THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN ACCESS THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Effective Date: January 15, 2026

OUR LEGAL DUTIES AND PRIVACY COMMITMENT

Hair Restoration Institute of Minnesota (“we,” “our,” or “the Practice”) is committed to protecting the privacy of your medical information. We are required by federal law (the Health Insurance Portability and Accountability Act of 1996, or “HIPAA”) and applicable Minnesota law to:

• Maintain the privacy and security of your Protected Health Information (“PHI”);
• Provide you with this Notice describing our legal duties and privacy practices;
• Follow the terms of this Notice currently in effect; and
• Notify you following a breach of unsecured PHI as required by law.

PHI is information that identifies you and relates to your past, present, or future physical or mental health condition, the health care services provided to you, or payment for those services. This Notice applies to all records of your care created or maintained by the Practice.

IMPORTANT NOTE: MINNESOTA LAW PREEMPTION

Where Minnesota law provides greater privacy protection than federal law (HIPAA), we will follow the stricter requirements of Minnesota law. Specifically, the Minnesota Health Records Act (Minn. Stat. § 144.293) generally requires your specific consent to release health records to third parties, even for treatment or payment purposes, unless a specific statutory exception applies. While this Notice describes how HIPAA permits us to use your information, we will comply with Minnesota’s stricter consent requirements whenever applicable.

USES AND DISCLOSURES OF PHI (SUBJECT TO MINNESOTA LAW)

Under federal law, we are permitted to use and disclose your PHI for the following purposes. However, as noted above, we will obtain your specific consent for these disclosures where required by Minnesota state law.

1. Treatment We may use and disclose your PHI to provide, coordinate, or manage your health care, including:

• Sharing information with physicians, nurses, technicians, laboratories, pharmacies, and other health care professionals involved in your care;
• Coordinating care with other health care providers or facilities;
• Consulting with family members or others involved in your care when appropriate and permitted by law; and
• Arranging appointments, referrals, laboratory work, or related services

2. Payment We may use and disclose your PHI to obtain payment for services, including:

• Verifying insurance coverage or obtaining prior authorization;
• Submitting claims to health plans or third-party payers;
• Billing and collection activities; and
• Coordinating benefits with other coverage you may have.
• Note: If you pay for a service in full out of pocket, you have the right to request that we not disclose information about that service to your health plan, unless disclosure is otherwise required by law.

3. Health Care Operations We may use and disclose your PHI for health care operations to run our practice and ensure you receive quality care, including:

• Quality assessment, training, and internal administrative activities;
• Business planning, management, and general operations; and
• Customer service activities.

4. Electronic Communication (Text and Email)

• Risk Acknowledgement: By providing us with your mobile phone number or email address, you acknowledge that standard text messaging (SMS) and email are generally not secure methods of communication and there is a risk they could be intercepted or viewed by unauthorized parties.
• Consent to Contact: Unless you specifically request otherwise in writing, you agree that we may contact you via these methods for appointment reminders, routine post-operative instructions, and scheduling purposes.

5. Individuals Involved in Your Care

• We may disclose PHI to family members, friends, or others involved in your care if you are present and agree, or if you do not object when given the opportunity.
• If you are not present or are incapacitated, we may use professional judgment to determine whether disclosure is in your best interest and will limit disclosures to information directly relevant to your care or payment.

SPECIAL SITUATIONS WHERE DISCLOSURE IS PERMITTED OR REQUIRED BY LAW

We may use or disclose your PHI without your authorization in the following circumstances, as permitted or required by law:

• Public health and safety activities (including reporting abuse, neglect, or domestic violence);
• To prevent or lessen a serious and imminent threat to health or safety;
• To business associates that perform services on our behalf under written agreements requiring privacy protections;
• Organ and tissue donation;
• Military, veterans, and national security activities;
• Workers’ compensation programs;
• Health oversight activities (audits, investigations, inspections);
• Legal proceedings and law enforcement requests, including court orders and subpoenas (subject to Minnesota restrictions on release of records);
• Coroners, medical examiners, and funeral directors; and
• Research activities approved by an institutional review board or as otherwise permitted by law

USES AND DISCLOSURES THAT REQUIRE YOUR WRITTEN AUTHORIZATION

We will not use or disclose your PHI without your written authorization for purposes not described in this Notice, including:

• Photographs and Images: We will not use photographs of you, your scalp, or your medical outcomes for marketing materials, website galleries, social media, or advertising without a separate, specific written authorization from you.
• Marketing Communications: Marketing communications not otherwise permitted by law.
• Sale of PHI: We will not sell your PHI.
• Psychotherapy Notes: Use or disclosure of psychotherapy notes (if applicable).

You may revoke an authorization in writing at any time. Revocation will not affect actions already taken in reliance on the authorization.

INCIDENTAL DISCLOSURES

Certain incidental disclosures of PHI may occur as a byproduct of permitted uses or disclosures. We take reasonable steps to minimize such incidental disclosures and comply with applicable law.

YOUR RIGHTS REGARDING YOUR PHI

You have the following rights, subject to certain limitations:

• Right to Obtain a Copy of This Notice: You may request a paper copy of this Notice at any time.
• Right to Inspect and Obtain Copies of Your PHI: You may request access to or copies of your PHI in paper or electronic form. Requests must be made in writing. We may charge a reasonable, cost-based fee as permitted by law.
• Right to Request Restrictions: You may request restrictions on how we use or disclose your PHI. We are not required to agree, except for certain disclosures to health plans when you have paid in full out of pocket.
• Right to Receive Breach Notification: You have the right to be notified following a breach of your unsecured PHI as required by law.
• Right to Request Amendments: You may request that we amend your PHI if you believe it is inaccurate or incomplete. Requests must be in writing.
• Right to Request Confidential Communications: You may request that we communicate with you in a specific manner or at a specific location. Reasonable requests will be accommodated when feasible.
• Right to an Accounting of Disclosures: You may request an accounting of certain disclosures of your PHI made during the six years prior to your request, as permitted by law.

COMPLAINTS AND CONTACT INFORMATION

If you have questions about this Notice or believe your privacy rights have been violated, you may contact:

Privacy Officer: Nathan Bruschi Practice Name: Hair Restoration Institute of Minnesota
Address: 8009 34th Ave S, Suite 1225, Bloomington, MN 55425 Phone: (612) 588-4247
Email: [email protected]

You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights. You will not be retaliated against for filing a complaint.

CHANGES TO THIS NOTICE

We reserve the right to change this Notice at any time. Changes will apply to all PHI we maintain. The revised Notice will be available in our office and upon request, and may be provided electronically as permitted by law.