Privacy Practices

Effective Date: June 11, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Who We Are

This Notice describes the privacy practices of Smiley Aesthetics and its affiliated clinical practices, providers, and staff at all of our locations (collectively, “we,” “us,” or “our”). We are required by law to maintain the privacy of your protected health information (“PHI”), to give you this Notice of our legal duties and privacy practices, to follow the terms of the Notice currently in effect, and to notify you if there is a breach of your unsecured PHI.

Your medical records, clinical photographs, and appointment information are maintained in our secure electronic medical record system, Aesthetic Record, which is contractually required to safeguard your PHI as our business associate.

How We May Use and Disclose Your Health Information

Treatment

We use your PHI to provide your care — for example, reviewing your medical history before an injectable or laser treatment, taking clinical before-and-after photos for your chart, and coordinating with other providers involved in your care, including our supervising or collaborating physician.

Payment

We may use and disclose your PHI to obtain payment for services — for example, processing your card payment, managing memberships and packages, or pursuing collection of unpaid balances. Most of our services are paid directly by you rather than billed to insurance.

Health Care Operations

We may use and disclose your PHI to run our practice — for example, quality review, staff training, scheduling, appointment reminders by phone, text, or email, safety and compliance audits, and obtaining legal or accounting services.

Other Uses and Disclosures Permitted or Required by Law

• When required by federal, state, or local law
• For public health activities, such as reporting adverse reactions to medications or devices
• To report suspected abuse, neglect, or domestic violence as required or permitted by law
• For health oversight activities such as audits, inspections, and licensure investigations
• In response to a court order, subpoena, or other lawful process, with required protections
• To law enforcement in limited circumstances permitted by law
• To coroners, medical examiners, and funeral directors
• For organ and tissue donation purposes
• For certain research approved under required privacy protections
• To prevent or lessen a serious and imminent threat to health or safety
• For specialized government functions, such as military or national security purposes
• For workers’ compensation or similar programs

We may also contact you with appointment reminders and information about treatment options, services, and products we offer that may benefit you. We may share your PHI with family members or others involved in your care if you agree, or as permitted in an emergency.

Uses and Disclosures That Require Your Written Authorization

We will obtain your written authorization before:

• Marketing photos and testimonials: using your photographs (including before-and-after photos), name, or likeness on our website, social media, or in any advertising or promotional material
• Most uses and disclosures of PHI for marketing purposes
• Any sale of your PHI
• Most uses and disclosures of psychotherapy notes, if any exist

Any other use or disclosure not described in this Notice will be made only with your written authorization. You may revoke an authorization at any time in writing, except to the extent we have already acted in reliance on it.

Substance Use Disorder Treatment Records

If we receive records relating to substance use disorder treatment from a program subject to 42 CFR Part 2, those records have additional confidentiality protections under federal law. In general, we may not use or disclose Part 2 records in civil, criminal, administrative, or legislative proceedings against you without your written consent or a specific court order, and such records may not be used or disclosed except as permitted by Part 2.

Your Rights Regarding Your Health Information

• Right to inspect and copy. You may ask to see or receive a copy of your medical record, including an electronic copy of records we keep electronically. We may charge a reasonable, cost-based fee. We will respond within the time required by law.
• Right to amend. If you believe information in your record is incorrect or incomplete, you may request an amendment in writing, with a reason. We may deny the request in certain circumstances, and you may submit a statement of disagreement.
• Right to an accounting of disclosures. You may request a list of certain disclosures of your PHI made in the six years before your request, other than disclosures for treatment, payment, operations, and certain other exceptions.
• Right to request restrictions. You may ask us to limit how we use or disclose your PHI. We are not required to agree, except that we must agree not to disclose PHI to your health plan for a service you have paid for in full out of pocket, where the disclosure would be for payment or operations and is not otherwise required by law.
• Right to confidential communications. You may ask us to contact you in a specific way or at a specific location (for example, only by cell phone, or no voicemails). We will accommodate reasonable requests.
• Right to a paper copy of this Notice. You may request a paper copy at any time, even if you agreed to receive it electronically.
• Right to breach notification. We will notify you as required by law if a breach occurs involving your unsecured PHI.

To exercise any of these rights, submit your request in writing to our Privacy Officer at the contact information below.

Our Duties

We are required by law to maintain the privacy and security of your PHI, provide you this Notice, abide by its terms, and notify you in the event of a breach of unsecured PHI. We reserve the right to change this Notice and to make the new Notice apply to PHI we already hold. The current Notice will be posted at each location and on our website, and copies are available on request.

Complaints

If you believe your privacy rights have been violated, you may file a complaint with us by contacting our Privacy Officer at the information below, or with the Secretary of the U.S. Department of Health and Human Services, Office for Civil Rights, 200 Independence Avenue S.W., Washington, D.C. 20201, by calling 1-877-696-6775, or online at www.hhs.gov/ocr/privacy/hipaa/complaints. We will not retaliate against you for filing a complaint.

Contact / Privacy Officer

Privacy Officer, Smiley Aesthetics

339 White Bridge Pike, Nashville, TN 37209

Email: admin@smileyaesthetics.com

Phone: 629-276-8915

Effective Date of this Notice: June 11, 2026