Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Our Legal Duty

Tagge Precision Health, PLLC is required by federal law (the Health Insurance Portability and Accountability Act, or HIPAA) to maintain the privacy of your Protected Health Information (PHI) and to provide you with this Notice of our legal duties and privacy practices. We are required to abide by the terms of this Notice currently in effect. We reserve the right to change the terms of this Notice and to make the new provisions effective for all PHI we maintain. If we make a material change to our privacy practices, we will post the revised Notice on our website at taggehealth.com.

What Is Protected Health Information (PHI)?

PHI is information about you, including demographic data, that may identify you and that relates to your past, present, or future physical or mental health condition, the provision of health care to you, or payment for that health care.

How We May Use and Disclose Your PHI

Treatment

We may use your PHI to provide, coordinate, or manage your health care and any related services. For example, we may share your health information with the laboratories that perform testing we order on your behalf, or with the pharmacy or dispensary that fills a prescription or supplement recommendation. We may also share your PHI with a specialist or with your primary care physician when we coordinate care with them. Dr. Tagge uses software tools, including artificial intelligence operating within OpenAI's HIPAA-compliant clinical environment under a Business Associate Agreement, to organize your records and prepare drafts of analyses and your Precision Health Plan. These tools do not diagnose, treat, or make decisions; Dr. Tagge reviews everything they produce, and every clinical decision remains his.

Payment

We may use and disclose your PHI to obtain payment for services we provide to you. For example, we may share billing information with our payment processor (Stripe, through Healthie) to process your fees. Because Tagge Precision Health is a cash-pay practice, we do not bill insurance on your behalf. However, we may generate superbills upon request for you to submit to your insurance carrier.

Health Care Operations

We may use and disclose your PHI for our practice's internal operations, including quality assessment, improving clinical protocols, staff training, legal compliance, and business management.

As Required by Law

We will disclose your PHI when required to do so by federal, state, or local law. This includes disclosures required by public health authorities, law enforcement, or in response to a valid court order or subpoena.

Public Health Activities

We may disclose your PHI to public health authorities that are authorized by law to collect information for the purpose of preventing or controlling disease, injury, or disability, or to report births, deaths, or child abuse or neglect.

Health Oversight Activities

We may disclose your PHI to a health oversight agency for activities authorized by law, such as audits, investigations, inspections, and licensure. This includes oversight of the North Carolina Medical Board.

Serious Threat to Health or Safety

We may use or disclose your PHI to prevent or lessen a serious and imminent threat to your health or safety or the health or safety of another person or the public.

Business Associates

We may share your PHI with third-party "business associates" who perform services on our behalf and who are contractually required to protect your information. Our current business associates include Healthie (electronic health record, scheduling, payment, and telehealth), Stripe (payment processing through Healthie), Google Workspace (business communications and file storage), and OpenAI (clinical AI tools within a HIPAA-compliant environment). Each business associate has signed a Business Associate Agreement (BAA) with us as required by HIPAA.

Uses and Disclosures Requiring Your Authorization

Except as described above, we will not use or disclose your PHI without your written authorization. The following uses and disclosures require your specific written authorization:

• Marketing communications
• Sale of your PHI to any third party
• Most uses of psychotherapy notes (if applicable)

You may revoke your authorization at any time by submitting a written request to care@taggehealth.com, except to the extent we have already taken action in reliance on your authorization.

Your Rights Regarding Your PHI

Right to Inspect and Copy

You have the right to inspect and obtain a copy of your PHI that we use to make decisions about your care. We will respond to your request within 30 days. We may charge a reasonable fee for copies. You may be able to access your records directly through the Healthie patient portal.

Right to Amend

If you believe your PHI is incorrect or incomplete, you may request that we amend your information. We may deny your request under certain circumstances but will provide you with a written explanation.

Right to an Accounting of Disclosures

You have the right to request a list of disclosures we have made of your PHI for purposes other than treatment, payment, or health care operations, for the past six years.

Right to Request Restrictions

You may request that we restrict how we use or disclose your PHI for treatment, payment, or health care operations. We are not required to agree to your request except in one circumstance: if you request that we not disclose your PHI to a health plan and you have paid for the service in full out of pocket, we must agree to that restriction.

Right to Request Confidential Communications

You may request that we communicate with you about your health information in a specific way or at a specific location. For example, you may ask that we only contact you by email. We will accommodate reasonable requests.

Right to Be Notified of a Breach

You have the right to be notified if a breach compromises your unsecured PHI. We will notify you without unreasonable delay and no later than 60 days after we discover it.

Right to a Paper Copy of This Notice

You have the right to a paper copy of this Notice at any time, even if you have agreed to receive it electronically. You may request a copy by emailing care@taggehealth.com.

Telehealth-Specific Notice

Tagge Precision Health delivers care by telehealth across North Carolina and through in-home visits in the Charlotte metropolitan area. Telehealth consultations are conducted via HIPAA-compliant video platform through Healthie. By participating in a telehealth encounter, you acknowledge that electronic transmission of PHI carries inherent, though minimal, risks. We employ encryption in transit and at rest for all communications and records.

Telehealth services are available only to patients physically located in North Carolina at the time of the encounter, consistent with Dr. Tagge's NC medical license and NCMB Position Statement 5.1.4.

Complaints

If you believe your privacy rights have been violated, you may file a complaint with us or with the U.S. Department of Health and Human Services Office for Civil Rights (OCR).

Privacy Officer: Daniel Tagge, MD

Tagge Precision Health, PLLC

Email: care@taggehealth.com

Website: taggehealth.com

To file a complaint with the HHS Office for Civil Rights: visit www.hhs.gov/ocr/privacy/hipaa/complaints or call 1-800-368-1019.

We will not retaliate against you for filing a complaint.

Contact Us

For questions about this Notice or to exercise your rights, please contact us at care@taggehealth.com. We aim to respond to all privacy-related inquiries within five business days.