HIPAA Notice of Privacy Practices

Our commitment to your privacy

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

ClearCardio® LLC ("ClearCardio," "we," "us," or "our"), located at 4343 N Josey Ln, Carrollton, TX 75010, is required by law — including the Health Insurance Portability and Accountability Act of 1996 (HIPAA), its implementing regulations, and the Texas Medical Records Privacy Act (Texas Health & Safety Code, Chapter 181) — to maintain the privacy and security of your protected health information (PHI), to give you this notice of our legal duties and privacy practices, to follow the terms of the notice currently in effect, and to notify you promptly if a breach occurs that may have compromised the privacy or security of your information.

PHI is information that identifies you and relates to your past, present, or future physical or mental health, the health care we provide to you, or payment for that care. Where Texas law provides stronger protection for your health information than HIPAA, we follow the stricter standard. We also apply the Minimum Necessary Rule: when we use, disclose, or request PHI for purposes other than treatment, we limit ourselves to the minimum amount of information reasonably necessary to accomplish the purpose.

Who must follow this notice

This notice applies to all of the following: the physicians and clinicians who care for you at ClearCardio, including our medical director and any covering providers; all employees, staff, contractors, trainees, and volunteers of ClearCardio® LLC; and the business associates who handle PHI on our behalf — such as our electronic health record and patient portal vendor, imaging and laboratory partners, and payment processors — each of which is bound by a written Business Associate Agreement (BAA) requiring HIPAA-compliant safeguards. Everyone covered by this notice is required to follow the practices it describes.

How we may use and disclose your health information

The categories below describe the ways we are permitted to use and disclose PHI without your written authorization, with an example of each. Not every specific use or disclosure is listed, but every permitted use or disclosure falls within one of these categories.

For treatment. We use your PHI to provide, coordinate, and manage your medical care. Example: we may share your history and risk factors with the imaging center that performs your coronary CT angiogram, with the laboratory that runs your advanced lipid panel, or — with your knowledge — with your primary care physician or other clinicians involved in your care, so that everyone treating you works from the same information.

For payment. We use your PHI to bill you and process your payments for our services. ClearCardio is a direct-pay practice: we do not submit claims to insurance companies on your behalf. Example: we may use your information to confirm the services you received, generate an invoice or receipt, process your card or bank payment through our payment processor, or prepare an itemized statement (superbill) that you may choose to submit to your own insurer or use for HSA/FSA substantiation.

For health care operations. We use your PHI to run the practice and make sure every patient receives quality care. Example: we may review clinical records for quality improvement, use them for staff training and credentialing, or analyze de-identified program data to evaluate and improve our protocols.

Appointment reminders and care communications. We may contact you by phone, text, email, or mail to remind you of an appointment, follow up on scheduled testing, or share results through our secure patient portal. You may ask us to use a specific number, address, or channel (see "Your rights" below).

Treatment alternatives and health-related services. We may contact you about treatment options, alternatives, or health-related benefits and services offered by our practice that may be of interest to you. This is not third-party marketing and never involves selling your information.

Individuals involved in your care. Unless you object, we may share information relevant to their involvement with a family member, close friend, caregiver, or person you designate — for example, a spouse who attends your results consultation. We may also share information with disaster-relief organizations so your family can be notified of your condition and location. In an emergency, or if you are not able to express a preference, we will use professional judgment and share only what is directly relevant.

Other permitted or required disclosures

We may also use or disclose your PHI without your authorization in the following circumstances, subject to the conditions and limits of federal and Texas law:

• As required by law — when federal, state, or local law compels disclosure, including to the U.S. Department of Health and Human Services when it reviews our compliance.
• Public health and safety — to public health authorities for preventing or controlling disease, reporting births and deaths, reporting suspected abuse or neglect, reporting adverse events and product recalls to the FDA, or notifying a person who may have been exposed to a communicable disease.
• Health oversight — to agencies authorized to audit, inspect, investigate, or license health care providers and programs.
• Judicial and administrative proceedings — in response to a court or administrative order, or in limited circumstances a subpoena or lawful discovery request with required protections.
• Law enforcement — in limited situations, such as responding to a court order or warrant, identifying or locating a suspect or missing person, or reporting a crime on our premises.
• Coroners, medical examiners, and funeral directors — as necessary to identify a deceased person, determine a cause of death, or allow these professionals to perform their duties.
• Organ and tissue donation — to organizations that handle organ, eye, or tissue procurement or transplantation.
• Research — under strict conditions, when an institutional review board or privacy board has approved safeguards, or using information from which identifiers have been removed.
• To avert a serious threat — when necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public, disclosed only to someone able to help prevent the threat.
• Workers' compensation — as authorized by workers' compensation laws for work-related injuries or illness.
• Specialized government functions — for military and veterans activities, national security and intelligence activities, protective services, and correctional institutions, as permitted by law.

Uses and disclosures that require your written authorization

We will not use or disclose your PHI for the following purposes without your explicit written authorization: (1) marketing communications on behalf of third parties or any marketing for which we receive payment; (2) any sale of your health information — we never sell PHI; and (3) disclosure of psychotherapy notes, in the rare event any are maintained. Under Texas Health & Safety Code § 181.152, we also obtain your authorization before any electronic disclosure of your PHI that is not for treatment, payment, health care operations, or another purpose expressly permitted by law.

Any other use or disclosure not described in this notice will be made only with your written authorization. If you give us an authorization, you may revoke it in writing at any time; revocation stops future uses and disclosures but does not affect actions we already took in reliance on it.

Your rights regarding your health information

You have the following rights with respect to your PHI. To exercise any of them, contact us using the details at the end of this notice; we may ask you to submit your request in writing.

• Inspect and copy. You may ask to see or receive an electronic or paper copy of your medical record. We will provide it within 30 days of your request (with one 30-day extension if we notify you in writing). A reasonable, cost-based fee for copying, processing, or postage may apply, consistent with federal standards and Texas Health & Safety Code § 241.154.
• Amend. If you believe information in your record is incorrect or incomplete, you may ask us to amend it. We may decline in certain cases — for example, if we did not create the information or believe it is accurate — but we will explain the denial in writing within 60 days, and you may add a statement of disagreement to your record.
• Accounting of disclosures. You may request a list of the disclosures we have made of your PHI in the six years before your request, other than disclosures for treatment, payment, operations, and certain other exceptions. One accounting per 12-month period is free; we may charge a reasonable fee for additional requests.
• Request restrictions. You may ask us to limit what we use or share for treatment, payment, or operations, or what we share with family or others involved in your care. We are not required to agree to every request — except one: because ClearCardio is a direct-pay practice, if you (or someone on your behalf) pay for a service in full out of pocket and ask us not to disclose that service to a health plan for payment or operations purposes, we MUST honor that restriction unless disclosure is required by law. Since we do not bill insurers, this protection applies naturally to the care you receive here.
• Confidential communications. You may ask us to contact you in a specific way or at a specific location — for example, only on your mobile phone, or only by secure portal message rather than voicemail. We will accommodate all reasonable requests and will not ask you why.
• Paper copy of this notice. You may request a paper copy of this notice at any time, even if you agreed to receive it electronically. It is also available at our office and on this page.
• Choose someone to act for you. If you have given someone medical power of attorney, or a person is your legal guardian or authorized personal representative, that person may exercise your rights and make choices about your health information. We will verify their authority before acting.
• Breach notification. You have the right to be notified promptly — without unreasonable delay and no later than 60 days after discovery — if a breach of your unsecured PHI occurs. Our notification will describe what happened, what information was involved, what we are doing about it, and steps you can take to protect yourself.
• File a complaint. You may complain to us or to the federal government if you believe your rights have been violated (see "Complaints" below). We will never retaliate against you for filing a complaint.

Our duties

We are required by law to maintain the privacy and security of your PHI; to notify you promptly if a breach occurs that may have compromised your information; to give you this notice and follow the duties and practices it describes; and to obtain your written authorization before using or sharing your information for purposes not covered by this notice, unless the law permits or requires otherwise. We will not use or share your information other than as described here unless you tell us in writing that we may; if you do, you may change your mind at any time by notifying us in writing.

Operationally, we protect PHI through encryption in transmission and storage, role-based access controls that limit records to personnel who need them for their work, workforce privacy and security training, audit procedures, and Business Associate Agreements with every vendor that touches PHI.

This website and your health information

This website is not a clinical system, and this notice's protections apply to the clinical care relationship — not to general website browsing. Forms on this website collect contact information only — name, email, and phone — so our team can schedule a consultation with you. Please do not submit symptoms, diagnoses, medications, or any other health details through website forms, chat fields, or quiz tools; they are not intended or designed to receive PHI.

Once you become a patient, your medical records, test results, and clinical messaging are handled exclusively through our secure, HIPAA-compliant patient portal (portal.akutehealth.com) and other systems covered by Business Associate Agreements — never through this public website.

Complaints

If you believe your privacy rights have been violated, you may file a complaint with our practice by writing to our Privacy Officer at ClearCardio® LLC, 4343 N Josey Ln, Carrollton, TX 75010, emailing care@clearcardio.com, or calling 432-200-0579.

You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights: 200 Independence Avenue SW, Washington, D.C. 20201; phone 1-877-696-6775; or online at www.hhs.gov/ocr/privacy/hipaa/complaints. Filing a complaint will never affect your care, and we will never retaliate against you for filing one.

Changes to this notice

We reserve the right to change this notice and to make the revised notice effective for all PHI we maintain, including information we already hold. The current version — with its effective date — will always be posted on this page and available in paper form at our office and on request. When we make material changes, we will post the updated notice promptly.

Contact and effective date

Privacy Officer · ClearCardio® LLC · 4343 N Josey Ln, Carrollton, TX 75010 · care@clearcardio.com · 432-200-0579.

Effective date of this notice: July 22, 2026. It replaces all prior versions.