Notice of Privacy Practices

NOTICE OF PRIVACY PRACTICES

(HIPAA Privacy Policy)

Effective Date: May 12, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

This Notice of Privacy Practices (“Notice”) describes how TrueBridge (“Practice,” “we,” “us,” or “our”) may use and disclose your protected health information (“PHI”) and how you can access this information.

1. Our Responsibilities

We are required by law to:

• Maintain the privacy and security of your PHI
• Provide you with this Notice of our legal duties and privacy practices
• Follow the terms of this Notice currently in effect

PHI includes information that identifies you and relates to your mental health care, payment for care, or related services.

2. How We May Use and Disclose Your PHI

A. Treatment

We may use and disclose your PHI to provide, coordinate, or manage your mental health treatment. This includes sharing information with other healthcare providers involved in your care, as appropriate.

B. Payment

We may use and disclose your PHI to obtain payment for services provided to you. This may include billing insurance companies, verifying coverage, obtaining authorizations, coordination of benefits, and collection activities.

C. Health Care Operations

We may use and disclose your PHI for practice operations, including:

• Quality assessment and improvement
• Administrative and business functions
• Compliance, auditing, and credentialing activities

3. Other Permitted Uses and Disclosures

We may use or disclose your PHI as permitted or required by law, including:

• As required by federal, state, or local law
• To avert a serious threat to your health or safety or the safety of others
• For public health activities, including mandatory reporting of abuse or neglect
• For health oversight activities such as audits or investigations
• For law enforcement purposes when legally required

4. Uses and Disclosures Requiring Your Authorization

We will obtain your written authorization before using or disclosing your PHI for purposes other than those described in this Notice, including:

• Marketing communications, except where permitted by law
• Sale of your PHI
• Psychotherapy notes, if maintained separately from your medical record

Psychotherapy notes are notes recorded by a mental health professional documenting or analyzing counseling sessions and are kept separate from the medical record. We will not disclose psychotherapy notes without your specific authorization except in limited circumstances permitted by law.

You may revoke an authorization in writing at any time, except to the extent we have already relied on it.

5. Your Rights Regarding Your PHI

You have the right to:

A. Access

Request to inspect or obtain a copy of your PHI.

B. Amendment

Request correction of your PHI if you believe it is inaccurate or incomplete.

C. Accounting of Disclosures

Request a list of certain disclosures we have made of your PHI.

D. Request Restrictions

Request restrictions on certain uses or disclosures of your PHI.

If you pay for a service out of pocket and in full, you have the right to request that we not disclose information about that service to your health plan, and we are required to honor that request.

E. Confidential Communications

Request that we communicate with you in a specific way or at a specific location, for example, by mail instead of email, particularly if you believe disclosure could endanger you.

F. Copy of This Notice

Request a paper or electronic copy of this Notice at any time.

6. Telehealth and Electronic Communications

We may provide services through secure electronic platforms. While we take reasonable steps to protect your information, electronic communications may involve inherent risks. By participating in telehealth services, you acknowledge and accept these risks.

7. Breach Notification

We will notify you without unreasonable delay and no later than 60 days after discovery if a breach occurs that compromises the privacy or security of your PHI, as required by law.

8. Business Associates

We may disclose your PHI to individuals or entities who support care delivery or practice operations, such as billing services, electronic health record providers, administrative vendors, and clinicians involved in your care, as permitted or required by law.

Business associates and other service providers are required to protect the privacy and security of your PHI as required by law and applicable agreements.

9. Complaints

If you believe your privacy rights have been violated, you may file a complaint with:

You may also file a complaint with the U.S. Department of Health and Human Services. We will not retaliate against you for filing a complaint.

10. Changes to This Notice

We reserve the right to change this Notice and make the revised Notice effective for all PHI we maintain. The current version will be available upon request and on our website.

11. Acknowledgment of Receipt

You will be asked to acknowledge receipt of this Notice. Your acknowledgment confirms receipt, not agreement.