and disclosures of PHI that fall outside the categories above, we will obtain your written authorization before sharing your information. This includes:

• Marketing communications beyond face-to-face communication or nominal gifts
• Sale of PHI — we do not and will not sell your information
• Most uses and disclosures of psychotherapy notes
• Use of your photographs or testimonials in any marketing material

3. Your Rights Regarding Your PHI

Under HIPAA and Arizona law, you have the following rights regarding the PHI we maintain about you:

To exercise any of these rights, please contact our Privacy Officer using the information at the end of this Notice. Most requests must be submitted in writing.

4. Our Responsibilities

Vella Method is required by law to:

• Maintain the privacy and security of your Protected Health Information
• Provide you with this Notice of our legal duties and privacy practices
• Follow the terms of the Notice currently in effect
• Notify you promptly if a breach occurs that may have compromised the privacy or security of your PHI
• Comply with HIPAA's Privacy, Security, and Breach Notification Rules, as well as Arizona's medical confidentiality and breach notification laws

We will not use or disclose your PHI other than as described in this Notice unless you provide written authorization, or unless the use or disclosure is otherwise permitted or required by law.

5. Breach Notification

In the event of a breach involving your unsecured PHI, we will notify you in accordance with applicable federal and Arizona law.

6. Changes to This Notice

We reserve the right to change the terms of this Notice and to make the new Notice provisions effective for all PHI we maintain. When we make a material change, we will post the revised Notice on our website at vellamethod.com/hipaa-notice.html and make paper copies available at our office. The effective date at the top of the Notice indicates when the most recent revision took effect.

7. Contact & Complaints

If you have questions about this Notice, wish to exercise any of your rights, or believe your privacy rights have been violated, please contact our Privacy Officer:

Filing a Complaint with Federal or State Authorities

You also have the right to file a complaint with:

• U.S. Department of Health and Human Services, Office for Civil Rights — www.hhs.gov/ocr  |  1-800-368-1019
• Arizona Attorney General's Office — www.azag.gov
• Arizona State Board of Nursing — www.azbn.gov

You will not be retaliated against for filing a complaint.