HIPAA Notice of Privacy Practices

Beyond Esthetics ("Beyond Esthetics," "we," "us," "our") is a healthcare technology platform that facilitates access to licensed healthcare providers for telehealth consultations. We are committed to protecting the privacy of our patients ("you," "your") and complying with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and applicable state privacy laws.

Privacy Officer contact: Beyond Esthetics, 2021 Park Ave West, Ontario, OH 44906. Email: beyondestheticsspa@gmail.com. Phone: (567) 560-5558.

"Protected Health Information" (PHI) is individually identifiable health information that relates to your past, present, or future physical or mental health, the provision of healthcare to you, or payment for that care. PHI includes information in any form: written, electronic, or oral.

We collect PHI that you provide, including:

• Name, date of birth, email address, phone number, and mailing address
• Health history, current medications, allergies, and lab results
• Consultation notes and treatment plans created by affiliated Providers
• Payment information (processed by our PCI-compliant payment processor)

We use and disclose your PHI only as permitted or required by law. Primary uses include:

• Treatment: sharing your PHI with Providers affiliated with Elite Care Health and with Rx Ave Health to facilitate your consultations, prescriptions, and care coordination.
• Payment: sharing your PHI with payment processors and, where applicable, payers, to process charges for services provided.
• Healthcare operations: using PHI for quality improvement, auditing, compliance monitoring, and Provider credentialing.
• Required by law: disclosing PHI when required by federal or state law, including to public health authorities, law enforcement (in limited circumstances), or the Department of Health and Human Services (HHS).
• Business associates: sharing PHI with vendors who help us operate, under written Business Associate Agreements (BAAs) that require them to protect your PHI to the same standard we do.

We do not sell your PHI. We do not use your PHI for marketing without your separate written authorization.

• Right to access: you may request a copy of your PHI. Requests will be fulfilled within 30 days. We may charge a reasonable fee for copies.
• Right to amend: if you believe PHI in your record is incorrect or incomplete, you may request an amendment.
• Right to an accounting of disclosures: you may request a list of disclosures of your PHI, other than those for treatment, payment, or healthcare operations.
• Right to request restrictions: you may request restrictions on how we use or disclose your PHI. We are not always required to agree, but we will consider your request.
• Right to confidential communications: you may ask us to contact you in a specific way or at a specific location.
• Right to a paper copy of this Notice upon request.
• Right to opt out of fundraising: we do not conduct fundraising. If we do in the future, you may opt out.

To exercise any of these rights, contact our Privacy Officer at beyondestheticsspa@gmail.com.

We implement administrative, physical, and technical safeguards to protect your PHI, including:

• Encryption of PHI in transit and at rest
• Access controls limiting PHI access to authorized personnel
• Audit logs tracking access to and changes of PHI
• HIPAA-compliant Business Associate Agreements with all third-party processors

In the event of a breach of unsecured PHI, we will notify affected individuals without unreasonable delay and within 60 days of discovery, as required by HIPAA's Breach Notification Rule. The notice will describe the breach, the types of information involved, steps you should take to protect yourself, and what we are doing to investigate and mitigate it.

We retain PHI for a minimum of seven (7) years from the date of service, or as otherwise required by applicable state law. When PHI is no longer needed, it is securely destroyed.

If you believe your privacy rights have been violated, you may file a complaint with:

• Beyond Esthetics Privacy Officer: beyondestheticsspa@gmail.com
• U.S. Department of Health and Human Services, Office for Civil Rights: https://www.hhs.gov/hipaa/filing-a-complaint

You will not be retaliated against for filing a complaint.

We reserve the right to change this Notice at any time. Updated versions will be posted on this page and will apply to all PHI we maintain. If we make a material change, we will notify you by email.

This HIPAA Notice of Privacy Practices is effective as of October 1, 2026.