Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

A Squared Medical Corporation, PC — The Systems

Effective date: September 24, 2026

Who and what this notice covers

This notice describes how A Squared Medical Corporation, PC, referred to here as “we,” “us” or “the practice,” handles protected health information when acting as a covered health care provider. It applies to the corporation and people acting on its behalf. It does not make independent laboratories, pharmacies or other independent clinicians part of the corporation; their own notices may also apply.

Protected health information is information that identifies you and concerns your health, care or payment for care. These protections apply to covered information in electronic, paper and spoken form. A record does not lose an applicable privacy protection because it was received while evaluating possible care rather than during an appointment.

The separate Website and Applicant Privacy Notice explains public website browsing and correspondence. This clinical privacy notice does not open applications, enroll you in care or provide permission for treatment, marketing or research. Receiving or acknowledging this notice is not authorization to release your records.

Your rights and how to use them

Contact the privacy contact listed at the end of this notice to make a request or ask for help. You do not need a website account to exercise your rights. We may reasonably verify your identity or a representative's authority before releasing protected information. Verification must not create an unreasonable barrier or unlawfully delay a request. Please begin an ordinary email with the type of request and a way to contact you, rather than sending medical records or a detailed health history.

See or receive your records

You may ask to inspect or receive an electronic or paper copy of the health information used to make decisions about you, including medical and billing records. We provide the requested format when readily producible; otherwise, we work with you on a readable alternative. A summary replaces the requested records only with your agreement and agreement to any permitted fee.

HIPAA generally requires action within 30 calendar days. A single extension of up to 30 more days requires a written explanation and completion date before the original deadline. We follow a shorter applicable deadline: California law generally requires inspection within five working days and copies within 15 days after receipt of a qualifying request. A HIPAA extension does not override a shorter state-law deadline.

Any charge must comply with the applicable limits, including HIPAA's reasonable, cost-based limits for your own copy and any right to a free copy. Access has limited legal exceptions. A denial will explain its basis, how to complain and any right to independent review. We provide the portions to which you remain entitled.

Request a correction

You may ask us to amend information you believe is incorrect or incomplete. Put the request and your reason in writing. We act within 60 days, unless a legally permitted one-time extension of up to 30 days is explained to you in writing before that deadline, or a shorter law applies. An amendment adds or corrects information without secretly rewriting the historical record.

We may deny an amendment for a legally permitted reason, such as an accurate and complete record. We will explain a denial in writing and describe your right to submit a statement of disagreement. Where California law applies, you may also submit an addendum of up to 250 words for each item you believe incomplete or incorrect; it accompanies disclosures of the challenged portion as the law requires.

Choose a confidential way to communicate

You may ask us to use a different telephone number, mailing address or other reasonable communication method. We accommodate reasonable requests. You do not have to explain why you need confidential communications. We may ask for the alternative contact details and, when appropriate, how payment will be handled.

Ask us to limit uses or disclosures

You may request limits on information used or shared for treatment, payment or health care operations, or shared with people involved in your care. We are not required to accept every requested restriction, except as described below or required by another applicable law. We follow a restriction we accept, subject to applicable legal exceptions, including information needed for emergency treatment.

When you or someone other than your health plan pays us in full for an item or service, you may require us not to disclose information relating solely to that item or service to your health plan for payment or health care operations, unless law requires the disclosure. Tell us which item or service your request covers. This right applies even if you have health insurance.

Request a list of disclosures

You may request an accounting of disclosures covered by this right for up to the six years before your request. It identifies the recipients, dates, information disclosed and purposes. HIPAA excludes certain disclosures, including most treatment, payment and operations disclosures, disclosures to you and disclosures made under your authorization. Any additional applicable accounting right remains available.

We respond within 60 days, with only one legally permitted extension of up to 30 days after written notice explaining the delay and completion date. The first accounting in a 12-month period is free. Before charging a permitted fee for another accounting in that period, we tell you the fee and give you a chance to change or withdraw the request.

Receive this notice and use a representative

You may obtain a paper copy of this notice on request, even after agreeing to receive it electronically. You may also request the current electronic version.

A person legally authorized to act for you may exercise your rights within that authority. We verify that authority. Being a relative or paying for care does not by itself give someone access to all your records. Rules protecting minors' confidential care and people at risk of abuse, neglect or endangerment can limit a representative's access.

Uses and disclosures for care, payment and practice operations

The following descriptions explain purposes for which information may be used or disclosed when applicable legal conditions are met. They are not permission to ignore a stricter law, an applicable consent requirement or an agreed restriction. Examples illustrate a permitted purpose and do not promise that a particular service or integration is available.

Treatment. We may use information to assess your health and provide or coordinate care, and share relevant information with other professionals treating you. For example, a clinician may give a laboratory the information needed to interpret an ordered test or discuss a medication with your pharmacist. Care coordination can include treatment reminders or discussing appropriate treatment alternatives.

Payment. We may use relevant information to prepare a bill, collect payment or resolve a payment question. For example, billing personnel may use a record of the service provided to explain a charge to you. A disclosure to another payer must be lawful and respect an applicable restriction. This notice does not state that the practice participates in insurance or submits insurance claims.

Health care operations. We may use information to administer care, review quality and safety, train authorized personnel, address a complaint, conduct an appropriate audit or obtain professional advice. For example, a clinician may review a care record to investigate a reported error. Access is limited according to duties and the applicable minimum-necessary rules.

Service providers may handle information for permitted functions such as medical-record storage, billing or professional support. Where the law requires a business associate agreement, that agreement and its protections must be in place before the applicable access. This notice does not itself authorize a vendor's unrelated use of your information.

People involved in your care and your choices

We may share information directly relevant to a family member's, friend's or other person's involvement in your care or payment when you agree, have an opportunity to object and do not object, or the law permits agreement to be reasonably inferred. You may tell us not to share. A stricter consent rule controls where it applies.

When you cannot express a preference, a clinician may use professional judgment to make a limited disclosure in your best interests where law allows. We may also share limited information for lawful disaster-relief notifications about your location, general condition or death. Known objections and applicable confidentiality requirements remain relevant.

If the practice uses a patient or facility directory, you may object to the permitted directory disclosure. A directory is not created by this notice.

Other legally permitted or required disclosures

Each category below is subject to its specific legal conditions and the additional protections later in this notice. A request, badge, subpoena or claimed public purpose is not by itself permission to disclose everything in a record. Where applicable, only the required or minimum necessary information may be disclosed.

Public health and safety. We may make legally permitted or required reports about communicable disease, adverse reactions, product safety or recalls, or suspected abuse, neglect or domestic violence. We may disclose information to a person able to help prevent or reduce a serious and imminent threat when law and professional standards permit.

Health oversight and compliance. We may disclose information to authorized agencies for activities such as lawful audits, licensing, inspections or investigations. We must provide information to the U.S. Department of Health and Human Services when required for its privacy-rule enforcement duties.

Courts, law enforcement and other compulsory requests. We disclose information when a valid law requires it, and may make a permitted disclosure for a judicial, administrative or law-enforcement purpose only after the applicable requirements are met. A subpoena without a qualifying order may require notice to you, a protective order or other safeguards. State restrictions and the substance-use-record protections below can prohibit or further limit disclosure.

Research. Information may be used or disclosed for research with your valid authorization, or without it only under a specifically permitted legal pathway, such as a documented privacy-board or institutional-review-board waiver, qualifying preparation for research or qualifying research involving decedents. Applicable state restrictions and record-specific protections still apply. This notice does not enroll you in a study or assert that the practice operates a research program.

Organ donation and death-related responsibilities. When law permits, relevant information may be disclosed to organ or tissue procurement organizations, coroners, medical examiners or funeral directors for their authorized duties.

Workers' compensation and special government functions. Limited disclosures may be made as authorized by workers' compensation law or the specific rules governing military, national-security, protective-service or lawful-custody functions. These categories do not authorize general employer access to your records.

Written authorization and fundraising

We require your written authorization before using or disclosing your health information for marketing or selling your health information. Most uses and disclosures of separately maintained psychotherapy notes also require your written authorization; narrow exceptions allowed by law remain, such as use by the treating professional who created the notes. An ordinary mental-health diagnosis or progress record is not automatically a separately maintained psychotherapy note.

We will obtain your written authorization before using your health information to solicit donations. You may decline or stop fundraising messages without affecting care or payment. If records protected by 42 CFR Part 2 would be used, we will also give the advance choice required by that rule. Viewing or acknowledging this notice gives no fundraising permission.

Uses or disclosures not described in this notice require your written authorization. You may revoke an authorization in writing through the privacy contact. Revocation stops future reliance on it, but cannot undo actions already taken in reliance on it. Other legally permitted limits on revocation will be described when relevant to the authorization.

Additional protection for substance use disorder records

Some records from federally assisted substance use disorder programs are protected by 42 CFR Part 2. If we receive or maintain such records, we comply with those protections in addition to HIPAA. A reference to substance use in an ordinary medical record does not automatically make every record a Part 2 record.

Uses or disclosures of Part 2 records require the consent or specific legal exception applicable to that record and purpose. When a valid consent permits treatment, payment and health care operations, HIPAA-covered recipients and business associates may use and redisclose the records as those rules permit, subject to Part 2's continuing restrictions. Revocation operates prospectively under the applicable rules; it does not recover information already lawfully disclosed.

Part 2 records, and testimony about their contents, cannot be used or disclosed in civil, criminal, administrative or legislative investigations or proceedings against you without your specific written consent or an appropriate Part 2 court order. The court-order route requires the notice and opportunity to be heard that Part 2 provides to you or the record holder, together with a subpoena or other legal requirement compelling disclosure. A general treatment, payment and operations consent does not authorize use against you in such proceedings. These limits apply to every disclosure category in this notice.

State law and sensitive records

We apply a state or other law that gives your information greater protection or gives you additional rights. A general HIPAA permission does not override a stricter rule. The law relevant to the record and services can require separate permission or prohibit a disclosure that would otherwise be allowed.

For records governed by California's Confidentiality of Medical Information Act, we obtain the required authorization unless a specific mandatory or permissive exception applies. Administrative, treatment, payment or research disclosures must stay within those exceptions and any restrictions on further disclosure. We do not treat all HIPAA operations disclosures as automatically authorized under California law.

California law generally requires specific written authorization identifying the recipient for each disclosure of identifiable HIV test results, unless an express statutory exception applies. Certain mental-health-service records have separate California confidentiality protections; we disclose them only with the required permission or a specific legal exception. Confidential services that a minor may consent to can also be protected from disclosure to a parent or other representative.

Where California's lawful-abortion-record restrictions apply, we limit out-of-state access through electronic health records or a health information exchange to the specifically permitted circumstances. These can include an express authorization or a qualifying payment, administrative, review, research, patient-access or compulsory-disclosure exception. A general request from an out-of-state recipient does not remove those protections. Additional applicable protections for reproductive care, genetic information and other sensitive records remain in force.

Our duties, notice changes and complaints

We are required by law to protect the privacy of protected health information, provide this notice of our duties and privacy practices, and follow the notice currently in effect. We must notify affected individuals of a breach of unsecured protected health information without unreasonable delay and within applicable legal deadlines.

We may revise this notice as law allows and apply the revised practices to information we already hold as well as information received later. We identify the revised effective date, make the revised notice available on request and post it prominently on our service-information website. We also make it available at any applicable service-delivery location. We do not implement a material change before its notice is effective, except where the law requires otherwise. A notice change does not replace a consent or authorization the law requires.

You may complain to our privacy contact by telephone, email or mail. Explain your concern and how we can reach you; we can arrange an appropriate way to receive sensitive details. You may also complain directly to the U.S. Department of Health and Human Services, Office for Civil Rights, using its health information privacy complaint instructions, or by writing to Office for Civil Rights, U.S. Department of Health and Human Services, 200 Independence Avenue, S.W., Washington, D.C. 20201. You do not have to complain to us first. We will not retaliate against you for making a complaint or exercising a privacy right.

Privacy contact

Designated contact name or title: Brian, Privacy Officer

Telephone: (714) 242-8927

Email: privacy@thesystems.com.

Mail: Privacy Contact, A Squared Medical Corporation, PC, 10340 Beach Boulevard, Stanton, CA 90680.

Use this contact for requests, complaints, questions about this notice and requests for a paper copy. Please do not include detailed health information in ordinary email.