Effective date: February 1, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

1. Who this Notice covers

This Notice applies to the privacy practices of Inspire Mind & Body, PLLC — a Texas professional limited liability company operating an outpatient behavioral-health practice at 77 Sugar Creek Center Blvd, Ste #669, Sugar Land, TX 77478 — and Nina Ali, PMHNP-BC, FNP-BC, together with any clinicians, employees, contractors, and workforce members acting on the practice’s behalf (collectively, “Inspire Mind & Body,” “we,” “our,” “us”).

2. Our duties

We are required by law to:

• Maintain the privacy of your protected health information (“PHI”)
• Provide you with this Notice of our legal duties and privacy practices with respect to your PHI
• Notify you if a breach of your unsecured PHI occurs
• Follow the terms of the Notice currently in effect

3. How we may use and disclose your PHI without your written authorization

We may use and disclose your PHI for the following purposes without your specific written authorization, as permitted by HIPAA and, where applicable, Texas HB 300:

a) Treatment. To provide, coordinate, or manage your care. For example, sharing relevant information with another clinician involved in your treatment (e.g., a primary care physician, pediatrician, or specialist) when clinically indicated.

b) Payment. To obtain payment for services. For example, submitting claims to your health plan through our billing partner, Headway, which operates under a Business Associate Agreement.

c) Health care operations. For internal activities necessary to run the practice, such as quality review, scheduling, and credentialing.

d) Required by law. When required by federal, state, or local law — for example, mandatory reporting of suspected child or elder abuse, or response to a valid subpoena or court order.

e) Public health. To public health authorities authorized to collect information to prevent or control disease.

f) Health oversight. To agencies authorized by law to conduct audits, investigations, or licensure actions.

g) Serious threat to health or safety. To prevent or lessen a serious and imminent threat to your health or safety or to the health or safety of another identifiable person or the public — including in situations involving suicidal or homicidal intent, as permitted by 45 CFR 164.512(j) and Texas law.

h) Workers’ compensation. As authorized by and to the extent necessary to comply with Texas workers’ compensation law.

i) Business associates. We may share PHI with business associates who perform functions on our behalf (for example, our EHR vendor, billing partner, and secure telehealth platform). Each business associate is bound by a written Business Associate Agreement that requires safeguarding of your PHI.

j) Others involved in your health care. Unless you object, we may disclose to a family member, relative, close friend, or any other person you identify, protected health information that is directly relevant to that person’s involvement in your care or payment for your care. If you are unable to agree or object (for example, in an emergency), we may use professional judgment to decide whether the disclosure is in your best interest.

k) Emergencies. We may use or disclose your PHI in an emergency treatment situation. If this happens, we will try to obtain your consent as soon as reasonably practicable after the delivery of treatment.

l) Communication barriers. If we are unable to obtain your consent because of a substantial communication barrier, we may use or disclose PHI where we determine, using professional judgment, that you would intend to consent under the circumstances.

m) Public health reporting and communicable diseases. We may disclose PHI to the Texas Department of State Health Services, the CDC, and other public-health authorities for activities authorized by law, including control of disease, injury, or disability. We may also disclose PHI (where authorized by law) to a person who may have been exposed to a communicable disease or may be at risk of contracting or spreading the condition.

n) Health oversight. We may disclose PHI to the Texas Board of Nursing, the U.S. Department of Health & Human Services, or other oversight agency for audits, investigations, inspections, and licensure actions authorized by law.

o) Abuse, neglect, or domestic violence. We are required to disclose PHI to Child Protective Services (CPS), Adult Protective Services (APS), or other governmental authority authorized to receive reports of suspected abuse or neglect.

p) Food and Drug Administration. We may disclose PHI to a person or company subject to the jurisdiction of the FDA for purposes such as reporting adverse events, tracking FDA-regulated products, enabling recalls, or conducting post-marketing surveillance.

q) Legal proceedings, subpoenas, and law enforcement. We may disclose PHI in response to a court or administrative tribunal order, and (subject to applicable requirements) in response to a subpoena, discovery request, or other lawful process. We may disclose PHI to law enforcement officials for limited identification / location purposes, about a victim or suspect of a crime, to report a death we believe resulted from criminal conduct, or to report a crime that occurred on our premises.

r) Justices of the peace, coroners, and medical examiners. We may disclose PHI to a justice of the peace, coroner, or medical examiner for identification purposes, to determine cause of death, or for other duties authorized by Texas law.

s) Research. We may disclose PHI to researchers whose protocol has been approved by an institutional review board (IRB) that has established privacy protections consistent with HIPAA.

t) Military and national security. When appropriate conditions apply, we may disclose PHI of Armed Forces personnel for activities deemed necessary by military command authorities, to the Department of Veterans Affairs for benefits determinations, to a foreign military authority if you are a member of that service, and to authorized federal officials for national-security and intelligence activities.

4. Special protections for sensitive information

Certain categories of information receive additional legal protection, and we will not disclose them without your written authorization except as specifically permitted by law:

• Psychotherapy notes. Separate, detailed process notes created during a counseling session (beyond the session summary in your medical record) require your specific written authorization before disclosure, except for limited purposes permitted under HIPAA.
• Substance use disorder records, to the extent 42 CFR Part 2 applies.
• HIV/AIDS-related information, under Texas Health and Safety Code Chapter 81.
• Mental health information, under Texas Health and Safety Code Chapter 611, which may require your written authorization for certain disclosures beyond what HIPAA requires.
• Genetic information, under GINA.

Where state law provides greater privacy protection than HIPAA, we follow the stricter standard.

5. Uses and disclosures requiring your written authorization

All other uses and disclosures of your PHI will be made only with your written authorization. Specifically, your written authorization is required for:

• Marketing communications
• Sale of PHI
• Most uses and disclosures of psychotherapy notes
• Any use or disclosure not otherwise described in this Notice

You may revoke an authorization in writing at any time. Revocation applies to future use and disclosure, not to actions already taken in reliance on the authorization.

6. Your rights regarding your PHI

You have the following rights with respect to your PHI:

• Right to inspect and copy. You have the right to inspect and obtain a copy of your PHI maintained in our records, in paper or electronic form. We may charge a reasonable cost-based fee as permitted by law. Certain psychotherapy notes are not subject to inspection.
• Right to amend. You may request that we amend PHI in your record that you believe is incorrect or incomplete. We may deny the request under certain circumstances; if we do, you may submit a written statement of disagreement, which becomes part of the record.
• Right to an accounting of disclosures. You may request a list of certain disclosures we made of your PHI for up to six years prior to the request.
• Right to request restrictions. You may request that we restrict certain uses or disclosures. We are not required to agree except in one specific case: if you pay in full out-of-pocket for a service, you may require us not to disclose PHI about that service to your health plan for payment or health care operations.
• Right to confidential communications. You may request that we communicate with you in a specific way (e.g., by text at a particular number, by postal mail only, or to a specific address). We will accommodate reasonable requests.
• Right to a paper copy of this Notice. You may request a paper copy of this Notice at any time, even if you received it electronically.
• Right to be notified of a breach. You have the right to be notified following a breach of your unsecured PHI.
• Right to opt out of fundraising communications. If we ever conduct fundraising and contact you by postal mail or email for that purpose, you have the right to opt out of receiving those communications. Contact the Privacy Officer to opt out.
• Right to complain. See Section 8 below.

To exercise any of these rights, contact our Privacy Officer using the contact information in Section 9.

7. Telehealth specifics

When you receive care via telehealth, we use a HIPAA-compliant video platform covered by a Business Associate Agreement. Details and patient acknowledgments are described in our Telehealth Consent.

8. Complaints

If you believe your privacy rights have been violated, you may file a complaint with us or with the U.S. Department of Health and Human Services, Office for Civil Rights.

To file with us, contact the Privacy Officer below. To file with OCR, visit hhs.gov/hipaa/filing-a-complaint or write to:

U.S. Department of Health and Human Services
Office for Civil Rights
200 Independence Avenue, S.W.
Washington, D.C. 20201
1-877-696-6775

We will not retaliate against you for filing a complaint.

9. Contact — Privacy Officer

Inspire Mind & Body
Attn: Privacy Officer — Nina Ali, PMHNP-BC, FNP-BC
77 Sugar Creek Center Blvd, Ste #669
Sugar Land, TX 77478
[email protected] · (832) 303-3111

10. How long we keep your information

We retain medical records and related PHI for the longer of: (a) the period required by Texas law for licensed practitioners (generally seven (7) years from the date of last treatment for adult patients), or (b) for minor patients, until the patient’s twenty-first (21st) birthday or seven (7) years from the date of last treatment, whichever is later. Records may be retained longer where required by a specific state or federal law, by a pending legal or regulatory matter, or where necessary to defend a claim. Signed acknowledgments of this Notice are retained for six (6) years from the date of signature or the date last in effect, as required by HIPAA.

11. Changes to this Notice

We reserve the right to change this Notice and to make the revised Notice effective for PHI we already have about you as well as any PHI we receive in the future. The current Notice will always be posted on the Site. A copy is available on request.