ORA MEDICAL CLINIC

Notice of Privacy Practices & Privacy Policy

Effective Date: January 1, 2026

State of California

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Introduction

Ora Medical Clinic ("we," "us," or "our") is a telehealth-only medical practice committed to protecting the privacy and security of your personal and health information. This document serves two purposes: (1) it is our Notice of Privacy Practices required under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), describing how we may use and disclose your Protected Health Information ("PHI"); and (2) it is our general Privacy Policy, describing how we collect, use, and protect other personal information gathered through our website, by phone, or through third-party platforms we use to operate our practice (e.g., scheduling, billing, and telehealth platforms).

By receiving care from us, visiting our website, or otherwise interacting with us, you acknowledge the practices described in this document.

Part I — Notice of Privacy Practices (HIPAA)

1. Our Commitment to Your Health Information

We are required by law to maintain the privacy of your PHI, to provide you with this Notice describing our legal duties and privacy practices, and to abide by the terms of the Notice currently in effect.

2. How We May Use and Disclose Your Health Information

Treatment. We may use and disclose your PHI to provide, coordinate, or manage your health care, including sharing information with other physicians, specialists, laboratories, pharmacies, or telehealth providers involved in your care.

Payment. We may use and disclose your PHI to bill and collect payment for services, including submitting claims to your health insurer or other payer and verifying coverage or eligibility.

Health Care Operations. We may use and disclose your PHI for activities such as quality assessment, staff training, licensing, and general clinic administration.

Appointment Reminders and Treatment Alternatives. We may contact you with appointment reminders, or with information about treatment options or health-related services that may be of interest to you.

Required by Law. We may disclose PHI when required to do so by federal, state, or local law, including public health reporting, health oversight activities, judicial or administrative proceedings, law enforcement purposes, and to coroners, medical examiners, or funeral directors as applicable.

To Avert a Serious Threat to Health or Safety. We may disclose PHI when necessary to prevent a serious threat to your health or safety, or the health or safety of others.

Business Associates. We may share PHI with third-party vendors ("Business Associates") who perform services on our behalf, such as billing companies, telehealth platform providers, and electronic health record hosts. These vendors are contractually required to protect your PHI under a Business Associate Agreement.

Uses and Disclosures Requiring Your Written Authorization. The following uses and disclosures of PHI will be made only with your written authorization: (1) most uses and disclosures of psychotherapy notes (where applicable); (2) uses and disclosures of PHI for marketing purposes; and (3) disclosures that constitute a sale of PHI.

Other uses and disclosures not described above will be made only with your written authorization. You may revoke that authorization in writing at any time, except to the extent we have already relied on it.

3. Telehealth Services

Ora Medical Clinic provides care exclusively through telehealth (virtual) appointments; we do not maintain a physical location for in-person visits. When you receive care from us:

Your PHI is transmitted electronically through a secure, encrypted telehealth platform and may be shared with the platform vendor acting as our Business Associate.
The same HIPAA protections described in this Notice apply to all information exchanged during your telehealth visits.
As with any electronic transmission, there is a small inherent risk of interruption, unauthorized access, or technical failure; we use reasonable administrative, technical, and physical safeguards to reduce this risk.
Because we are a telehealth-only practice, we are unable to offer an in-person alternative; if your condition requires in-person evaluation or emergency care, we will refer you to an appropriate in-person provider or emergency service.

4. Your Rights Regarding Your Health Information

Right to Inspect and Copy. You may request to inspect and obtain a copy of your medical and billing records, with limited exceptions.

Right to Amend. You may request that we amend your health information if you believe it is incorrect or incomplete.

Right to an Accounting of Disclosures. You may request a list of certain disclosures we have made of your PHI outside of treatment, payment, and health care operations.

Right to Request Restrictions. You may request restrictions on how we use or disclose your PHI. We are not required to agree, except where you have paid out-of-pocket in full for a service and request that we not disclose that information to your health plan.

Right to Request Confidential Communications. You may request that we communicate with you in a specific way or at a specific location.

Right to a Paper Copy of This Notice. You may request a paper copy of this Notice at any time, even if you agreed to receive it electronically.

Right to be Notified of a Breach. You have the right to be notified if a breach occurs that may have compromised the privacy or security of your PHI.

To exercise any of these rights, please submit a written request to hello@oramedicalclinic.com. You may also call us at (415) 289-9696.

5. Complaints

If you believe your privacy rights have been violated, you may file a complaint with us at hello@oramedicalclinic.com or with the U.S. Department of Health and Human Services, Office for Civil Rights. We will not retaliate against you for filing a complaint.

Part II — General Privacy Policy

6. Other Information We Collect

In addition to PHI covered under Part I, we may collect other personal information, including:

Contact and account information — name, email address, phone number, mailing address, and similar details provided when you schedule an appointment, sign up for communications, or contact us.

Transaction information — billing details and limited payment information (e.g., card type and last four digits); full payment details are processed by our third-party payment processor and are not stored by us beyond what is necessary to complete the transaction.

Feedback and other information you provide — feedback, reviews, and other information you choose to provide.

Website usage information — IP address, browser type, device type, operating system, pages visited, referring URL, and similar technical data collected automatically when you use our website.

Cookies and similar technologies — as described in Section 9 below.

Information from other sources — we may receive information from third-party services we use (e.g., scheduling, payment, or analytics platforms) in accordance with their policies and applicable law.

7. How We Use This Information

To schedule and manage appointments, including telehealth visits.
To communicate with you about appointments, billing, and inquiries.
To send marketing or promotional communications where you have opted in, or as otherwise permitted by law; you may opt out at any time.
To improve our website, patient experience, and clinic operations.
To comply with legal obligations and protect our rights, patients, and staff, and to prevent fraud or abuse.
To maintain records of your preferences and consent (e.g., for marketing or text-message communications).

We do not sell your personal information. Non-PHI information described in Part II may be shared with:

Service providers who perform functions on our behalf (e.g., scheduling software, payment processing, email delivery, website hosting, analytics), under contractual confidentiality obligations.
Parties involved in a merger, acquisition, or sale of business assets, subject to continued protection under this Policy.
Government authorities or others, where required by law or necessary to protect health and safety.
Any other party, with your consent.

9. Cookies and Similar Technologies

Our website may use cookies and similar technologies to operate the site and understand visitor interactions. You can set your browser to refuse cookies or alert you when cookies are used; disabling cookies may limit some site features.

10. Data Retention

We retain PHI in accordance with California medical record retention requirements and applicable federal law, and retain other personal information only as long as necessary for the purposes described in this document, unless a longer period is required by law.

11. Your Choices

Depending on your location and applicable law, you may have certain rights regarding your personal information, such as requesting access, correction, deletion, or opting out of certain uses. To make a request, contact us at hello@oramedicalclinic.com.

12. California Privacy Rights

Medical information that constitutes PHI and is governed by HIPAA and the California Confidentiality of Medical Information Act (CMIA) is generally exempt from the California Consumer Privacy Act (CCPA/CPRA). For personal information collected through our website that falls outside HIPAA/CMIA (such as general website usage data), California residents may have rights to know, delete, and correct their information, and to opt out of certain sharing, subject to applicable exemptions. To exercise these rights, contact us at hello@oramedicalclinic.com.

13. Children's Privacy

Ora Medical Clinic does not provide medical services to, or knowingly treat, any individual under the age of 18. Our services are intended for adult patients only. Our website is not directed to children, and we do not knowingly collect personal information from anyone under 18 through our website, scheduling, or intake process. If we learn that we have inadvertently collected information from someone under 18, we will take reasonable steps to delete it. If this practice's patient population changes in the future, this Notice will be updated to reflect applicable minor-consent and confidentiality protections.

14. Changes to This Notice

We reserve the right to change the terms of this Notice and to make the revised Notice effective for PHI we already maintain, as well as PHI we receive in the future. The current version will always be available on our website.

15. Contact Us

If you have questions about this Notice of Privacy Practices or Privacy Policy, or wish to exercise any of the rights described above, please contact:

Ora Medical Clinic
Email: hello@oramedicalclinic.com
Phone: (415) 289-9696

Effective Date: This Notice of Privacy Practices and Privacy Policy is effective as of January 1, 2026.

Privacy Policy