HIPAA-Aligned Privacy Practices Notice

1. Important Clarification

2. Our Commitment

Function Bone Health LLC (“Company,” “we,” “us,” or “our”) is committed to protecting the privacy and security of your health-sensitive information. We recognize that the information you share with us during bone density screenings, body composition analyses, and wellness coaching sessions is personal and sensitive. This notice describes how your health-sensitive information may be used and disclosed and how you can access this information.

3. What Health-Sensitive Information (HSI) We Collect

In the course of providing our services, we may collect the following types of health-sensitive information:

• •Bone density screening results: T-scores, Z-scores, bone mineral density measurements, fragility scores, and related data generated by the EchoS/REMS device
• •Body composition data: Body fat percentage, lean mass, visceral fat, and other body composition measurements
• •Health history questionnaire responses: Information you provide about your medical history, current medications, supplements, lifestyle, fracture history, and family health history
• •Wellness coaching records: Notes from coaching sessions, goals, progress tracking, and lifestyle recommendations discussed during sessions
• •Demographic and contact information: Name, date of birth, gender, address, phone number, email address, and emergency contact information
• •Payment and billing records: Payment method details (processed securely through third-party processors), transaction history, and service receipts

4. How We Use and Disclose Your HSI

4.1 Uses and Disclosures Without Your Authorization

We may use and disclose your HSI without your separate written authorization for the following purposes:

• •Service delivery: To provide, coordinate, and manage your bone density screenings, body composition analyses, wellness coaching, and related educational services
• •Payment processing: To process payments for services rendered, manage billing, and handle refund requests
• •Business operations: For quality improvement, staff training (using de-identified data), business planning, internal auditing, and customer service
• •Legal obligations: When required by federal, state, or local law, including responding to court orders, subpoenas, or government investigations
• •Public safety: To prevent or lessen a serious and imminent threat to the health or safety of a person or the public
• •As required by law: When disclosure is mandated by applicable federal, state, or local regulations

4.2 Uses and Disclosures Requiring Your Authorization

We will obtain your written authorization before using or disclosing your HSI for the following purposes:

• •Marketing: Using your HSI to send you marketing communications about products or services (beyond general appointment reminders and service-related communications)
• •Sale of information: We will never sell your HSI. Any future change to this practice would require your prior written authorization
• •Other purposes: Any use or disclosure of your HSI not described in this notice will require your written authorization. You may revoke your authorization in writing at any time, and revocation will apply prospectively

5. Your Rights Regarding Your HSI

Although we are not legally required to provide these rights under HIPAA, we voluntarily extend the following rights to you as part of our commitment to transparency:

5.1 Right to Access

You have the right to inspect and obtain a copy of your HSI maintained by us. We will respond to your request within thirty (30) days. We may charge a reasonable, cost-based fee for copies. Requests should be submitted in writing to our Privacy Officer.

5.2 Right to Amendment

You have the right to request that we amend your HSI if you believe it is incorrect or incomplete. We will respond to your request within sixty (60) days. We may deny your request under certain circumstances (for example, if the information was not created by us or if we believe the information is accurate and complete), and we will provide you with a written explanation if we deny your request.

5.3 Right to Request Restrictions

You have the right to request restrictions on certain uses and disclosures of your HSI. While we are not required to agree to your request, we will carefully consider it and notify you of our decision. If we agree to a restriction, we will honor it unless the information is needed for emergency situations.

5.4 Right to Accounting of Disclosures

You have the right to request a list of disclosures of your HSI that we have made to third parties. This accounting does not include disclosures made for service delivery, payment, business operations, disclosures you authorized, or disclosures made directly to you.

5.5 Right to Confidential Communications

You have the right to request that we communicate with you about your HSI in a certain way or at a certain location. For example, you may request that we contact you only at a specific phone number or email address. We will accommodate all reasonable requests.

5.6 Right to a Copy of This Notice

You have the right to obtain a paper or electronic copy of this notice at any time, even if you have previously received or acknowledged it. Contact our Privacy Officer to request a copy.

For more details about your rights and how to exercise them, please see our Client Rights page.

6. Our Responsibilities

As part of our voluntary adoption of HIPAA-aligned practices, we commit to the following responsibilities:

• •Maintaining the privacy and security of your HSI through appropriate administrative, technical, and physical safeguards
• •Notifying you promptly if a breach occurs that may have compromised the privacy or security of your HSI
• •Following the privacy practices described in this notice and providing you a copy upon request
• •Not using or sharing your HSI other than as described in this notice unless you tell us we can in writing; if you give us written authorization, you may revoke it at any time by contacting us in writing

7. Breach Notification

In the event of a breach of your unsecured HSI, we will notify you within sixty (60) days of discovering the breach. Our notification will include:

• •A description of the breach, including the date(s) of the breach and the date of discovery
• •The types of HSI that were involved in the breach
• •Steps you should take to protect yourself from potential harm resulting from the breach
• •A description of what we are doing to investigate the breach, mitigate harm, and prevent future breaches
• •Contact information for you to ask questions or obtain additional information

8. Safeguards

We implement the following safeguards to protect your HSI:

• •Encryption: All HSI is encrypted in transit (TLS 1.2+) and at rest using industry-standard encryption protocols
• •Access controls: Access to your HSI is restricted to authorized personnel on a need-to-know basis, with role-based access controls
• •Staff training: All staff members who handle HSI receive privacy and security training upon hire and annually thereafter
• •Secure storage: Physical records are stored in locked, access-controlled areas; digital records are stored on secure, HIPAA-aligned platforms
• •Audit logging: We maintain audit logs of access to HSI systems to detect and investigate unauthorized access
• •Secure disposal: When HSI is no longer needed, it is disposed of securely through shredding (physical records) or secure deletion (digital records)

9. Business Associates

We may share your HSI with trusted third-party service providers (“business associates”) who assist us in providing our services, such as technology vendors, payment processors, and cloud storage providers. We require these business associates to implement appropriate safeguards to protect your HSI and to use it only for the purposes for which it was shared. Where appropriate, we enter into agreements with these parties that include privacy and security obligations aligned with HIPAA requirements.

10. Complaints

If you believe your privacy rights have been violated or you have concerns about how we handle your HSI, you may file a complaint using either of the following options:

• •File a complaint with us: Contact our Privacy Officer using the contact information provided in Section 12 below. We will investigate your complaint and respond within thirty (30) days.
• •File a complaint with the U.S. Department of Health and Human Services: You may file a complaint with the Office for Civil Rights by visiting www.hhs.gov/ocr/complaints or by writing to: U.S. Department of Health and Human Services, 200 Independence Avenue S.W., Washington, D.C. 20201, or by calling 1-877-696-6775.

We will not retaliate against you in any way for filing a complaint.

11. Changes to This Notice

We reserve the right to change the terms of this notice and to make the new provisions effective for all HSI that we maintain, including HSI we collected before the changes. When we make a significant change, we will post the revised notice on our website and make copies available upon request. Each version of this notice will have an effective date listed at the top of the page.

12. Contact Information

If you have questions about this notice, wish to exercise any of your rights, or want to file a complaint, please contact our Privacy Officer: