Notice of Privacy Practices & Website Privacy Policy

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED, AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. IT ALSO DESCRIBES HOW WE COLLECT AND USE INFORMATION THROUGH OUR WEBSITE AND TELEHEALTH PLATFORM. PLEASE REVIEW IT CAREFULLY.

A. Our Commitment to Your Privacy

Pure Metabolics, LLC (“Pure Metabolics,” “we,” “us,” or “our”) provides telehealth hormone replacement therapy and weight management services. Because we handle medical information about our patients, we are required by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) to protect the privacy of Protected Health Information (“PHI”) and to give you this Notice explaining our legal duties and privacy practices.

This Notice applies to all PHI we create or receive about you, whether through a virtual visit, our patient portal, our website, or any other channel. We may revise this Notice from time to time; any revision applies to PHI we already have as well as PHI we create or receive afterward. The current version of this Notice will always be posted on our website, and you may request a paper copy at any time by contacting our Privacy Officer (see Section F).

B. How We May Use and Disclose Your PHI

We may use and disclose your PHI in the following ways without a separate written authorization from you:

1. Treatment

We may use your PHI to evaluate, diagnose, and treat you, and to coordinate your care — for example, ordering or reviewing lab work, adjusting a prescription, or consulting with our compounding pharmacy partner about a formulation. Our clinical staff, including our prescribing nurse practitioner, may share PHI with each other and with entities involved in delivering your care, such as our pharmacy or a laboratory.

2. Payment

We may use and disclose PHI to bill and collect payment for services, including sharing information with our payment processor as needed to verify eligibility, process a charge, or resolve a billing dispute. We disclose only the minimum information reasonably necessary for these purposes.

3. Health Care Operations

We may use PHI to run our practice — for example, to evaluate the quality of care we provide, train staff, conduct compliance reviews, or handle business planning.

4. Appointment & Treatment Reminders

We may contact you by phone, text message, email, or through the patient portal to remind you of an upcoming visit, a refill, or a lab follow-up.

5. Portal & Account Communications

Because we operate as a telehealth practice, we do not maintain a physical waiting room sign-in sheet. Identity verification and scheduling occur through our secure patient portal and intake process.

6. Treatment Options

We may use PHI to tell you about treatment alternatives or health-related programs that may be appropriate for you.

7. Health-Related Services & Marketing Communications

We may contact you about health-related benefits, services, or programs that may interest you. See Section G for how this relates to marketing text messages and emails specifically, and how you can opt out.

8. Disclosures to Family or Friends

We may share PHI relevant to your care with a family member, friend, or other person you identify as involved in your care, or who assists in paying for your care, unless you object.

9. As Required by Law

We will use or disclose PHI when required to do so by federal, state, or local law.

C. Notification in the Event of a Breach

If unsecured PHI is breached in a way that compromises its privacy or security, we are required by law to notify you.

D. Other Permitted Uses and Disclosures

In addition to the categories above, the law permits us to use or disclose PHI, generally without your written authorization, in these limited circumstances:

• To another provider or health plan for their own payment or health care operations activities, where they already have a relationship with you.
• For health care fraud and abuse detection or legal compliance activities.
• To a public health authority as required by law — for example, to report a communicable disease, a product defect, or suspected abuse or neglect.
• For health oversight activities such as audits, licensing reviews, or government investigations.
• In response to a court order, administrative order, or in limited cases a subpoena.
• For law enforcement purposes in narrow, legally defined circumstances.
• For military, national security, or other specialized government functions.
• To avert a serious and imminent threat to health or safety.
• For workers’ compensation purposes, as authorized by workers’ compensation law.
• To coroners, medical examiners, or funeral directors as necessary to carry out their duties.
• For organ, eye, or tissue donation purposes, if applicable.

Any use or disclosure not described in this Notice will be made only with your written authorization, which you may revoke at any time (except to the extent we already relied on it).

E. Your Rights Regarding Your PHI

• Right to access, inspect, and obtain a copy of your PHI, including in electronic form if we maintain it electronically.
• Right to request an amendment to your PHI if you believe it is incomplete or incorrect. We may decline the request in certain circumstances and will explain why.
• Right to request an accounting of certain disclosures of your PHI made in the six years before your request (this does not include disclosures for treatment, payment, or health care operations).
• Right to request restrictions on certain uses or disclosures of your PHI, including a right to restrict disclosure to a health plan for services you have paid for out of pocket in full.
• Right to request confidential communications, such as being contacted only at a particular phone number or email address.
• Right to receive a paper copy of this Notice upon request, even if you have agreed to receive it electronically.
• Right to file a complaint with us or with the U.S. Department of Health and Human Services if you believe your privacy rights have been violated, without fear of retaliation.

F. Complaints & Contact Information

If you have questions about this Notice or wish to exercise any of the rights described above, please contact our Privacy Officer:

Carolina Townsend, Privacy Officer & Co-Owner
Pure Metabolics, LLC
1942 E 900 N, Spanish Fork, UT 84660-6210
801-513-3381
wellness@puremetabolics.com

You may also file a complaint with the Secretary of the U.S. Department of Health and Human Services, Office for Civil Rights, either through their online portal at www.hhs.gov/ocr/complaints or by mail to the regional office serving Utah:

HHS Office for Civil Rights — Rocky Mountain Region (CO/UT)
1961 Stout Street, Room 08-148
Denver, CO 80294
Phone: 800-368-1019

G. Website Use, Cookies & Marketing Communications

Information We Collect

Through our website and patient portal, we may collect information you provide directly (such as your name, contact details, and health history submitted during intake) and information collected automatically (such as IP address, browser type, and pages visited, typically through cookies or similar tracking technologies).

How We Use It

We use this information to schedule and deliver care, process payment, operate and improve our website, and — where you’ve consented — to send you appointment reminders and marketing communications.

Consent to Communications

By providing your contact information, you consent to receive communications from Pure Metabolics by email, text message, and phone call — including through automated systems — regarding appointments, treatment, and promotional content. Message and data rates may apply, and message frequency may vary. You may opt out of text messages at any time by replying “STOP,” and may unsubscribe from marketing emails using the link in any such email. Calls may be recorded for quality and training purposes. Consent to marketing communications is never a condition of receiving treatment.

Sharing

We do not sell your personal information. We may share information with service providers who help us operate — for example, our EMR platform, payment processor, and compounding pharmacy partner — under agreements that require them to protect your information, and as otherwise described in this Notice.

Cookies

Our website may use cookies and similar technologies to support functionality, analytics, and advertising.

H. Your State Privacy Rights

Depending on where you live, you may have additional rights under state law regarding your personal information — for example, the right to know what information we collect, to request deletion, or to opt out of certain kinds of data sharing.

• Utah residents: the Utah Consumer Privacy Act may give you rights to access, delete, and opt out of certain processing of your personal data.

We are a telehealth practice currently licensed to treat patients located in Utah. If our service area expands, this Notice will be updated accordingly.

I. Medical, Compounding & Telehealth Disclosures

• Information provided on our website, in our marketing, and through our platform is for educational purposes and is not a substitute for individualized medical advice.
• Hormone replacement and weight management treatment is provided only after clinical evaluation by a licensed provider and is individualized to each patient; results vary.
• Some treatments involve compounded medications prepared by a licensed compounding pharmacy. Compounded medications are not reviewed or approved by the FDA for safety, effectiveness, or quality in the same way as FDA-approved drugs.
• All patients are required to review and sign informed consent documentation before starting treatment.
• Telehealth services are currently available only in Utah.

J. Changes to This Notice

We reserve the right to change this Notice at any time. Any changes will apply to PHI we already maintain as well as PHI we create or receive going forward. The most current version will always be available on our website.