Notice of Privacy Practices

Notice of Privacy Practices for Protected Health Information

Effective Date: August 2025

Our Commitment to Your Privacy

Desert Dexa Inc. ("Desert Dexa," "we," "us," or "our") is committed to protecting the privacy of your health information. Although we are not a covered entity under HIPAA (Health Insurance Portability and Accountability Act), we voluntarily comply with HIPAA privacy standards to ensure the highest level of protection for your health information.

This Notice describes how we may use and disclose your Protected Health Information (PHI) to carry out treatment, payment, or healthcare operations and for other purposes that are permitted or required by law. It also describes your rights to access and control your PHI.

Understanding Your Health Record/Information

Each time you receive a DEXA scan from Desert Dexa, a record of your visit is made. This record typically contains your symptoms, examination and test results, diagnoses, treatment, and a plan for future care or treatment. This information serves as a:

• Basis for planning your care and treatment
• Means of communication among health professionals who contribute to your care
• Legal document describing the care you received
• Tool for you to track changes in your body composition and bone density over time

How We May Use and Disclose Your Health Information

For Treatment

We may use your health information to provide you with DEXA scanning services. We may disclose health information about you to other healthcare providers involved in your care, but only with your written authorization.

For Payment

We may use and disclose your health information to obtain payment for services we provide to you. Since we do not accept insurance and operate on a cash-pay basis, this use is limited to processing your direct payments.

For Healthcare Operations

We may use and disclose your health information for our healthcare operations, including:

• Quality assessment and improvement activities
• Reviewing the competence or qualifications of our staff
• Conducting training programs
• Accreditation, certification, licensing, or credentialing activities

As Required by Law

We will disclose your health information when required to do so by federal, state, or local law.

To Avert a Serious Threat to Health or Safety

We may use and disclose your health information when necessary to prevent a serious threat to your health and safety or the health and safety of the public or another person.

Business Associates

We may disclose your health information to our business associates who perform functions on our behalf or provide us with services if the information is necessary for such functions or services. All of our business associates are obligated to protect the privacy of your information.

Uses and Disclosures That Require Your Authorization

Other uses and disclosures of your health information not covered by this Notice will be made only with your written authorization. These include:

• Marketing purposes
• Sale of your health information
• Sharing with family members or friends (unless you give verbal permission)
• Research purposes

You may revoke an authorization at any time in writing, except to the extent that we have already taken action based on the authorization.

Your Rights Regarding Your Health Information

Right to Inspect and Copy

You have the right to inspect and receive copies of your health information that may be used to make decisions about your care. To inspect and copy your health information, submit a written request to our Privacy Officer. We will provide copies within 30 days of your request.

Right to Amend

If you believe that health information we have about you is incorrect or incomplete, you may ask us to amend the information. You have the right to request an amendment for as long as the information is kept by Desert Dexa.

Right to an Accounting of Disclosures

You have the right to request an accounting of disclosures of your health information made by us for purposes other than treatment, payment, and healthcare operations.

Right to Request Restrictions

You have the right to request a restriction or limitation on the health information we use or disclose about you. We are not required to agree to your request, but if we do, we will comply with your request unless the information is needed for emergency treatment.

Right to Request Confidential Communications

You have the right to request that we communicate with you about health matters in a certain way or at a certain location. We will accommodate reasonable requests.

Right to a Paper Copy of This Notice

You have the right to a paper copy of this Notice at any time, even if you have agreed to receive this Notice electronically.

Right to Be Notified of a Breach

You have the right to be notified in the event that we discover a breach of your unsecured PHI.

Our Responsibilities

Desert Dexa is required to:

• Maintain the privacy of your health information
• Provide you with this Notice of our legal duties and privacy practices
• Abide by the terms of this Notice
• Notify you if we are unable to agree to a requested restriction
• Accommodate reasonable requests for confidential communications
• Notify you promptly if a breach occurs that may have compromised the privacy or security of your information

Changes to This Notice

We reserve the right to change this Notice and to make the revised Notice effective for health information we already have about you as well as any information we receive in the future. We will post a copy of the current Notice in our facility and on our website. The Notice will contain the effective date on the first page.

Complaints

If you believe your privacy rights have been violated, you may file a complaint with Desert Dexa or with the Secretary of the Department of Health and Human Services. To file a complaint with Desert Dexa, contact our Privacy Officer at the address below. All complaints must be submitted in writing. You will not be penalized for filing a complaint.

Contact Information

If you have questions about this Notice or want to exercise any of your rights, please contact:

Other Uses of Health Information

Other uses and disclosures of health information not covered by this Notice or the laws that apply to us will be made only with your written permission. If you provide us permission to use or disclose health information about you, you may revoke that permission, in writing, at any time. If you revoke your permission, we will no longer use or disclose health information about you for the reasons covered by your written authorization. You understand that we are unable to take back any disclosures we have already made with your permission.