Effective Date: September 14, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED, AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Mind Body Therapy Center, LLC (“MBTC,” “we,” “us,” or “our”) is committed to protecting the privacy of your health information. This Notice of Privacy Practices describes how we may use and disclose your protected health information (“PHI”), as permitted by law, and describes your rights regarding your PHI.

This Notice applies to information created or received by MBTC in connection with providing health care services to you.

YOUR RIGHTS

You have the following rights regarding your protected health information:

Get a copy of your health information

You generally have the right to inspect and obtain a copy of PHI contained in your designated record set, subject to certain exceptions under applicable law.

You may request your records in paper or electronic form. We may charge a reasonable, cost-based fee where permitted by law.

Psychotherapy notes maintained separately from your clinical record are generally not subject to this access right.

Ask us to correct your health information

You have the right to request that we correct or amend PHI that you believe is incorrect or incomplete.

We may deny your request in certain circumstances permitted by law. If we deny your request, we will provide you with a written explanation.

Request confidential communications

You have the right to request that we communicate with you about your health information in a particular way or at a particular location.

For example, you may ask us to contact you only by email, at a particular telephone number, or at a particular address.

We will accommodate reasonable requests as required by law.

Ask us to limit what we use or share

You have the right to request that we restrict how we use or disclose your PHI for treatment, payment, or health care operations.

We are not required to agree to every requested restriction.

However, if you pay for a service or health care item entirely out of pocket and request that we not disclose information about that service or item to your health plan for payment or health care operations purposes, we will generally agree to the restriction unless disclosure is required by law.

Get a list of disclosures

You have the right to request an accounting of certain disclosures of your PHI made by MBTC, subject to limitations and exceptions established by law.

Choose someone to act for you

If you have given someone medical power of attorney or if someone is your legal guardian, that person may exercise your rights and make decisions regarding your PHI on your behalf to the extent permitted by law.

Get a copy of this Notice

You have the right to receive a paper or electronic copy of this Notice at any time.

Receive notice of a breach

You have the right to receive notification as required by law if a breach occurs that compromises the privacy or security of your PHI.

File a complaint

If you believe your privacy rights have been violated, you may file a complaint with MBTC or with the U.S. Department of Health and Human Services. You will not be retaliated against for filing a complaint.

HOW WE MAY USE AND DISCLOSE YOUR HEALTH INFORMATION

We may use or disclose your PHI without your written authorization when permitted or required by HIPAA or other applicable law.

The following are examples of the ways we may use or disclose your PHI.

Treatment

We may use or disclose your PHI to provide, coordinate, or manage your health care.

For example, we may use your PHI to provide therapy, coordinate care with another health care provider involved in your treatment, or contact you regarding your care.

Payment

We may use or disclose your PHI as necessary to obtain payment for services we provide.

For example, we may disclose appropriate information to a health plan, insurer, billing service, or other business associate involved in processing payment for your care.

Health care operations

We may use or disclose your PHI for health care operations, as permitted by law.

Examples include quality improvement, clinical supervision, training, credentialing, compliance activities, auditing, and other administrative functions necessary to operate our practice and provide quality care.

Appointment reminders and health-related communications

We may use your PHI to contact you about appointments, treatment, services, or other health care-related matters.

People involved in your care

When permitted by law, we may disclose relevant PHI to a family member, close friend, or another person you identify who is involved in your care or payment for your care.

We may also use or disclose information to notify or assist in notifying such persons about your location, general condition, or death when permitted by law.

Required by law

We may use or disclose your PHI when required to do so by federal, state, or local law.

Public health activities

We may disclose PHI for certain public health activities permitted or required by law, including activities related to preventing or controlling disease, injury, or disability.

Abuse, neglect, or domestic violence

We may disclose PHI to appropriate government authorities when required or permitted by law to report suspected abuse, neglect, or domestic violence.

Health oversight activities

We may disclose PHI to governmental agencies for activities authorized by law involving oversight of the health care system, including audits, investigations, inspections, licensing, and disciplinary proceedings.

Judicial and administrative proceedings

We may disclose PHI in response to a court or administrative order, subpoena, discovery request, or other lawful process when the applicable legal requirements are satisfied.

Law enforcement

We may disclose PHI to law enforcement officials in circumstances permitted or required by law.

Serious threats to health or safety

We may use or disclose PHI when necessary to prevent or lessen a serious and imminent threat to the health or safety of you or another person, when permitted by applicable law.

Coroners and medical examiners

We may disclose PHI to coroners or medical examiners as permitted or required by law, including for purposes of identifying a deceased person or determining a cause of death.

Workers' compensation

We may disclose PHI as necessary to comply with workers' compensation laws and other similar programs established by law.

Specialized government functions

We may disclose PHI for certain specialized government functions, including military and veterans' activities and national security activities, when authorized by law.

Research

We may use or disclose PHI for research purposes when permitted by applicable law and appropriate privacy protections are in place.

USES AND DISCLOSURES THAT REQUIRE YOUR AUTHORIZATION

Most uses and disclosures of your PHI that are not described in this Notice or otherwise permitted by law will require your written authorization.

Certain uses and disclosures require specific authorization under HIPAA, including most uses and disclosures of psychotherapy notes and certain uses of PHI for marketing or the sale of PHI.

If you provide an authorization, you may revoke it in writing at any time, except to the extent that MBTC has already relied on the authorization.

MBTC will not use or disclose your PHI for marketing purposes or sell your PHI except as permitted by law and, when required, with your written authorization.

PSYCHOTHERAPY NOTES

Psychotherapy notes are notes recorded by a mental health professional documenting or analyzing the contents of a counseling session and maintained separately from the individual's medical record.

Psychotherapy notes receive special protection under HIPAA. In most circumstances, MBTC must obtain your written authorization before using or disclosing psychotherapy notes, except when an exception under applicable law applies.

Not all information recorded by your therapist is considered psychotherapy notes. Your regular clinical record and treatment documentation may be subject to different rules under HIPAA and applicable state law.

SUBSTANCE USE DISORDER RECORDS

When applicable, MBTC will comply with the additional privacy protections governing records subject to the federal Confidentiality of Substance Use Disorder Patient Records regulations, commonly known as “Part 2,” in addition to HIPAA.

If MBTC creates or maintains records subject to Part 2, those records may receive additional protections regarding their use and disclosure.

OUR RESPONSIBILITIES

MBTC is required by law to:

• Maintain the privacy and security of your PHI.

• Provide you with this Notice describing our legal duties and privacy practices.

• Follow the terms of the Notice currently in effect.

• Notify you as required by law if a breach occurs that compromises the privacy or security of your PHI.

• Comply with applicable federal and state privacy laws, including laws that provide greater privacy protections than HIPAA when applicable.

We maintain administrative, technical, and physical safeguards designed to protect your PHI from unauthorized access, use, or disclosure.

ELECTRONIC RECORDS AND TELEHEALTH

MBTC provides services through telehealth and uses electronic systems to create, maintain, and manage clinical records and other information related to your care.

Our primary electronic health record system is SimplePractice.

MBTC has entered into a HIPAA Business Associate Agreement with SimplePractice. Business associates are required under HIPAA to appropriately safeguard PHI and comply with applicable HIPAA requirements.

We maintain safeguards designed to protect information accessed through our electronic systems.

No electronic system or method of transmitting information can be guaranteed to be completely secure. We continuously evaluate and maintain reasonable safeguards appropriate to the nature of the information we maintain.

ARTIFICIAL INTELLIGENCE AND CLINICAL DOCUMENTATION

MBTC may use certain artificial intelligence (“AI”) tools to support clinical documentation, clinical supervision, and internal administrative functions.

AI tools are used in accordance with MBTC policies, applicable law, and any required client consent.

AI-assisted clinical supervision

For some clients working with graduate interns, MBTC may use an AI transcription function within Google Meet to create a temporary transcript of a telehealth session for clinical supervision.

When this tool is used:

• Separate written consent is obtained before the tool is used.

• The transcript is used by the intern and their licensed supervisor for clinical supervision.

• The transcript is not intended to become part of the permanent clinical record.

• The transcript is deleted after the applicable supervisory review period.

• MBTC maintains appropriate contractual safeguards governing the protection of PHI.

You may decline or withdraw consent for this use as described in the applicable consent form.

AI-assisted clinical documentation

Some MBTC clinicians may use AI-assisted documentation tools within our electronic health record system.

When applicable:

• Separate written consent is obtained before the tool is used to record or transcribe a session.

• AI-generated material is reviewed and edited by the treating clinician.

• The treating clinician remains responsible for the final clinical documentation.

• Audio and transcript information is handled according to applicable contractual, security, and retention requirements and MBTC's policies.

• MBTC requires applicable vendors to maintain appropriate protections for PHI.

Administrative AI tools

MBTC may use AI-assisted tools for administrative and operational purposes.

MBTC does not intentionally enter your PHI into administrative AI tools that are not approved for the handling of PHI.

AI tools do not replace your clinician's professional judgment or responsibility for your care. AI tools are not used to independently make diagnoses, determine treatment, or make final clinical decisions on your behalf.

OTHER PRIVACY PROTECTIONS

Certain types of health information may receive additional protections under federal or state law.

MBTC will comply with applicable laws that provide greater privacy protections than HIPAA.

Because MBTC provides services to individuals in multiple states, the privacy protections applicable to your information may vary depending on the laws that apply to your care.

Nothing in this Notice is intended to reduce any privacy rights or protections provided to you by applicable federal or state law.

CHANGES TO THIS NOTICE

MBTC reserves the right to change this Notice and its privacy practices at any time, as permitted by law.

Any revised Notice will apply to PHI that MBTC already maintains as well as information received or created after the revised Notice becomes effective, to the extent permitted by law.

If we make a material change to our privacy practices, we will revise this Notice as required by law.

The current version of this Notice will be available on our website and through the MBTC client portal. You may also request a paper or electronic copy at any time.

QUESTIONS AND COMPLAINTS

If you have questions about this Notice, believe your privacy rights have been violated, or would like to exercise any of your rights under this Notice, please contact:

Mind Body Therapy Center, LLC
Address: 2857 SE Pine St. Portland, OR 97214
Email: info@mindbodytherapycenter.org

You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights.

You will not be retaliated against for filing a complaint about our privacy practices.

ACKNOWLEDGMENT OF RECEIPT

MBTC will make a good-faith effort to obtain your written acknowledgment that you received this Notice of Privacy Practices.

Your signature acknowledging receipt of this Notice does not constitute an authorization for MBTC to use or disclose your PHI beyond the uses and disclosures permitted by law.

If you decline to sign the acknowledgment, MBTC will document that it made a good-faith effort to obtain your acknowledgment. Your refusal to sign does not prevent MBTC from using or disclosing your PHI as permitted by law.

This Notice of Privacy Practices is effective September 14, 2026.