Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

(45 CFR §164.520(b)(1)(i))

Effective date: [EFFECTIVE DATE]

---

1. Who We Are and What This Notice Covers

This Notice applies to CoolCRYO LLC, doing business as Measured Health, 4040 Cheyenne Blvd, Suite C, Rapid City, SD 57703 ("we," "us," "our," or the "Company"). It covers our clinic, our staff and coaches, and our online client portal (the "Portal").

This Notice covers protected health information, which we call "health information." That is information that identifies you and relates to your past, present, or future physical or mental health, the care you get, or payment for that care. For example:

• your health history and intake forms
• body-composition scan results
• lab results
• progress photos
• weekly check-ins and messages with your coach
• assessment reports
• consultation recordings and notes

Independent Prescribing Providers. You may choose to see a licensed physician or other prescriber in the Asher Health provider network (a "Prescribing Provider") about prescription medicines or peptides. Prescribing Providers are independent. They are not our employees. Each one follows its own Notice of Privacy Practices for the care it provides. This Notice covers only how we handle your information.

2. Our Duties to You

The law requires us to:

• keep your health information private and secure (45 CFR §164.530(c))
• give you this Notice of our legal duties and privacy practices (§164.520(a))
• follow the terms of the Notice currently in effect (§164.520(b)(1)(v)(B))
• tell you if there is a breach of your unsecured health information (§164.404)

We will not use or share your health information except as described in this Notice, unless you tell us in writing that we can. If you give us written permission, you may change your mind at any time. Tell us in writing (§164.520(b)(1)(ii)(E)).

Changes to this Notice. We may change this Notice. Any change will apply to all health information we have about you, including information we got before the change (§164.520(b)(1)(v)(C)). If we make an important change, we will:

• post the new Notice in our clinic and on our website
• make it available in the Portal
• give you a copy if you ask

3. How We Typically Use and Share Your Health Information

We may use and share your health information without your written permission in the following ways (45 CFR §164.506).

3.1 To provide and coordinate your care and services ("treatment")

We can use your health information and share it with others who are helping with your care.

Examples:

• Your coach reviews your body-composition scans, check-ins, and nutrition plan to give you feedback.
• If you ask to talk with a Prescribing Provider, we send that provider your intake answers, scan results, and lab results so they can evaluate you.
• We send a lab order and your contact details to the laboratory that runs your tests.
• If you ask, we send your progress report to your own doctor.

3.2 To get paid ("payment")

We can use and share your health information to bill you and collect payment.

Examples:

• We use your name and the services you bought to process your card payment.
• If you use a financing company such as Cherry, CareCredit, or Afterpay, we share only the billing details that company needs. We do not share your health history, scans, or lab results with it.

3.3 To run our business ("health care operations")

We can use and share your health information to run our business, improve our services, and train our staff.

Examples:

• Quality review: A supervisor reviews coaching notes to check quality and safety.
• Training: We train new coaches using records with identifying details removed whenever possible.
• AI-assisted documentation: We use secure artificial intelligence (AI) tools to help draft chart notes, assessment reports, and call summaries. These tools are provided by Anthropic (the maker of Claude), under a written HIPAA business associate agreement. A trained staff member reviews and approves every AI draft before it goes into your record. The AI tools do not make medical or prescribing decisions. (Recordings and AI use for your consultations also require your separate consent. See our Consent to Record and AI-Assisted Documentation form.)
• Other operations: audits, legal reviews, security monitoring, and business planning.

3.4 Business associates

We hire companies to do some work for us. These companies are called "business associates." Examples include:

• our secure cloud host (DigitalOcean)
• our AI service provider (Anthropic)
• our text-message and email delivery services
• our software developer, who may need limited, logged access to fix problems

Before we share your health information with a business associate, it must sign a contract promising to protect it (45 CFR §164.502(e), §164.504(e)).

3.5 Reminders and information about our services

We may contact you to:

• remind you about appointments, scans, and weekly check-ins
• tell you about our other services or treatment options that may interest you

Our text messages and emails will not contain health details. They say things like "You have a new message in your Portal." You will read the details after you sign in to the Portal. You can ask us to contact you a different way (see Section 6.5).

3.6 People involved in your care

If you agree, or do not object, we may share information with a family member, friend, or other person you name who is involved in your care or helps pay for it. For example, this could be a spouse who joins your consultation. If you are not able to agree or object, such as in an emergency, we may share information if we believe it is in your best interest (45 CFR §164.510(b)). We may also share information with disaster relief groups so your family can be told where you are and how you are doing.

4. Other Ways We May Use or Share Your Health Information

The law allows or requires us to share your information in the following situations without your written permission. We must meet many conditions before we do (45 CFR §164.512). We share only what is needed.

Situation	What it means
When the law requires it	We share information when a federal, state, or local law requires it, including with the U.S. Department of Health and Human Services if it checks that we follow privacy law. (§164.512(a))
Public health and safety	We may report information to public health authorities to prevent disease, report reactions to medicines or product problems to the FDA, or help with product recalls. (§164.512(b))
Abuse, neglect, or domestic violence	We may report suspected abuse, neglect, or domestic violence to the proper government agency, as the law allows or requires. (§164.512(c))
Health oversight	We may share information with agencies that oversee health care, for example for audits, investigations, inspections, and licensing. (§164.512(d))
Lawsuits and legal actions	We may share information in response to a court or administrative order, or in response to a subpoena if certain protections are met. (§164.512(e))
Law enforcement	We may share information with police or other law enforcement officials for limited purposes. Examples include responding to a court order or warrant, or reporting a crime on our premises. (§164.512(f))
Coroners, medical examiners, and funeral directors	We may share information when a person dies. (§164.512(g))
Organ and tissue donation	We may share information with organizations that handle organ, eye, or tissue donation. (§164.512(h))
Research	We may use or share information for research only if a review board or privacy board approves it and your privacy is protected. Otherwise we ask for your permission. We do not currently take part in research. (§164.512(i))
Serious threat to health or safety	We may share information to prevent or lessen a serious and imminent threat to you, another person, or the public. (§164.512(j))
Special government functions	We may share information for military, national security, presidential protective services, or correctional purposes, as the law allows. (§164.512(k))
Workers' compensation	We may share information for workers' compensation or similar programs that pay for work-related injuries. (§164.512(l))

More protective laws. Some laws protect certain information more strictly than HIPAA. Examples include laws about HIV/AIDS, sexually transmitted infections, mental health, and genetic test results. When a stricter state or federal law applies, we follow it. (§164.520(b)(1)(ii)(C))

Substance use disorder records. We do not run a federally assisted substance use disorder program, so 42 CFR Part 2 does not apply to us.

5. Uses That Need Your Written Permission

We will ask for your written permission (an "authorization") before we use or share your health information in these ways (45 CFR §164.508):

• Marketing. We will not use or share your health information for marketing without your written permission. This does not include talking with you face-to-face or reminding you about our own services (§164.508(a)(3)).
• Testimonials, before-and-after photos, and success stories. We will never post your name, photos, age, body-composition results, quotes, or video in our advertising, website, or social media unless you sign our separate authorization form.
• Sale of health information. We do not sell your health information. We would need your written permission to do so (§164.508(a)(4)).
• Psychotherapy notes. We do not provide psychotherapy and do not keep psychotherapy notes. If we ever did, most uses would need your written permission (§164.508(a)(2)).
• Any other use not described in this Notice.

You may cancel (revoke) your permission at any time. Tell us in writing, using the contact information in Section 9. Canceling stops future uses. It does not undo anything we already did while we had your permission (§164.508(b)(5)).

Fundraising. We do not raise funds using your information. If we ever do, you will have the right to opt out (§164.514(f)).

6. Your Rights

You have the following rights about your health information. To use any of them, contact us using the information in Section 9. Many of these requests can also be made in the Portal.

6.1 Get a copy of your health information

You can ask to see or get a copy of your health information, on paper or electronically (45 CFR §164.524).

• Many of your records are available any time in the Portal. This includes scans, reports, check-ins, and messages. You can download them using the Export My Records feature.
• For other records, we will respond within 30 days. If we need more time, we will tell you why, and we may take up to 30 more days.
• We may charge a reasonable, cost-based fee for copies. Self-service Portal downloads are free.
• You can also ask us to send a copy straight to another person or company you choose.

6.2 Ask us to correct your health information

If you think information in your record is wrong or incomplete, you can ask us in writing to correct it (§164.526). We may say "no." If we do, we will explain why in writing within 60 days, and you can send us a statement of disagreement to keep with your record.

6.3 Get a list of those we shared your information with

You can ask for a list (an "accounting") of times we shared your health information in the 6 years before your request. You can ask who we shared it with and why (§164.528).

• The list will not include sharing for treatment, payment, or business operations.
• It will not include sharing you asked for or gave us permission for, and certain other types.
• We will give you one list free each 12 months. We may charge a reasonable, cost-based fee for more.

6.4 Ask us to limit what we use or share

You can ask us not to use or share certain health information for treatment, payment, or our operations (§164.522(a)).

• We are not required to agree. We may say "no" if it would affect your care.
• One exception: If you pay for a service in full out of pocket, you can ask us not to share information about it with your health insurer for payment or operations. We will say "yes" unless a law requires us to share it.

6.5 Ask us to contact you in a certain way

You can ask us to contact you in a specific way, such as only by Portal message or only at a certain phone number or address (§164.522(b)). We will agree to all reasonable requests. You do not have to tell us why.

6.6 Get a copy of this Notice

You can ask for a paper copy of this Notice at any time, even if you agreed to get it electronically (§164.520(c)). It is also posted on our website and in the Portal.

6.7 Choose someone to act for you

If you have given someone medical power of attorney, or someone is your legal guardian, that person can use your rights and make choices about your health information (§164.502(g)). We will check that the person has this authority before we act.

6.8 Be told about a breach

We will tell you if there is a breach that affects the privacy or security of your unsecured health information (§164.404). We will notify you without unreasonable delay and no later than 60 days after we find out.

7. Our Online Privacy Practices

Our client Portal and the pages where you enter or view health information do not use advertising pixels, session recording, or other third-party tracking tools. We do not share your health information with Facebook/Meta, Google, or any other advertising company. Our public website is covered by our separate Website Privacy Policy.

8. How to File a Complaint

If you believe we have violated your privacy rights, you can file a complaint with us or with the federal government (§164.520(b)(1)(vi)).

• With us: Contact our Privacy Officer using the information in Section 9. You can complain in writing, by email, or through the Portal.
• With the U.S. Department of Health and Human Services, Office for Civil Rights:
  • Mail: 200 Independence Avenue, S.W., Washington, D.C. 20201
  • Phone: 1-877-696-6775
  • Online: www.hhs.gov/ocr/privacy/hipaa/complaints/

We will not retaliate against you for filing a complaint. Filing a complaint will not affect your services (§164.530(g)).

9. Contact Us

Contact: Privacy Officer
Measured Health / CoolCRYO LLC
4040 Cheyenne Blvd, Suite C, Rapid City, SD 57703
Phone: 605-301-3189
Email: privacy@measuredhealth.me
Portal: Send a message to "Privacy Officer" at measuredhealth.me

10. Effective Date

This Notice takes effect on [EFFECTIVE DATE]. (§164.520(b)(1)(viii))