Notice of Privacy Practices

Advanced Dermatology and Aesthetic Medicine, LLC
Effective date: July 15, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

About This Notice

This Notice of Privacy Practices (the “Notice”) explains how Advanced Dermatology and Aesthetic Medicine, LLC (“Advanced Dermatology,” “we,” “us,” or the “Practice”) may use and disclose protected health information about you, the rights you have regarding that information, and our legal responsibilities.

Protected health information, or “PHI,” is information about your past, present, or future physical or mental health, the health care you receive, or payment for your health care that identifies you or could reasonably be used to identify you.

This Notice applies to the Practice, our physicians and other clinicians, employees, contractors who are treated as members of our workforce, and supervised medical students and other trainees involved in care or training at our Chicago location or through our telehealth services.

This Notice applies only to PHI that we create or receive as a health care provider. Personal information collected through our public website or Shopify retail store that is not PHI is covered by our separate Website Privacy Policy.

Your Information. Your Rights. Our Responsibilities.

Your rights

You have the right to:

• Get an electronic or paper copy of your medical record.
• Ask us to correct or amend your medical record.
• Ask us to contact you in a particular way or at a different location.
• Ask us to limit certain uses or disclosures of your information.
• Get a list of certain disclosures of your information.
• Get a paper copy of this Notice.
• Choose someone to act for you.
• File a complaint without retaliation.

Your choices

In certain situations, you may tell us your preferences about:

• Sharing information with family members, friends, caregivers, or others involved in your care.
• Sharing information for disaster-relief purposes.
• Certain marketing communications.
• The use of identifiable photographs, videos, or testimonials.

Our common uses and disclosures

We may use or disclose your information to:

• Treat you, including through telehealth.
• Operate the Practice and train supervised medical students or other health care professionals.
• Bill for services and obtain payment.
• Support public health, safety, legal, and oversight activities.

Your Rights

When it comes to your health information, you have certain rights. This section explains those rights and some of our responsibilities to help you exercise them.

Get an electronic or paper copy of your medical record

You may ask to inspect or obtain an electronic or paper copy of your medical record and other PHI that we maintain about you. Contact our Privacy Officer to learn how to submit a request.

We generally will provide a copy or summary within 30 days. If additional time is permitted by law, we will notify you in writing. We may charge a reasonable, cost-based fee as allowed by law.

You may also have access to certain information through our patient portal. Portal access does not limit your right to request records directly from us.

Ask us to correct or amend your medical record

You may ask us to amend PHI that you believe is incorrect or incomplete. Contact our Privacy Officer to learn how to submit a written request and explain the reason for the requested amendment.

We may deny the request in circumstances permitted by law. If we deny it, we will explain the reason in writing, generally within 60 days, and describe any additional rights you may have.

Request confidential communications

You may ask us to contact you in a specific way, such as at a particular phone number, email address, or mailing address. We will accommodate reasonable requests.

Ask us to limit what we use or disclose

You may ask us not to use or disclose certain PHI for treatment, payment, or health care operations. We are not generally required to agree. If we do agree, we will follow the restriction unless the information is needed for emergency treatment or another legal exception applies.

If you pay out-of-pocket in full for a specific service or item, you may ask us not to disclose information about that service or item to your health plan for payment or health care operations. We will agree unless the disclosure is required by law.

Get a list of certain disclosures

You may request an accounting of certain disclosures of your PHI made during the six years before your request. The accounting generally does not include disclosures for treatment, payment, or health care operations, disclosures you authorized, or certain other disclosures excluded by law.

We will provide one accounting in any 12-month period without charge. We may charge a reasonable, cost-based fee for an additional accounting during the same period after telling you the cost in advance.

Get a copy of this Notice

You may request a paper copy of this Notice at any time, even if you agreed to receive it electronically. The current Notice is also available at our office and on our website.

Choose someone to act for you

If a person has legal authority to act as your personal representative, such as under a valid health care power of attorney or guardianship, that person may exercise your rights and make choices about your PHI. We will verify that person’s authority before taking action.

For minors, a parent, guardian, or other personal representative generally may exercise these rights, subject to exceptions under federal and Illinois law. In some circumstances, a minor may control particular health information or consent to care without parental involvement. We will follow applicable law.

Revoke an authorization

When we rely on your written authorization, you may revoke it in writing at any time. Revocation will not affect actions already taken in reliance on the authorization or circumstances in which the law does not permit revocation.

File a complaint without retaliation

You may complain to us if you believe your privacy rights have been violated by contacting the Privacy Officer listed at the end of this Notice.

You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights. We will not retaliate against you for filing a complaint.

Your Choices

For certain health information, you may tell us your preferences about what we disclose. Tell us your preference, and we will follow your instructions when required by law.

Family members, friends, and others involved in your care

You may tell us whether we may share relevant PHI with a family member, close friend, caregiver, or another person involved in your care or payment for your care.

If you are unable to tell us your preference, such as when you are unconscious, we may disclose limited information if we believe doing so is in your best interest and the law permits it. We may also disclose information when needed to lessen a serious and imminent threat to health or safety.

Disaster relief

We may disclose limited PHI to an organization assisting in disaster relief so that family members or others responsible for your care may be notified about your location, condition, or death, unless you object or the law otherwise restricts the disclosure.

Marketing and information about services

We may contact you about appointment reminders, treatment alternatives, care coordination, prescription or treatment reminders, and health-related benefits, products, or services that may interest you when HIPAA permits those communications without an authorization.

We may also contact patients about our own medical, cosmetic, or health-related services and products when permitted by HIPAA and other applicable law. Communications may be made by mail, phone, email, or text, as appropriate and consistent with your communication preferences.

For a use or disclosure of PHI that HIPAA defines as marketing, we will obtain your written authorization unless an exception applies, such as a face-to-face communication or a promotional gift of nominal value. If we receive payment from a third party for a marketing communication that requires authorization, the authorization will state that payment is involved.

Sale of PHI, photographs, videos, and testimonials

We will not sell your PHI without your written authorization when HIPAA requires one.

We will obtain an appropriate written authorization before using or disclosing identifiable patient photographs, videos, testimonials, or treatment information for public advertising, social media, or promotional purposes, unless the information has been properly de-identified or another legal basis applies.

Most uses and disclosures of psychotherapy notes, if we maintain any, also require your written authorization.

Fundraising

We do not currently use or disclose PHI to contact patients for fundraising. If this practice changes, we will revise this Notice as required and provide any opt-out rights required by law.

How We Typically Use or Disclose Your PHI

We may use and disclose PHI without your written authorization for the following common purposes, subject to applicable legal limits.

Treatment, including telehealth

We may use and disclose PHI to diagnose and treat you and to coordinate or manage your care. For example, we may share relevant information with another physician, pharmacy, laboratory, pathology provider, hospital, or other professional involved in your care.

When we provide care through telehealth, we may use PHI to schedule, conduct, document, and follow up on the visit. We may also disclose information to telehealth technology providers or other service providers as permitted by law and subject to appropriate safeguards.

Payment

We may use and disclose PHI to bill and obtain payment for services, verify coverage or benefits, obtain prior authorization, conduct utilization review, collect amounts due, and coordinate benefits. For example, we may provide information to your health plan so it can determine eligibility or pay a claim.

Health care operations, administration, and teaching

We may use and disclose PHI to operate the Practice, improve quality and patient experience, review clinician performance, conduct compliance and auditing activities, manage risk, support credentialing, train staff, and perform other health care operations permitted by law.

We teach medical students and may train other health care professionals. Supervised students and trainees may observe or participate in care, review relevant PHI, or discuss cases for treatment and educational purposes. They are required to protect the confidentiality of PHI. Please speak with your clinician if you have concerns about student or trainee participation.

Business associates and service providers

We may disclose PHI to companies and professionals that perform services for us, such as electronic health record and patient portal providers, appointment scheduling services, billing companies, telehealth vendors, information technology providers, accountants, and attorneys. When required, we enter into agreements requiring these business associates to safeguard PHI and use it only as permitted.

Appointment reminders and care-related communications

We may use PHI to contact you about appointments, follow-up care, test results, prescriptions, treatment instructions, patient portal messages, payment matters, or other care-related communications. You may request a reasonable alternative method of communication.

Other Uses and Disclosures Permitted or Required by Law

We may use or disclose PHI in the circumstances below. Many of these uses and disclosures are subject to specific legal conditions and limitations.

Public health and safety

We may use or disclose PHI:

• To prevent or control disease, injury, or disability and report certain communicable diseases.
• To report adverse events, product defects, or problems with medications or medical devices and support product recalls.
• To report suspected abuse, neglect, or domestic violence as permitted or required by law.
• To prevent or reduce a serious and imminent threat to the health or safety of a person or the public.
• For other public health activities authorized by law.

Health oversight

We may disclose PHI to health oversight agencies for activities authorized by law, including audits, investigations, inspections, licensure or disciplinary actions, oversight of government benefit programs, and compliance with health care laws.

Research

We may use or disclose PHI for health research when an institutional review board or privacy board has approved a waiver, when you have signed an authorization, for certain preparatory or decedent research activities, or as otherwise permitted by law. We may also use properly de-identified information for research.

Required by law and government requests

We will disclose PHI when federal, state, or local law requires it, including to the U.S. Department of Health and Human Services when it is reviewing our compliance with federal privacy law.

We may also use or disclose PHI for workers’ compensation claims, certain law-enforcement purposes, military and veterans activities, national security and intelligence activities, protective services for certain officials, and other specialized government functions when permitted by law.

Lawsuits and legal proceedings

We may disclose PHI in response to a court or administrative order, subpoena, discovery request, or other lawful process, but only when the applicable legal requirements are met.

Organ and tissue donation; deceased individuals

We may disclose PHI to organ procurement organizations or similar entities for organ, eye, or tissue donation and transplantation. We may also disclose PHI to a coroner, medical examiner, or funeral director as permitted by law.

Substance use disorder records subject to 42 CFR Part 2

To the extent we maintain or receive substance use disorder patient records that are subject to 42 CFR Part 2, those records receive additional protections. We will not use or disclose information from those records in a civil, criminal, administrative, or legislative investigation or proceeding against you unless you provide written consent or the disclosure is authorized by a court order and accompanied by a subpoena or other legal process as required by law.

We do not currently use Part 2 records for fundraising communications.

Information protected by stricter laws

Some categories of health information may receive greater protection under federal or Illinois law, including certain mental health and developmental-disability records, HIV/AIDS-related information, genetic information, substance use disorder records, and information concerning minors. When a stricter law applies, we will follow the law that provides greater privacy protection.

Our Responsibilities

• We are required by law to maintain the privacy and security of your PHI.
• We will notify you as required if a breach occurs that may have compromised the privacy or security of your unsecured PHI.
• We must follow the duties and privacy practices described in the Notice currently in effect and provide you with a copy upon request.
• We will not use or disclose PHI other than as described in this Notice unless you authorize us in writing or the law otherwise permits or requires it.
• When the HIPAA minimum-necessary standard applies, we will make reasonable efforts to use, disclose, and request only the minimum PHI needed for the purpose.

Changes to This Notice

We may change the terms of this Notice and make the revised Notice effective for all PHI we maintain, including information created or received before the change. The current Notice will be available upon request, at our office, and on our website. We will revise the effective date whenever this Notice changes.

Questions, Requests, and Complaints

To ask a question about this Notice, exercise a privacy right, request a form, or file a complaint with the Practice, contact:

Monica Rani, Privacy Officer
Advanced Dermatology and Aesthetic Medicine, LLC
850 S Wabash Ave, Suite 200
Chicago, IL 60605
Phone: (847) 802-9667
Email: info@advanceddermchi.com

File a complaint with the U.S. Department of Health and Human Services

You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights:

• By mail: 200 Independence Avenue, S.W., Washington, D.C. 20201
• By phone: 1-877-696-6775
• Online: through the HHS Office for Civil Rights complaint portal

WE WILL NOT RETALIATE AGAINST YOU FOR FILING A COMPLAINT.