Legal

Last updated: April 18, 2026

Our Commitment to Your Privacy

DreamBodyRx, LLC and the independent physicians on our platform are committed to maintaining the privacy of your Protected Health Information (PHI) as required by the Health Insurance Portability and Accountability Act (HIPAA) and applicable state law. This Notice explains your rights and our obligations regarding the use and disclosure of your PHI.

DreamBodyRx operates as a telehealth platform that connects patients with independently licensed healthcare providers. In certain circumstances, DreamBodyRx may act as a "business associate" of a covered Provider or Pharmacy. This Notice applies to those circumstances where HIPAA is applicable to our handling of your PHI.

How We May Use and Disclose Your PHI

The following categories describe the ways we may use and disclose your PHI:

Treatment

We may use and disclose your PHI to provide, coordinate, or manage your healthcare and related services. This includes sharing information with physicians, pharmacies, laboratories, and other healthcare providers involved in your care. For example, your treating physician may disclose PHI to a compounding pharmacy to fulfill your prescription.

Payment

We may use and disclose your PHI to obtain payment for services rendered, including billing, claims management, payment processing, and collection activities. For example, we may share information with your payment processor to verify coverage or process a charge for services.

Healthcare Operations

We may use and disclose your PHI for quality assessment, compliance activities, training, accreditation, licensing, and other operational purposes necessary to run our platform. For example, we may use PHI to review the quality of care provided by our physicians or to conduct internal audits.

As Required by Law

We will disclose your PHI when required to do so by federal, state, or local law, including in response to a court order, subpoena, or other lawful process.

Public Health Activities

We may disclose PHI for public health activities, including reporting to public health authorities to prevent or control disease, reporting adverse events or product defects to the FDA, and notifying persons exposed to a communicable disease.

Health Oversight Activities

We may disclose PHI to a health oversight agency for activities authorized by law, such as audits, investigations, inspections, and licensure, as necessary for oversight of the healthcare system and government benefit programs.

Law Enforcement

We may disclose PHI to law enforcement officials for limited purposes, including to identify or locate a suspect, fugitive, material witness, or missing person; in response to a court order, subpoena, warrant, summons, or similar legal process; or to report certain types of wounds or injuries.

Serious Threats to Health or Safety

We may use or disclose PHI when necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public, and the disclosure is to a person or persons reasonably able to prevent or lessen the threat.

Business Associates

We may disclose PHI to our business associates who perform functions on our behalf or provide us with services, provided we have a written agreement in place requiring them to protect the privacy of your PHI.

Uses and Disclosures Requiring Your Authorization

We will obtain your written authorization before using or disclosing your PHI for purposes not described in this Notice, including:

• Marketing purposes, except for certain face-to-face communications and low-value promotional gifts
• Sale of PHI
• Most uses and disclosures of psychotherapy notes
• Any other purpose not described in this Notice

You may revoke an authorization at any time by submitting a written request to our Privacy Officer. Your revocation will not affect any use or disclosure already made in reliance on your prior authorization.

Your Rights Regarding Your PHI

You have the following rights with respect to your PHI:

• Right to Access: You have the right to inspect and obtain a copy of your medical records and other PHI maintained in our designated record set, with limited exceptions. We may charge a reasonable, cost-based fee for providing a copy.
• Right to Amend: You have the right to request that we amend PHI that you believe is inaccurate or incomplete. We may deny your request in certain circumstances, and you have the right to submit a statement of disagreement.
• Right to an Accounting of Disclosures: You have the right to receive an accounting of certain disclosures of your PHI made by us in the six years prior to your request.
• Right to Request Restrictions: You have the right to request restrictions on certain uses and disclosures of your PHI. We are not required to agree to your request, except in limited circumstances required by law.
• Right to Confidential Communications: You have the right to request that we communicate with you about PHI by alternative means or at alternative locations (e.g., by email only, or at a different address).
• Right to Receive a Paper Copy of This Notice: You have the right to receive a paper copy of this Notice upon request, even if you have agreed to receive it electronically.
• Right to File a Complaint: You have the right to file a complaint if you believe your privacy rights have been violated. We will not retaliate against you for filing a complaint.

To exercise these rights, contact our Privacy Officer at: [email protected]

DreamBodyRx, LLC

Attn: Privacy Officer

3 Gopher Flat Rd, #111

Sutter Creek, CA 95685

How to File a Complaint

If you believe your privacy rights have been violated, you may file a complaint with:

Our Privacy Officer: [email protected]

The U.S. Department of Health and Human Services Office for Civil Rights: www.hhs.gov/hipaa/filing-a-complaint

We will not retaliate against you for filing a complaint in good faith.

Breach Notification

We are required to notify you if there is a breach of your unsecured PHI. We will notify you without unreasonable delay and within 60 days of discovering the breach, and will provide you with information about what happened, what information was involved, what steps we are taking, and what steps you can take to protect yourself.

Changes to This Notice

We reserve the right to change this Notice and to make the revised Notice effective for PHI we already hold as well as PHI we receive in the future. The current Notice will always be available at dreambodyrx.com/legal/hipaa. If we make a material change, we will notify you by posting the revised Notice on our website and, where required by law, by direct communication.

Contact Our Privacy Officer

For questions about this Notice or to exercise your rights, contact: [email protected]