HIPAA Notice of Privacy Practices

Effective Date: February 16, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND
DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT
CAREFULLY.

Scope of Notice

This Notice of Privacy Practices (“Notice”) applies to all Protected Health Information about you held or
transmitted by Reflections Orthodontics (“we”, “our”, “us”). Protected Health Information is any
individually identifiable health information about your past, present, or future physical or mental health
condition or payment for healthcare or about the provision of care to you. Protected Health Information
may include information about your condition or treatment, diagnostic tests and images, and related
dental or other health information.

Our Responsibilities

We are required by law to maintain the privacy of Protected Health Information, to provide individuals
with notice of our legal duties and privacy practices with respect to protected health information, and to
notify affected individuals following a breach of unsecured protected health information. We must follow
the privacy practices that are described in this Notice while it is in effect.
You may request a copy of our Notice at any time. For more information about our privacy practices, or
for additional copies of this Notice, please contact us using the information listed at the end of this Notice.

How We May Use and Disclose Your Protected Health Information

The following categories describe the different ways that we may use and disclose your Protected Health
Information without an authorization. For all the following categories, when state or federal law
(including the substance use disorder requirements at 42 CFR Part 2) is more restrictive, we are required
to follow the more restrictive state applicable law. Not every use or disclosure in a category will be
listed. Your Protected Health Information may be stored in paper, electronic or other form and may be
disclosed electronically and by other methods:

Treatment. We may use and disclose your Protected Health Information for your treatment. For example,
we may disclose your Protected Health Information to a specialist providing treatment to you.

Payment. We may use and disclose your Protected Health Information to obtain reimbursement for the
treatment and services you receive from us or another entity involved with your care. Payment activities
include billing, collections, claims management, and determinations of eligibility and coverage to obtain
payment from you, an insurance company, or another third party. For example, we may send claims to
your dental health plan containing certain Protected Health Information.

Healthcare Operations. We may use and disclose your Protected Health Information in connection with
our healthcare operations. Healthcare operations include quality assessment and improvement activities,
arranging for legal services, conducting training programs, reviewing the competence and qualifications
of healthcare professionals, and licensing activities. We may also use your Protected Health Information
to notify you about our health-related products and services, to recommend possible treatment options or
alternatives that may be of interest to you, to send you patient satisfaction surveys, or to send you appointment
reminders. We may make incidental disclosures of limited Protected Health Information, such as by using sign-in
sheets in our waiting rooms or calling out names in our waiting rooms when calling back patients for their appointments.

Business Associates. We may disclose your Protected Health Information to one or more of our service
providers, known as “business associates,” in order for them to provide services to us or on our behalf
pursuant to a written business associate agreement. Our business associates are required to safeguard your
Protected Health Information.

Health Information Exchanges. We may participate in one or more Health Information Exchanges
(HIEs) and may electronically share your Protected Heath Information for treatment, payment, healthcare
operations and other permitted purposes with other participants in the HIE. HIEs allow your health care
providers to efficiently access and use your PHI as necessary for treatment and other lawful purposes.

Individuals Involved in Your Care or Payment for Your Care. We may disclose your Protected Health
Information to your family or friends, or any other individual identified by you when they are involved in
your care or in the payment for your care. Additionally, if a person has the authority by law to make
health care decisions for you, we may disclose information about you to such patient representative and
treat that patient representative the same way we would treat you with respect to your Protected Health
Information. We may also disclose your Protected Health Information to a public or private entity
authorized by law to assist in disaster relief efforts to notify, or assist in notifying, a family member or
personal representative about your location, general condition, or death.

Required by Law. We may use or disclose your Protected Health Information when we are required to do
so by law, such as to report suspected abuse or neglect.

Public Health Activities. We may disclose your Protected Health Information for public health activities,
such as to prevent or control disease, injury or disability, report child abuse or neglect, or notify a person
of a recall, repair, or replacement of products or services.

Abuse, Neglect or Domestic Violence. If we reasonably believe that you are a victim of abuse, neglect, or
domestic violence, we may disclose protected health information about you to a government authority,
including a social service protective agency, authorized by law to receive reports of abuse, neglect or
domestic violence.

Health Oversight Activities. We may disclose your Protected Health Information to a health oversight
agency for activities authorized by law, such as audits, investigations, inspections, and licensure actions.
For example, we may disclose Protected Health Information about you to the U.S. Department of Health
and Human Services if it requests such information to determine that we are complying with federal
privacy law.

Law Enforcement. We may disclose your Protected Health Information for law enforcement purposes as
permitted by HIPAA, as required by law, or in response to a subpoena or court order.

Judicial and Administrative Proceedings. We may disclose your Protected Health Information in
response to a court or administrative order. We may also disclose health information about you in
response to a subpoena, discovery request, or other lawful process instituted by someone else involved in
the dispute, but only if efforts have been made, either by the requesting party or us, to tell you about the
request or to obtain an order protecting the information requested.

Serious Threat to Health or Safety. We may disclose your Protected Health Information when permitted
by law to avert a serious and imminent threat to the health or safety of a person or the public.

Specialized Government Functions. To the extent applicable, we may release your Protected Health
Information for specialized government functions, including military and veterans activities, national
security and intelligence activities, and correctional institutions.

Worker’s Compensation. We may disclose your Protected Health Information to the extent authorized by
and to the extent necessary to comply with laws relating to worker’s compensation or other similar
programs established by law.

Coroners, Medical Examiners, and Funeral Directors. We may release your Protected Health
Information to a coroner or medical examiner. This may be necessary, for example, to identify a deceased
person or determine the cause of death. We may also disclose your Protected Health Information to
funeral directors consistent with applicable law to enable them to carry out their duties.

Research. We may use or disclose your Protected Health Information for research in limited
circumstances, including when an institutional review board or privacy board has reviewed the research
proposal and established a process to ensure the privacy of the requested information and approves the
research.

Limited Data and De-identified Data. We may remove most information that identifies you from a set of
data and use and disclose this data set for research, public health and healthcare operations, provided the
recipients of the data set agree to keep it confidential. We may also de-identify your Protected Health
Information and use and disclose the de-identified information for purposes permitted by law.

SUD Treatment Information. If we receive or maintain any information about you from a substance use
disorder (“SUD”) treatment program that is covered by 42 CFR Part 2 (a “Part 2 Program”) through a
general consent you provide to the Part 2 Program to use and disclose the SUD record for purposes of
treatment, payment or health care operations, we may use and disclose your SUD record for treatment,
payment and health care operations purposes as described in this Notice. If we receive or maintain your
SUD record through specific consent you provide to us or another third party, we will use and disclose
your SUD record only as expressly permitted by you in your consent as provided to us. In no event will
we use or disclose your SUD record, or testimony that describes the information contained in your SUD
record, in any civil, criminal, administrative, or legislative proceedings by any Federal, State, or local
authority, against you, unless authorized by your consent or the order of a court after it provides you
notice of the court order. A court order authorizing use or disclosure must be accompanied by a subpoena
or other legal requirement compelling disclosure before the requested substance use disorder record is
used or disclosed.

Other Uses and Disclosures of Protected Health Information

In any other situation not identified in this Notice, we will ask for your written authorization before using
or disclosing information about you. Most uses and disclosures of Protected Health Information for
marketing purposes and disclosures that constitute a sale of health information will be made only with
your written authorization. You may revoke an authorization in writing at any time. Upon receipt of the
written revocation, we will stop using or disclosing your Protected Health Information, except to the
extent that we have already taken action in reliance on the authorization.

Your Protected Health Information Rights

Right to Access. You have the right to inspect and obtain copies of your Protected Health Information
that we maintain or to direct us to send your Protected Health Information stored in an electronic health
record to another person designated by you, with limited exceptions, as provided by 45 CFR § 164.524.
You must make the request in writing at the address listed at the end of this Notice. In most cases, we will
provide access to you or the person you designate within 30 days of your request. If you request
information that we maintain on paper, we may provide photocopies. If you request information that we
maintain electronically, you have the right to an electronic copy. We will use the form and format you
request if readily producible. We will charge you a reasonable cost-based fee for the cost of supplies and
labor of copying, and for postage if you want copies mailed to you. If you are denied a request for access,
in certain circumstances you have the right to have the denial reviewed in accordance with the
requirements of applicable law.

Right to Request Amendment. You have a right to request that we amend your Protected Health
Information if you believe the information is not accurate or is incomplete, as provided by 45 CFR §
164.526. To request an amendment of your health information, you must submit your request in writing to
the address listed at the end of this Notice. Your request must explain why the information should be
amended. We may deny your request under certain circumstances.

Right to an Accounting of Disclosures. You have a right to receive an accounting of certain disclosures
of your Protected Health Information, as provided by 45 CFR § 164.528. To request an accounting of
disclosures of your health information, you must submit your request in writing to the address listed at the
end of this Notice.

Right to Request a Restriction. You have the right to request additional restrictions on certain uses and
disclosures of your Protected Health Information for treatment, payment or healthcare operations, as
provided by 45 CFR § 164.522(a). You must make your request in writing. We are not required to agree
to your request, except we are required to agree in the case where your request is to restrict disclosures to
a health plan for purposes of carrying out payment or healthcare operations, and the information pertains
solely to a health care item or service for which you, or a person on your behalf (other than the health
plan), has paid our practice in full.

Right to Alternative Communication. You have the right to request that we communicate with you about
your Protected Health Information by alternative means or at alternative locations, as provided by 45 CFR
§ 164.522(b). You must make your request in writing. Your request must specify the alternative means or
location and provide satisfactory explanation of how payments will be handled under the alternative
means or location you request. We will accommodate all reasonable requests. However, if we are unable
to contact you using the ways or locations you have requested, we may contact you using the information
we have.

Right to a Paper Copy of this Notice. You have a right to obtain a paper copy of this Notice upon request.

Changes to this Notice

We reserve the right to change our privacy practices and the terms of this Notice at any time, provided
such changes are permitted by applicable law, and to make new Notice provisions effective for all
Protected Health Information that we maintain. When we make a material change in our privacy
practices, we will change this Notice and post the new Notice clearly and prominently at our practice
location, and we will provide copies of the new Notice upon request.

Complaints or Request for More Information

If you want more information about our privacy practices, please contact us as the address below. If you
believe your privacy rights may have been violated, you can file a complaint with the Privacy Officer
listed below or with the Office for Civil Rights, U.S. Department of Health and Human Services. You
will not be retaliated against in any way for filing a complaint.