Sano Medical Group — How Your Medical Information May Be Used and Disclosed and How You Can Access This Information

PLEASE REVIEW THIS NOTICE CAREFULLY.

Effective Date: June 25, 2026

Who This Notice Applies To

This Notice of Privacy Practices ("NPP") describes the privacy practices of Sano Medical Group, a California professional medical corporation, and its physicians, nurse practitioners, and other healthcare providers (collectively, "we," "us," "our").

This NPP is required by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and California state privacy law.

Our Pledge

We understand that medical information about you and your health is personal. We are committed to protecting it. We create a record of the care and services you receive through Sano. We need this record to provide you with quality care and to comply with legal requirements. This NPP explains the ways we may use and disclose your protected health information ("PHI") and your rights regarding it.

How We May Use and Disclose Your PHI

For Treatment

We use and disclose your PHI to provide medical care. For example, we may share your PHI with the pharmacy that fills your prescription, with a commercial laboratory that processes your optional, but reccomended blood work, with consulting specialists, or with emergency providers if you need urgent care.

For Payment

We use and disclose your PHI for billing purposes. For example, we may share information with our payment processor (Stripe) to process your payments. Because the program is cash-pay only, we do not bill insurance or federal/state healthcare programs.

For Healthcare Operations

We use and disclose your PHI for healthcare operations such as quality assessment, clinical training and supervision, business management, audit, and accreditation activities.

To Sano Health Management as Business Associate

Sano Health Management provides technology and administrative services to us under a Business Associate Agreement. They may receive and use your PHI only as needed to perform services for us and only as permitted by HIPAA. They are contractually required to protect your PHI.

Appointment Reminders and Health Information

We may contact you to remind you about appointments, share lab results, or share treatment information.

As Required by Law

We will disclose PHI when required by federal, state, or local law, including for: public health activities, victims of abuse or neglect, health oversight activities, judicial and administrative proceedings, law enforcement purposes (limited circumstances), reporting deaths, organ donation, research (limited circumstances), to prevent serious threat to health or safety, specialized government functions, workers' compensation, and as required by California state law.

Uses That Require Your Written Authorization

Other than the uses described above, we will not use or disclose your PHI without your written authorization. This includes (a) marketing communications that involve more than nominal compensation to us; (b) the sale of PHI; (c) most uses and disclosures of psychotherapy notes. You may revoke an authorization at any time in writing.

Your Rights Regarding Your PHI

Right to Inspect and Copy

You have the right to inspect and copy your PHI. You may request your records by emailing hello@sano.healthcare. We will respond within 30 days. Reasonable copying fees may apply per California law.

Right to Request Amendment

You have the right to request that we amend PHI you believe is incorrect or incomplete. We may deny your request if the information is accurate, was not created by us, or is not part of the records we maintain.

Right to an Accounting of Disclosures

You have the right to request a list of disclosures we made of your PHI for purposes other than treatment, payment, healthcare operations, and certain other exceptions, going back up to 6 years.

Right to Request Restrictions

You have the right to request restrictions on how we use or disclose your PHI. We are not required to agree to all restrictions, but we will consider all requests.

Right to Request Confidential Communications

You may request that we communicate with you in a specific way (for example, by email rather than phone) or at a specific location. We will accommodate reasonable requests.

Right to a Paper Copy of This Notice

You have the right to request a paper copy of this NPP at any time, even if you previously agreed to receive it electronically.

Right to Be Notified of a Breach

We will notify you if a breach affects your unsecured PHI.

California-Specific Rights

California law provides additional privacy protections. For example: (a) you have additional rights regarding mental health, HIV/AIDS, genetic, and substance abuse treatment records; (b) we generally cannot disclose your medical information without your written authorization except as specifically permitted by the Confidentiality of Medical Information Act (CMIA, Cal. Civil Code § 56 et seq.); (c) you have additional rights under the California Consumer Privacy Act for any personal information that is not PHI.

Our Responsibilities

• We are required by law to maintain the privacy of your PHI

• We must provide you with this NPP describing our legal duties and privacy practices

• We must follow the terms of the NPP currently in effect

• We must notify you if a breach occurs that may have compromised the privacy of your PHI

Changes to This Notice

We may change this NPP at any time. Changes will apply to PHI we already have and PHI we receive in the future. We will post the revised NPP in our patient portal and on the Sano website. The effective date is at the top of this Notice.

Complaints

If you believe your privacy rights have been violated, you may file a complaint with us at:

Sano Medical Group

Email: hello@sano.healthcare

You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, at:

200 Independence Avenue, SW, Washington, DC 20201

1-877-696-6775

www.hhs.gov/hipaa/filing-a-complaint

We will not retaliate against you for filing a complaint.

Contact

Questions about this NPP or about your PHI:

Sano Medical Group

Email: hello@sano.healthcare