Notice of Privacy Practices

Our Pledge to You

At Regenerative Performance, we understand that health information about you is personal. We are committed to protecting it. This Notice tells you how we may use and share your protected health information (“PHI”) and your rights regarding that information. We are required by law to:

• Protect the privacy of your health information
• Provide you with this Notice of our legal duties and privacy practices
• Follow the terms of the Notice currently in effect
• Notify you in the event of a breach affecting your unsecured health information

---

Who Follows This Notice

This Notice applies to the practice of Regenerative Performance, PLLC, including:

• Dr. Drew Timmermans, ND, RMSK (orthobiologic medicine, musculoskeletal ultrasound, regenerative injections)
• Dr. Kaitlyn Myers, ND (internal medicine, bioidentical hormone replacement, women’s health, chronic infections, medical aesthetics)
• Dr. Jack Meister, ND and all other licensed providers, associates, employees, staff, and contractors of Regenerative Performance
• All locations where we provide care, whether in person at our Gilbert clinic or through telehealth

---

What Information Is Covered

“Protected Health Information” or “PHI” means any individually identifiable information about your past, present, or future physical or mental health, the care you receive from us, or payment for that care. This includes your name, date of birth, address, phone number, email, medical history, examination findings, lab results, imaging, diagnoses, treatment plans, prescriptions, procedure records, and billing information.

---

How We May Use and Disclose Your Health Information Without Your Authorization

Federal law permits us to use or share your PHI without your written authorization for the following purposes:

For Treatment

We use and share your information to provide, coordinate, or manage your health care. A physician at Regenerative Performance may share your lab results, imaging, or treatment plan with another physician at the practice involved in your care. We may share your information with specialists, imaging centers, physical therapists, or other providers when a referral is needed. During a procedure, members of our clinical team will have access to the records needed to perform that procedure safely. For telehealth appointments, your information is shared only with the provider conducting the visit using a secure telehealth platform.

For Payment

We use and share your information to bill for the services we provide. Regenerative Performance does not accept insurance. We are a cash-pay practice. Payment-related uses include:

• Processing credit card, debit card, or check payments for services rendered
• Storing payment information securely in our accounting system for recurring charges, cancellation fees, or future visits, with your consent
• Generating itemized receipts or insurance superbills at your request for you to submit to your insurer (we do not submit these ourselves)
• Collecting unpaid balances through our billing staff or, if necessary, a collection agency under a written confidentiality agreement

For Health Care Operations

We use and share your information to run our practice, including:

• Quality improvement activities such as case reviews and outcomes tracking
• Submitting de-identified outcomes data to the DataBiologics national outcomes registry (only with your separate written consent at the time of your procedure)
• Training our staff
• Licensing, credentialing, and accreditation activities
• Planning, management, and general administration
• Customer service and resolving complaints

As Required by Law

We will disclose your information when required by federal, state, or local law, including reporting to public health authorities, responding to subpoenas or court orders, cooperating with law enforcement in specific situations permitted by law, reporting to the FDA regarding adverse events, and complying with workers’ compensation laws.

For Public Health and Safety

We may share your information to prevent or reduce a serious and imminent threat to your health or safety or that of another person or the general public.

For Specialized Government Functions

We may disclose information about active military members to authorized military authorities, to correctional institutions for inmates, and for national security activities authorized by law.

---

Uses and Disclosures Requiring Your Written Authorization

We will not use or share your PHI for the following purposes without your written authorization:

• Marketing communications that describe a product or service and would result in us being paid by a third party. Our regular educational emails, appointment reminders, and patient newsletters are not considered marketing under HIPAA and do not require separate authorization.
• Sale of your PHI (we have never done this and have no plans to)
• Disclosure of psychotherapy notes, if applicable
• Fundraising communications that identify you personally

You may revoke any authorization you give us in writing at any time, except to the extent we have already acted in reliance on it.

About Our Marketing and Communications

When you become a patient at Regenerative Performance, we may send you appointment confirmations and reminders by email, phone, text, or patient portal message; educational information about services, protocols, and new offerings; and our newsletter and occasional promotional emails if you opt in separately.

You can opt out of any non-essential communication at any time by replying STOP to a text, clicking unsubscribe in an email, or contacting our office. Opting out of marketing does not affect appointment reminders, payment reminders, or clinically necessary communications while you are an active patient.

We do not sell your name, contact information, or health information to any third party for marketing, research, or advertising purposes.

---

Your Rights Regarding Your Health Information

You have the following rights with respect to your PHI. To exercise any of these rights, please submit your request in writing to:

Right to Inspect and Copy

You have the right to inspect and receive a copy of your PHI that we use to make decisions about your care. Submit a written request and we will provide access or copies within 30 days (with one 30-day extension if needed). We may charge a reasonable cost-based fee for copies as permitted by Arizona law.

Right to Request Amendment

If you believe information in your record is incorrect or incomplete, you may ask us to amend it in writing with a supporting reason. We may deny your request if the information was not created by us, is not part of the records we maintain, or is already accurate and complete. If we deny your request, we will tell you why in writing.

Right to an Accounting of Disclosures

You have the right to request a list of certain disclosures we have made of your PHI for purposes other than treatment, payment, or health care operations. Your request must cover a time period of no more than six years. The first accounting in any 12-month period is free; additional requests may have a reasonable fee.

Right to Request Restrictions

You have the right to request a restriction on how we use or disclose your PHI. If you pay for a service in full, out of pocket, at the time of service and request that we not share information about that service with a health insurer, we must honor that request, provided disclosure is not otherwise required by law. Because Regenerative Performance is a cash-pay practice, this restriction applies to every service you receive from us, if you request it.

Right to Request Confidential Communications

You have the right to request that we communicate with you about medical matters in a specific way or at a specific location (for example, only at a specific phone number or only by email). We will accommodate reasonable requests.

Right to a Paper Copy of This Notice

You have the right to a paper copy of this Notice at any time, even if you have agreed to receive it electronically. Request a paper copy from our front desk staff.

Right to Be Notified of a Breach

You have the right to be notified following a breach of your unsecured PHI. We will notify you in writing within 60 days of discovery, consistent with HIPAA’s Breach Notification Rule and Arizona Revised Statutes § 18-552.

Right to File a Complaint

If you believe your privacy rights have been violated, you may file a complaint with our Privacy Officer or with the U.S. Department of Health and Human Services. You will not be retaliated against for filing a complaint.

• Regenerative Performance Privacy Officer: office@regenerativeperformance.com or (480) 508-4226
• HHS Office for Civil Rights: 200 Independence Avenue SW, Washington, DC 20201 | 1-877-696-6775 | hhs.gov/ocr

---

Our Responsibilities

We are required by law to:

• Maintain the privacy and security of your protected health information
• Provide you with this Notice of our legal duties and privacy practices with respect to your PHI
• Abide by the terms of the Notice currently in effect
• Notify you if a breach of your unsecured PHI occurs
• Not use or disclose your PHI in ways not described in this Notice without your written authorization

---

Changes to This Notice

We reserve the right to change this Notice and make the new Notice effective for all PHI we maintain. When we make a significant change, we will post the revised Notice on our website, make the new Notice available at our clinic, and give a copy to patients at their next visit.

---

Email and Electronic Communication

Email is not a secure method of communication. While we use email for administrative purposes, we do not recommend sending detailed health information by email. For confidential communication with your provider, please use our patient portal (Power2Patient) or call our office directly.

---

Contact Us

If you have questions about this Notice, want to exercise any of your rights, or want to report a concern, please contact us: