Notice of Privacy Practices

Carolina Longevity
50101 Governors Dr, Ste 105, Chapel Hill, NC 27517
Phone: (984) 234-6951

Our Commitment to You

Carolina Longevity is required by law to:

• maintain the privacy and security of your protected health information (“PHI”);
• give you this Notice explaining our legal duties and privacy practices regarding your PHI;
• notify you promptly if a breach occurs that may have compromised the privacy or security of your PHI;
• follow the terms of the Notice currently in effect; and
• obtain your written authorization for uses and disclosures not described in this Notice.

“Protected health information” means individually identifiable information about your past, present, or future health, your health care, or payment for your health care.

Part A — How We May Use and Disclose Your Health Information

A.1 Uses and disclosures that do not require your authorization

For Treatment. We use and disclose your PHI to provide, coordinate, and manage your care. Example: we send your hormone panel and DXA body composition results to a specialist we are referring you to, or we transmit a prescription to your pharmacy.

For Payment. We use and disclose your PHI to bill and collect payment for the services we provide. Example: we submit a claim to your health plan, or we provide a superbill so you can seek reimbursement. If you pay for a service in full out of pocket, see your right to restrict this disclosure in Part B.

For Health Care Operations. We use and disclose your PHI to run our practice and make sure you receive quality care. Example: quality review of clinical outcomes, training, licensing and credentialing, business planning, and audits.

Appointment Reminders and Health-Related Communications. We may contact you to remind you of an appointment, to tell you about treatment alternatives, or to tell you about health-related benefits and services that may interest you. You may ask us to stop or to use a different method of contact.

Individuals Involved in Your Care. Unless you object, we may share information directly relevant to a person’s involvement in your care or payment for your care with a family member, friend, or other person you identify, and we may share information with someone helping in a disaster relief effort. If you are not present or are unable to agree or object, we will use our professional judgment to determine whether disclosure is in your best interest.

As Required by Law. We will disclose your PHI when federal, state, or local law requires it.

Public Health Activities. We may disclose PHI to public health authorities to prevent or control disease, injury, or disability; to report births and deaths; to report reactions to medications or problems with products; and to notify people of recalls.

Victims of Abuse, Neglect, or Domestic Violence. We may disclose PHI to a government authority if we reasonably believe a person is a victim of abuse, neglect, or domestic violence, as North Carolina and federal law require or permit.

Health Oversight Activities. We may disclose PHI to agencies conducting audits, investigations, inspections, and licensure activities — including the North Carolina Medical Board and the U.S. Department of Health and Human Services.

Judicial and Administrative Proceedings. We may disclose PHI in response to a court or administrative order. If we receive a subpoena, discovery request, or other lawful process that is not accompanied by a court order, we will disclose PHI only if we receive satisfactory assurance that you were notified and given an opportunity to object, or that a qualified protective order has been sought — and only to the extent the physician-patient privilege under N.C. Gen. Stat. § 8-53 does not bar disclosure.

Law Enforcement. We may disclose PHI to law enforcement officials for limited purposes permitted by HIPAA, such as responding to a court order or grand jury subpoena, identifying or locating a suspect or missing person, reporting a death we believe resulted from criminal conduct, or reporting a crime on our premises.

Coroners, Medical Examiners, and Funeral Directors. We may disclose PHI as necessary for them to carry out their duties.

Organ and Tissue Donation. We may disclose PHI to organizations that handle organ procurement or transplantation.

Research. We may use or disclose PHI for research that has been approved by an Institutional Review Board with privacy protections in place, or as otherwise permitted by HIPAA.

To Avert a Serious Threat to Health or Safety. We may use or disclose PHI when necessary to prevent a serious and imminent threat to your health and safety or that of the public.

Specialized Government Functions. We may disclose PHI for military and veterans activities, national security and intelligence activities, protective services for the President, and correctional institution purposes, as permitted by law.

Workers’ Compensation. We may disclose PHI as authorized by North Carolina workers’ compensation laws.

Controlled Substances Reporting. Because we prescribe controlled substances, including testosterone (a Schedule III controlled substance), we are required to report dispensing information to and review data from the North Carolina Controlled Substances Reporting System under N.C. Gen. Stat. § 90-113.70 et seq.

Business Associates. We may disclose PHI to vendors who perform services for us — our electronic health record and patient portal vendor, our billing and IT vendors, and similar service providers. Each is bound by a written Business Associate Agreement requiring it to protect your PHI and to use it only for the agreed purpose.

A.2 Uses and disclosures that require your written authorization

We will obtain your written authorization before we:

• use or disclose psychotherapy notes, except in the narrow circumstances HIPAA allows;
• use or disclose your PHI for marketing purposes, where we would receive payment from a third party for the communication (45 C.F.R. § 164.508(a)(3));
• sell your PHI — and to be clear, we do not sell protected health information;
• use your photograph, image, video, testimonial, or before-and-after results in advertising, on our website, or on social media; or
• use or disclose your PHI for any other purpose not described in this Notice.

You may revoke an authorization at any time, in writing, except to the extent we have already acted in reliance on it.

A.3 Substance use disorder records (42 C.F.R. Part 2)

Carolina Longevity is not a “Part 2 program.” If we receive records from a federally assisted substance use disorder treatment program, those records receive additional protection under 42 C.F.R. Part 2, as amended effective February 16, 2026. We will not redisclose those records except as Part 2 permits, and we will not use or disclose them in any civil, criminal, administrative, or legislative proceeding against you without your written consent or a court order meeting Part 2’s requirements. You may revoke consent for the disclosure of Part 2 records, and you have the right to an accounting of certain Part 2 disclosures.

A.4 More protective North Carolina law

Some categories of information receive greater protection under North Carolina law than under HIPAA, and we follow the more protective standard. This includes information identifying a person with a communicable disease or condition, including HIV/AIDS status, which is confidential under N.C. Gen. Stat. § 130A-143, and confidential services lawfully consented to by a minor under N.C. Gen. Stat. § 90-21.4(b).

Part B — Your Rights Regarding Your Health Information

1. Right to Inspect and Copy. You have the right to inspect and obtain a copy of your medical and billing records. If we maintain your record electronically, you have the right to receive an electronic copy and to direct us to transmit a copy to a person or entity you designate. Submit your request in writing. We will respond within 30 days. We may charge a reasonable, cost-based fee, limited by HIPAA and by N.C. Gen. Stat. § 90-411. In limited circumstances we may deny access, and you may have the right to have that denial reviewed.
2. Right to Request an Amendment. If you believe information in your record is incorrect or incomplete, you may ask us in writing to amend it and state the reason. We will respond within 60 days. If we deny your request, we will explain why in writing, and you may submit a written statement of disagreement that will be included with your record.
3. Right to an Accounting of Disclosures. You have the right to request a list of certain disclosures we have made of your PHI in the six years prior to your request. This does not include disclosures for treatment, payment, health care operations, disclosures you authorized, or certain others. The first accounting in any 12-month period is free.
4. Right to Request Restrictions. You may ask us to limit how we use or disclose your PHI for treatment, payment, or health care operations, or to limit what we share with a family member or friend. We are not required to agree to most restriction requests. However, we must agree to one: if you pay for a health care item or service in full, out of pocket, and you ask us not to disclose information about that item or service to your health plan, we will honor that request, as required by 45 C.F.R. § 164.522(a)(1)(vi).
5. Right to Request Confidential Communications. You may ask us to communicate with you about medical matters in a specific way or at a specific location — for example, only by mail to a particular address, only at your work number, or only through the patient portal. We will accommodate all reasonable requests and will not ask you why.
6. Right to a Paper Copy of This Notice. You may ask for a paper copy of this Notice at any time, even if you agreed to receive it electronically. A current copy is always available at our office and on our website at www.carolinalongevity.com/notice-of-privacy-practices.
7. Right to Be Notified of a Breach. You have the right to be notified if we discover a breach of your unsecured PHI. We will notify you without unreasonable delay and no later than 60 days after discovery, as required by 45 C.F.R. §§ 164.400–414, and we will also provide any notice required by the North Carolina Identity Theft Protection Act, N.C. Gen. Stat. § 75-65.
8. Right to Choose Someone to Act for You. If you have given someone medical power of attorney, or if someone is your legal guardian, that person can exercise your rights and make choices about your health information. We will verify their authority before taking action.
9. Right to File a Complaint. See Part D. We will never retaliate against you for filing a complaint or exercising any right described here.

Part C — How We Protect Your Information

We maintain administrative, physical, and technical safeguards required by the HIPAA Security Rule, including: SSL/TLS encryption of all information transmitted through our website and patient portal; encryption of PHI at rest; unique user credentials and role-based access limited to the minimum necessary; audit logging; workforce privacy and security training with sanctions for violations; periodic review of our safeguards, policies, and procedures; secure destruction of records; and Business Associate Agreements with all vendors that handle PHI.

Patient portal. We provide access to your records through Elation Passport, an encrypted, password-protected patient portal. You are responsible for safeguarding your login credentials. If you authorize another person to access your record through the portal, they will see the information you have permitted until you revoke that access. Contact us immediately if you suspect unauthorized access. We do not permit analytics or advertising trackers inside the patient portal.

Telehealth. Virtual visits are conducted over an encrypted, HIPAA-compliant platform under a Business Associate Agreement, and we apply the same confidentiality standards as to in-person visits. We do not record visits without your written consent.

Email and text messaging. Standard email and SMS are not secure. If you ask us to communicate with you that way, we will, but you accept the risk of interception. Use the patient portal for anything sensitive.

Part D — Complaints and Contact

To ask a question, exercise a right, or file a complaint with us:

Privacy Inquiries
Carolina Longevity
50101 Governors Dr, Ste 105, Chapel Hill, NC 27517
Phone: (984) 234-6951
Email: privacy@carolinalongevity.com

To file a complaint with the federal government:

Office for Civil Rights, U.S. Department of Health and Human Services
200 Independence Avenue SW, Room 509F, HHH Building, Washington, D.C. 20201
1-877-696-6775
ocrportal.hhs.gov/ocr/smartscreen/main.jsf

To file a complaint with the State of North Carolina:

North Carolina Attorney General, Consumer Protection Division
9001 Mail Service Center, Raleigh, NC 27699-9001
1-877-566-7226
ncdoj.gov/file-a-complaint

North Carolina Medical Board
1203 Front Street, Raleigh, NC 27609
1-800-253-9653

Part E — Changes to This Notice

We reserve the right to change this Notice and to make the revised Notice effective for all PHI we already maintain as well as information we receive in the future. The current Notice will always be posted in our office and at www.carolinalongevity.com/notice-of-privacy-practices, with its effective date shown at the top. You may request a paper copy at any time.

Acknowledgment of receipt of this Notice is requested from each patient at the first service encounter, as required by 45 C.F.R. § 164.520(c)(2)(ii). If acknowledgment cannot be obtained, we document our good faith effort and the reason.