Notice of Privacy Practices

VALLEY ROOTS MEDICAL, LLC

Effective Date  October 1, 2026

Practice Location  Westcliffe, Colorado

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

This Notice applies to Valley Roots Medical, LLC, its workforce, and individuals providing services on its behalf. It explains your privacy rights and how we may use and disclose your protected health information, also called PHI.

Your Rights

You have the right to:

•  Get a copy of your health information. You may ask to inspect or receive an electronic or paper copy of your medical record and other health information maintained in our designated record set. We will usually provide a copy or summary within 30 days and may charge a reasonable, cost-based fee permitted by law.

•  Ask us to correct your health information. You may ask us to amend information you believe is incorrect or incomplete. We may deny the request in certain circumstances, but we will explain the denial in writing, generally within 60 days.

•  Request confidential communications. You may ask us to contact you in a specific way or send mail to a different address. We will accommodate reasonable requests.

•  Ask us to limit what we use or disclose. You may request restrictions on uses or disclosures for treatment, payment, or health care operations. We are generally not required to agree. If we agree, we may still disclose the information if it is needed for emergency treatment or if disclosure is otherwise required by law.

•  Request a health-plan restriction after paying in full. If you pay out of pocket in full for a health care item or service, you may ask us not to disclose information about that item or service to your health plan for payment or health care operations. We will honor the request unless disclosure is required by law.

•  Receive an accounting of certain disclosures. You may ask for a list of certain disclosures made during the six years before your request. The list generally will not include disclosures for treatment, payment, or health care operations or disclosures you authorized. One accounting in a 12-month period is free. We may charge a reasonable, cost-based fee for another accounting during the same period after telling you the cost in advance.

•  Receive a copy of this Notice. You may request a paper copy at any time, even if you agreed to receive it electronically. We will provide it promptly.

•  Choose someone to act for you. A legally authorized personal representative, such as an agent under a medical power of attorney or a legal guardian, may exercise your rights. We will verify the person's authority before taking action.

•  File a complaint. You may complain if you believe your privacy rights were violated. We will not retaliate against you for filing a complaint.

Your Choices

For certain information, you may tell us your preferences about what we share. Tell us what you want us to do, and we will follow your instructions when the law permits.

•  You may tell us whether to share relevant information with family members, close friends, caregivers, or others involved in your care or payment for your care.

•  You may tell us whether to share information in a disaster-relief situation.

•  If you cannot tell us your preference, such as when you are unconscious, we may share relevant information when we believe it is in your best interest. We may also share information when necessary to lessen a serious and imminent threat to health or safety.

We will obtain your written authorization before using or disclosing your information for marketing purposes, selling your information, or making most disclosures of psychotherapy notes, when applicable. Valley Roots Medical does not use your health information to contact you for fundraising purposes.

How We May Use and Disclose Your Information

•  Treatment. We may use and disclose PHI to provide, coordinate, or manage your care. This may include sharing information with specialists, pharmacies, laboratories, hospitals, and other professionals involved in your treatment.

•  Payment. We may use and disclose PHI to bill and obtain payment from health plans, insurers, billing services, or others responsible for payment.

•  Health care operations. We may use and disclose PHI to operate our practice, improve care, coordinate services, conduct quality assessment, credential practitioners, complete compliance activities, train personnel, and perform administrative and business-planning functions.

•  Business associates. We may disclose PHI to companies that perform services for us, such as billing, electronic health record, information technology, legal, accounting, or consulting services. Business associates must protect the information as required by law and contract.

•  Appointment reminders and health-related communications. We may contact you about appointments, treatment alternatives, care coordination, or health-related services and benefits that may interest you.

Other Uses and Disclosures Permitted or Required by Law

We may use or disclose PHI without your authorization when permitted or required by law. Applicable legal conditions and limitations must be met before we make these disclosures. Examples include:

•  Public health activities, including disease prevention, product recalls, adverse-event reporting, and reports of suspected abuse, neglect, or domestic violence

•  Health oversight activities, audits, inspections, investigations, and licensure proceedings

•  Research when applicable legal requirements have been satisfied

•  Organ and tissue donation requests

•  Coroners, medical examiners, and funeral directors after a person's death

•  Workers' compensation claims

•  Law-enforcement requests and special government functions when authorized by law

•  Court or administrative orders, subpoenas, lawsuits, and legal proceedings

•  Preventing or reducing a serious and imminent threat to a person's health or safety

•  Compliance with federal or state law, including disclosures to the U.S. Department of Health and Human Services for privacy-law compliance reviews

Uses and Disclosures Requiring Written Authorization

Uses and disclosures not described in this Notice and not otherwise permitted or required by law will be made only with your written authorization. You may revoke an authorization in writing at any time. A revocation will not affect actions we already took in reliance on the authorization.

Sensitive Health Information

Some information may receive additional protection under federal or Colorado law, including certain behavioral health, substance use disorder, HIV-related, genetic, reproductive health, and minor-consented health information. When another law provides greater privacy protection than HIPAA, we will follow the more protective law and obtain written authorization or consent when required.

To the extent that Valley Roots Medical maintains substance use disorder patient records protected by 42 CFR Part 2, we will not use or disclose those records in any civil, criminal, administrative, or legislative investigation or proceeding against you without your written consent or a court order and subpoena that meet the requirements of 42 CFR Part 2.

Our Responsibilities

•  We are required by law to maintain the privacy and security of your protected health information.

•  We must provide you with this Notice and follow the duties and privacy practices described in the Notice currently in effect.

•  We will notify you promptly if a breach occurs that may have compromised the privacy or security of your unsecured PHI, when notification is required by law.

•  We will not use or disclose your information other than as described in this Notice unless you authorize us to do so in writing.

Changes to This Notice

We may change the terms of this Notice. Changes may apply to information we already have and to information we receive in the future. The current Notice will be available upon request, posted in our office, and published on our website.

Questions and Complaints

You may contact our Privacy Officer with questions, requests, or complaints:

Valley Roots Medical, LLC

Privacy Officer: Jenna Becker, FNP-BC

Address: 590 Hermit Road, Westcliffe, CO 81252

Phone: 719-204-5137  |  Email: hello@valleyrootsmedical.com

Website: www.valleyrootsmedical.com

You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1-877-696-6775, or visiting www.hhs.gov/hipaa/filing-a-complaint. Valley Roots Medical will not retaliate against you for filing a complaint.