Notice of Privacy Practices

Your Information. Your Rights. Our Responsibilities.

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

This notice describes the privacy practices of Theta ADHD and its workforce for protected health information we create, receive, maintain, or transmit in providing health care, including telehealth care. Protected health information includes information that identifies you and relates to your health, your care, or payment for your care.

You have a right to a paper or electronic copy of this notice and to discuss it with our privacy contact. To exercise your rights, ask questions, or make a complaint, use the contact information at the end of this notice.

Your Rights

When it comes to your health information, you have certain rights. This section explains your rights and some of our responsibilities to help you.

Get an electronic or paper copy of your medical record

You can ask to inspect or get an electronic or paper copy of your medical record and other health information we use to make decisions about you. Ask us how to do this. We will provide a copy or a summary, if you agree to a summary, usually within 30 days of your request. If the law allows an extension, we will explain the reason and expected completion date in writing. We may charge a reasonable, cost-based fee as permitted by law. Certain records, such as separately maintained psychotherapy notes, are excluded from the HIPAA right of access. If we deny access, we will explain the reason and any available review rights.

Ask us to correct your medical record

You can ask us to correct health information about you that you think is incorrect or incomplete. We may say “no” to your request, but we will tell you why in writing within 60 days, subject to a legally permitted extension. If we deny your request, you may submit a statement of disagreement to be included with the record.

Request confidential communications

You can ask us to contact you in a specific way, such as at a home or office phone number, or to send mail to a different address. We will accommodate all reasonable requests. You do not have to explain the reason for your request.

Ask us to limit what we use or share

You can ask us not to use or share certain health information for treatment, payment, or our operations, or with people involved in your care. We are not required to agree to every request, and we may say “no” if it would affect your care or for another reason permitted by law.

If you pay for a health care item or service out of pocket in full, you can ask us not to share information about that item or service with your health insurer for payment or health care operations. We will agree unless a law requires us to share that information.

Get a list of those with whom we have shared information

You can ask for an accounting of certain disclosures of your health information during the six years before your request. We will include disclosures covered by the accounting requirement, but not disclosures for treatment, payment, or health care operations, disclosures you authorized, and certain other disclosures excluded by law. We will provide one accounting a year for free; we may charge a reasonable, cost-based fee for additional requests within 12 months, after telling you the cost and allowing you to withdraw or change the request.

Get a copy of this privacy notice

You can ask for a paper copy of this notice at any time, even if you agreed to receive it electronically. We will provide a paper copy promptly and make this notice available on our website.

Choose someone to act for you

If you have given someone a health care power of attorney, or if someone is your legal guardian or other legally authorized personal representative, that person can exercise your rights and make choices about your health information within the scope of their authority. We will verify their authority before taking action. Exceptions may apply, including when the law permits us not to treat someone as your representative because of abuse, neglect, or endangerment.

File a complaint if you feel your rights are violated

You can complain to Theta ADHD using the contact information below if you feel we have violated your privacy rights. You may also complain to the U.S. Department of Health and Human Services Office for Civil Rights. We will not retaliate against you for filing a complaint, and you do not have to waive your right to complain to receive care.

Your Choices

For certain health information, you can tell us your choices about what we share. If you have a clear preference for how we share your information in the situations below, tell us. We will follow your instructions to the extent required by law.

Information shared with family, friends, or others involved in your care

You can tell us whether we may share information relevant to your care or payment with your family, close friends, or others you identify. You may agree, object, or ask us to limit what we share. Similar choices apply to disaster relief notifications and, if applicable, a facility directory.

If you cannot tell us your preference, for example because you are unconscious, we may share information when we believe it is in your best interest, as permitted by law. We may also share information when needed to lessen a serious and imminent threat to health or safety. These permissions do not override stricter protections for Part 2 records or other specially protected information.

Uses requiring your written permission

We generally need your written authorization for uses or disclosures of separately maintained psychotherapy notes, marketing uses or disclosures that require authorization, and the sale of your health information, except for specific exceptions permitted by law. Psychotherapy notes are a clinician’s separately maintained notes about counseling conversations; ordinary treatment records are not automatically psychotherapy notes. Where required, an authorization for marketing or a sale will disclose whether remuneration is involved.

For uses or disclosures not described in this notice or otherwise permitted or required by law, we will obtain your written authorization. You may revoke an authorization in writing at any time, except to the extent we have already acted in reliance on it or another legal exception applies.

Fundraising

If we contact you for fundraising using health information as permitted by HIPAA, you can tell us not to contact you again. We will provide a clear way to opt out and will honor your choice. Your decision will not affect your treatment or payment. Additional advance-choice protections apply to Part 2 records, as described below.

Our Uses and Disclosures

The following describes how we typically use or share health information and other situations in which the law permits or requires us to do so. These are permissions under HIPAA, not a statement that Theta ADHD engages in every listed activity. Any more protective applicable law, including Part 2 when applicable, limits these permissions.

Treat you

We may use your health information and share it with other professionals who are treating you. For example, a clinician may discuss your symptoms, medications, or treatment plan with another provider involved in your care.

Run our organization

We may use and share your health information to operate our practice, improve care, review quality, train staff, and contact you when necessary. For example, we may review records to evaluate the quality of our care or send appointment reminders. Service providers acting as business associates must protect your information under appropriate agreements and applicable law.

Bill for your services

We may use and share your health information to bill and obtain payment from health plans or other entities responsible for payment. For example, we may provide information about your visit to process a claim, when applicable and subject to any agreed or legally required restriction.

Help with public health and safety issues

We may share information for legally authorized public health activities, including preventing disease, reporting adverse medication reactions, assisting with product recalls, reporting suspected abuse, neglect, or domestic violence, and preventing or reducing a serious and imminent threat to someone’s health or safety. We will disclose only as permitted or required by applicable law.

Do research

We may use or share health information for health research when legal requirements are met, for example with your authorization or a waiver approved by an authorized review board, and with the privacy safeguards required by law.

Comply with the law

We will share information when federal or state law requires it, including with the Department of Health and Human Services when it wants to determine whether we are complying with federal privacy law. A legal request does not eliminate additional protections that may apply to particular records.

Respond to organ and tissue donation requests

We may share information with organ procurement organizations as permitted by law.

Work with a medical examiner or funeral director

We may share health information with a coroner, medical examiner, or funeral director when an individual dies, as permitted by law.

Address workers’ compensation, law enforcement, and other government requests

We may use or share health information for workers’ compensation claims; for law enforcement purposes when the required legal conditions are met; with health oversight agencies for activities authorized by law; and for special government functions such as military, national security, presidential protective services, or correctional purposes, as permitted by law.

Respond to lawsuits and legal actions

We may share health information in response to a court or administrative order, or a subpoena or other lawful process when the required safeguards are met. Part 2 records have additional protections, and a subpoena alone is not sufficient to override them.

To the extent that we have your substance use disorder patient records, subject to 42 CFR part 2, we will not share that information for investigations or legal proceedings against you without (1) your written consent or (2) a court order and a subpoena.

Additional Protections for Substance Use Disorder Records

Federal law, 42 U.S.C. 290dd-2 and 42 CFR Part 2, provides special confidentiality protections for records from federally assisted programs providing substance use disorder diagnosis, treatment, or referral for treatment. Not every health record that mentions substance use is a Part 2 record. The following protections apply to the extent Theta ADHD creates, receives, or maintains records protected by Part 2; this notice does not represent that Theta ADHD is itself a Part 2 program.

Your consent and choices

Most uses and disclosures of Part 2 records require your written consent unless Part 2 specifically permits or requires otherwise. You may provide a single consent for future uses and disclosures for treatment, payment, and health care operations. You may revoke that consent in writing, except to the extent action has already been taken in reliance on it. We will explain how to submit or revoke consent through our privacy contact.

Consent for use or disclosure of Part 2 records in civil, criminal, administrative, or legislative proceedings against you must be separate from consent for other purposes. Separately maintained substance use disorder counseling notes generally require specific consent, subject to the limited exceptions allowed by Part 2.

Redisclosure and legal proceedings

When a HIPAA covered entity or its business associate receives Part 2 records under a consent for treatment, payment, and health care operations, it may redisclose those records as HIPAA permits, subject to Part 2’s restrictions on use in proceedings against you. Information disclosed to another recipient may be redisclosed and may no longer be protected by HIPAA; Part 2 and other applicable laws may still restrict the recipient’s use or disclosure.

Part 2 records, and testimony describing information in those records, may not be used or disclosed in civil, criminal, administrative, or legislative proceedings against you without your specific written consent or a qualifying court order accompanied by a subpoena or other legally required demand. An ordinary authorization, subpoena, or general request for records is not by itself sufficient. Required confidentiality notices and consent information will accompany disclosures of Part 2 records as applicable.

Limited disclosures without consent

Part 2 permits limited uses or disclosures without your consent when its specific requirements are satisfied. These may include necessary communications within a Part 2 program or with qualified service organizations; bona fide medical emergencies; qualifying scientific research, audits, or evaluations; reporting suspected child abuse or neglect; reporting crimes on program premises or against program personnel, or threats of such crimes; and qualifying court-ordered disclosures. Public health disclosures without consent under Part 2 are limited to information de-identified according to HIPAA standards. General HIPAA permissions do not automatically authorize disclosure of identifiable Part 2 records.

Additional rights when applicable

You may request restrictions, obtain a copy of this notice, discuss it with our privacy contact, and complain about a violation of Part 2 without retaliation. When applicable, you may request a list of recipients from an intermediary that disclosed your records under a general designation in your consent, as provided by Part 2. Any additional right to an accounting of electronic treatment, payment, and health care operations disclosures will be provided when the corresponding federal requirement becomes applicable.

If a Part 2 program proposes to use your Part 2 records for fundraising, you must first be given a clear and conspicuous opportunity to choose not to receive fundraising communications. We will honor applicable opt-out rights; your choice will not affect your care or payment.

Our Responsibilities

• We are required by law to maintain the privacy and security of your protected health information.
• We will notify you promptly, as required by law, if a breach occurs that may compromise the privacy or security of your information.
• We must follow the duties and privacy practices described in the notice currently in effect and give you a copy.
• We will not use or share your information other than as described here unless you tell us we can in writing, or the law otherwise permits or requires it. You can change your mind by notifying us in writing, subject to the limitations described above.
• We apply the minimum necessary standard where required and follow more protective federal or state laws when they apply, including special protections for certain mental health, substance use disorder, HIV-related, or other sensitive records.

For more information about HIPAA privacy rights, visit HHS: HIPAA for Individuals.

Changes to the Terms of This Notice

We may change the terms of this notice, and the changes may apply to all information we maintain about you, including information received before the change. We will make a revised notice available upon request and on our website and display its effective date. The effective date for this notice is October 9, 2026; this date does not alter any earlier legal compliance deadline.

Questions, Requests, and Complaints

Theta ADHD privacy contact

To discuss this notice, exercise a privacy right, revoke an authorization or consent, or file a privacy complaint, contact Theta ADHD and ask for the person responsible for privacy practices:

Please avoid including sensitive medical details in ordinary email; ask us for a secure way to send health information.

U.S. Department of Health and Human Services

You can file a HIPAA or Part 2 privacy complaint with the Office for Civil Rights online at www.hhs.gov/ocr/complaints, by calling 1-800-368-1019 (TDD: 1-800-537-7697), or by writing to:

Complaints generally must be filed within 180 days of when you knew of the alleged violation; OCR may extend this period for good cause. You may file with Theta ADHD, OCR, or both. We will not retaliate or discriminate against you for making a complaint.