Understanding your health record and information

This notice describes the practices of Serene Medical Spa LLC regarding the protected health information created while you are a patient. It applies to all records of your care maintained by Serene Medical Spa LLC at both of our locations — Serene Med Spa of Hudson, Ohio, and Serene Med Spa of Barboursville, West Virginia — and to all of our providers and personnel who have access to those records.

We create a record of the care and services you receive from us. We understand that medical information about you and your health is personal. The Health Insurance Portability and Accountability Act of 1996 (HIPAA) requires that all protected health information we use or disclose — whether electronically, on paper, or spoken aloud — be kept confidential, and we are committed to protecting it.

This notice explains the ways we may use and disclose medical information about you. It also describes your rights and our obligations regarding that information.

Your health information rights

While your health record is the physical property of Serene Medical Spa LLC, the information in it belongs to you. You have the right to:

• Inspect and request a paper or electronic copy of your health record, as provided by law.
• Request amendments to your health record, as provided by law. We will notify you if we are unable to grant your request.
• Request that we communicate your health information by alternative means or at alternative locations. We will accommodate reasonable requests.
• Request restrictions on certain uses and disclosures of your information for treatment, payment, and health care operations, and on disclosures to people involved in your care, including family members. We are not required by law to agree to a requested restriction, except where it relates to a disclosure to your health insurer for an item or service you paid for out-of-pocket and in full.
• Obtain an accounting of disclosures of your health information, as provided by law.
• Obtain a paper copy of this notice.
• Choose someone to act for you. If you have given someone medical power of attorney, or if someone is your legal guardian, that person can exercise your rights and make choices about your health information. We will verify that person's authority before taking action.
• Revoke an authorization you previously gave, in writing, at any time — including an authorization for photographs or marketing. We will honor the revocation except to the extent we have already acted in reliance on it.

To exercise any of these rights, submit a written request to our Privacy Officer at info@serenemedspas.com.

Our responsibilities

In addition to honoring the rights described above, we are required to:

• Maintain the privacy of your health information.
• Notify you of any unauthorized acquisition, access, use, or disclosure of your protected health information, subject to certain exceptions under the law.
• Provide you with this notice of our legal duties and privacy practices.
• Abide by the terms of this notice.
• Notify you if we are unable to agree to a requested restriction on certain uses and disclosures.

Uses and disclosures that do not require your authorization

The categories below describe the ways we may use and disclose medical information without your authorization. Not every use or disclosure is listed individually, but every use or disclosure we are permitted to make without your authorization falls within one of these categories.

Treatment

We may disclose medical information about you to physicians, nurses, technicians, and other personnel involved in your care. We may share information to coordinate different treatments, such as prescriptions, laboratory work, and imaging. We may also provide your physician or a subsequent health care provider with copies of reports to assist in treating you after your care with us.

Payment

We may use and disclose your health information for payment purposes. For example, a bill may be sent to you or to a third-party payer. That bill may include information identifying you, along with your diagnosis, the procedures performed, and supplies used.

Health care operations

We may use and disclose your health information for regular health care operations. For example, we may review information in your record to assess the care and outcomes in your case and others, in order to continually improve the quality and effectiveness of the care we provide.

Other uses and disclosures allowed by law

• Business associates. We may share information with companies that perform services for us, such as our electronic records vendor, billing services, and answering services. These companies are contractually required to safeguard your information.
• Notification. Unless you object, we may use or disclose information to notify or help notify a family member, personal representative, or another person responsible for your care about your location and general condition.
• Individuals involved in your care. Unless you object, we may disclose information relevant to their involvement to a family member, relative, close personal friend, or another person you identify.
• Disaster relief. We may disclose information to public or private disaster relief organizations to coordinate your care or notify family or friends of your location or condition.
• Research. We may disclose information to researchers when their research has been approved by an institutional review board with protocols in place to protect your privacy.
• Appointment reminders and health-related communications. We may contact you with appointment reminders or with information about treatment alternatives and other health-related benefits and services that may interest you.
• FDA. We may disclose information to the U.S. Food and Drug Administration regarding adverse events involving medications, devices, supplements, or products, including product defects and post-marketing surveillance.
• Workers' compensation. We may disclose information to comply with laws relating to workers' compensation or similar programs.
• Public health. We may disclose information to public health or legal authorities charged with preventing or controlling disease, injury, or disability.
• Abuse, neglect, or domestic violence. We may disclose information to governmental authorities authorized by law to receive such reports.
• Judicial, administrative, and law enforcement purposes. We may disclose information for these purposes consistent with applicable law.
• Health oversight activities. We may disclose information to health oversight agencies for activities authorized by law, including audits, investigations, inspections, and licensure.
• Threats to health or safety. We may use or disclose information when necessary to prevent or lessen a serious and imminent threat to health or safety.
• Special government functions. We may disclose information to authorized federal officials for national security and intelligence activities or protective services. If you are a member of the armed forces, we may disclose information to military authorities. If you are an inmate or in the custody of law enforcement, we may disclose information necessary for your health and safety or that of others.
• Required or allowed by law. We will disclose information when required or permitted by federal, state, or local law.

Where West Virginia or Ohio law provides greater protection for certain categories of health information than HIPAA does, we follow the more protective standard.

Photographs and images

Photographs of you taken in the course of your care — including before-and-after images, clinical progress photographs, and video — are part of your protected health information and are treated as such.

For your care. We may take and use clinical photographs as part of treatment planning, documentation of your results, and our own quality review, in the same way we use the rest of your record. This does not require separate authorization.

For marketing. We will never use your image in advertising, on our website, on social media, in printed materials, or in any other promotional setting without your separate written authorization. That authorization will tell you specifically where your images may appear. It is entirely your choice, and your care and pricing will be exactly the same whether you sign it or not.

Withdrawing permission. You may revoke a photography authorization at any time by writing to our Privacy Officer. On receiving your revocation, we will stop using your images going forward and remove them from materials we control, including our own website and social media accounts. We cannot retrieve materials that have already been printed, distributed, shared, or copied by others before we received your request.

Electronic health records

We use a third-party vendor to maintain our electronic medical record system and to store your electronic health information. That vendor is bound by a business associate agreement requiring it to protect your information. We monitor access to your record and limit it to personnel with a legitimate need.

Our public website, appointment forms, and marketing systems are separate from that record system. Please do not send medical details through website forms or ordinary email, as neither is a secure channel.

When we need your written authorization

Any use or disclosure outside the categories described above will be made only with your written authorization. In particular, your written authorization is required for most uses and disclosures of psychotherapy notes, for the use of your protected health information for marketing purposes, and for any sale of protected health information.

We do not sell protected health information.

You may revoke an authorization in writing at any time, and we are required to honor that revocation, except to the extent we have already taken action in reliance on it.

Questions and complaints

If you have questions about this notice or need more information, contact our Privacy Officer using any of the details above.

If you believe your privacy rights have been violated, you may send a complaint to our Privacy Officer in writing at info@serenemedspas.com, or by telephone at either location.

You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, Centralized Case Management Operations, 200 Independence Ave. S.W., Suite 515F, HHH Building, Washington, D.C. 20201. You may contact the Customer Response Center at (800) 368-1019, by fax at (202) 619-3818, by TDD at (800) 537-7697, or by email at ocrmail@hhs.gov. Complaint forms are available at hhs.gov/hipaa/filing-a-complaint.

There will be no retaliation against you for filing a complaint.

Changes to this notice

We may change our privacy policies and this notice at any time, and any changes will apply to all protected health information we maintain. When this notice is revised, we will post the current version on this page and at each of our locations, and you may request a written copy of any updated version.

This notice is effective as of August 16, 2026. It replaces the version originally effective June 1, 2024.