HIPAA Notice of Privacy Practices

Effective Date: June 17, 2026

Your Information. Your Rights. Our Responsibilities.

This notice describes how medical information about you may be used and disclosed and how you may obtain access to this information. Please review it carefully.

This Notice of Privacy Practices applies to Elysian Medspa & Rejuvenation Center and the healthcare professionals, staff members, contractors, and authorized personnel who provide or support care through the clinic.

Our Responsibilities

We are required by law to:

  • Maintain the privacy and security of your protected health information
  • Provide you with this notice describing our legal duties and privacy practices
  • Follow the terms of the notice currently in effect
  • Notify you if a breach occurs that may have compromised the privacy or security of your protected health information
  • Respect additional protections required by applicable federal or state law

We will not use or disclose your protected health information except as described in this notice, as permitted or required by law, or as authorized by you in writing.

Your Rights

You have the following rights regarding your health information. Some rights are subject to legal limitations and verification requirements.

Obtain a Copy of Your Medical Record

You may ask to inspect or receive an electronic or paper copy of your medical record and other health information we maintain about you.

We will generally provide a copy or summary within the period required by law. We may charge a reasonable, cost-based fee where permitted.

In limited situations, the law may allow us to deny access to certain information. If access is denied, we will explain the reason and tell you whether the decision may be reviewed.

Ask Us to Correct Your Medical Record

You may ask us to correct health or billing information that you believe is inaccurate or incomplete.

We may deny the request in certain circumstances, but we will explain the reason in writing. You may have the right to submit a statement of disagreement.

Request Confidential Communications

You may ask us to contact you in a particular way or at a particular location.

For example, you may ask us to call a specific telephone number or send mail to a different address. We will accommodate reasonable requests.

Ask Us to Limit What We Use or Share

You may ask us not to use or disclose certain health information for treatment, payment, or healthcare operations.

We are not always required to agree, particularly if the requested restriction could affect your care.

If you pay for a service completely out of pocket and ask us not to disclose information about that service to your health plan for payment or healthcare operations, we will honor the request unless a law requires disclosure.

Receive an Accounting of Certain Disclosures

You may ask for a list of certain disclosures of your health information made during the six years before your request.

The accounting will not include every disclosure. For example, it generally will not include disclosures for treatment, payment, healthcare operations, or disclosures you authorized.

We will provide one accounting in a 12-month period without charge. We may charge a reasonable fee for additional requests during the same period after informing you of the cost.

Receive a Copy of This Notice

You may request a paper copy of this notice at any time, even if you agreed to receive it electronically.

Choose Someone to Act for You

If you have given someone medical power of attorney, if someone is your legal guardian, or if another person is legally authorized to act for you, that person may exercise your rights as permitted by law.

We will verify the person’s authority before taking action.

File a Complaint

You may complain if you believe your privacy rights have been violated.

You may file a complaint with:

Privacy Officer
Elysian Medspa & Rejuvenation Center
6280 Shadeland Ave., Suite A
Indianapolis, IN 46220
Phone: (317) 526-5090
Email: info@elysianmedirejuv.com

You may also file a complaint with the Office for Civil Rights of the U.S. Department of Health and Human Services.

We will not retaliate against you for filing a complaint.

How We May Use and Share Your Health Information

The following sections describe common ways we may use or disclose protected health information without obtaining a separate written authorization.

Not every example will apply in every situation.

Treatment

We may use and disclose health information to provide, coordinate, or manage your care.

For example, we may share information with:

  • Physicians and other healthcare professionals
  • Laboratories
  • Pharmacies
  • Imaging providers
  • Specialists
  • Hospitals
  • Other providers involved in your care

This may include information related to primary care, medical aesthetics, injectable treatments, laser services, skincare, dry eye treatment, weight management, IV hydration, telehealth, occupational health, or DOT and CDL medical examinations.

Payment

We may use and disclose health information to bill and receive payment for services.

For example, we may:

  • Verify insurance coverage
  • Submit insurance claims
  • Respond to health plan inquiries
  • Obtain prior authorization
  • Coordinate benefits
  • Collect deductibles, copayments, coinsurance, or other balances
  • Work with billing and claims-administration providers

Acceptance of an insurance plan does not guarantee that a particular service is covered.

Healthcare Operations

We may use and disclose health information for activities necessary to operate the clinic and improve care.

These activities may include:

  • Quality assessment
  • Staff training
  • Credentialing
  • Licensing
  • Compliance
  • Auditing
  • Legal and professional services
  • Business planning
  • Patient safety
  • Complaint resolution
  • Information technology
  • Fraud prevention
  • Reviewing provider performance
  • Evaluating services

Business Associates

We may share protected health information with vendors or professionals that perform services for us, such as billing, technology, communications, data storage, legal, accounting, or administrative support.

When required by HIPAA, these parties must agree to protect the information and use it only as permitted by law and contract.

Appointment Reminders and Service Communications

We may contact you regarding:

  • Appointments
  • Treatment preparation
  • Follow-up care
  • Prescription or laboratory matters
  • Billing
  • Insurance
  • Health-related benefits or services
  • Treatment alternatives
  • Office operations

Communications may occur by telephone, voicemail, mail, email, or text message, based on the contact information and preferences available to us.

Family Members, Friends, and Others Involved in Your Care

Unless you object, we may share information relevant to your care or payment with a family member, friend, caregiver, or other person involved in your care.

When you are not present or cannot agree because of incapacity or an emergency, we may use professional judgment to determine whether sharing limited information is in your best interest.

Disaster Relief

We may disclose limited information to an organization assisting with disaster relief so that family members or others responsible for your care can be notified about your location, condition, or status.

Public Health and Safety

We may disclose health information for legally authorized public health or safety activities, including:

  • Preventing or controlling disease
  • Reporting certain conditions
  • Reporting adverse reactions to medications or products
  • Product recalls
  • Reporting suspected abuse, neglect, exploitation, or domestic violence
  • Preventing or reducing a serious and imminent threat to health or safety

Health Oversight

We may disclose health information to governmental or regulatory agencies for legally authorized activities such as:

  • Audits
  • Inspections
  • Investigations
  • Licensing
  • Credentialing
  • Disciplinary proceedings
  • Civil rights compliance
  • Healthcare system oversight

Compliance With Law

We may disclose information when federal, state, or local law requires it.

We may disclose information to the U.S. Department of Health and Human Services to demonstrate compliance with federal privacy law.

Workers’ Compensation and Occupational Matters

We may disclose information as authorized by workers’ compensation laws and similar programs.

For occupational health or employer-requested examinations, including DOT or CDL medical examinations, information may be disclosed to the patient, employer, government agency, licensing authority, or other authorized recipient as permitted or required by law and consistent with applicable authorization and certification rules.

Law Enforcement and Government Functions

We may disclose health information for certain legally permitted purposes involving:

  • Law enforcement
  • Correctional institutions
  • Military or veterans’ activities
  • National security
  • Protective services
  • Government benefit programs
  • Identification of a deceased or missing person

Judicial and Administrative Proceedings

We may disclose information in response to a court or administrative order, subpoena, discovery request, or other lawful process when the legal requirements for disclosure have been satisfied.

Coroners, Medical Examiners, and Funeral Directors

We may disclose information to a coroner, medical examiner, or funeral director as permitted by law.

Organ and Tissue Donation

We may disclose information to organizations involved in organ, eye, or tissue donation and transplantation.

Research

We may use or disclose health information for research when the research has received required approval or when another legal permission applies.

Serious Threats

We may use or disclose information when necessary and legally permitted to prevent or reduce a serious threat to the health or safety of a person or the public.

Uses and Disclosures That Usually Require Written Authorization

We generally will obtain your written authorization before:

  • Using or disclosing protected health information for marketing when HIPAA requires authorization
  • Selling protected health information as defined by HIPAA
  • Using or disclosing psychotherapy notes, if we maintain them, except in limited circumstances permitted by law
  • Making another use or disclosure not described in this notice and not otherwise permitted or required by law

You may revoke an authorization in writing at any time. Revocation will not affect actions already taken in reliance on the authorization.

Substance Use Disorder Records

If we receive or maintain substance use disorder patient records protected by 42 CFR Part 2, additional confidentiality protections may apply.

Such records generally may not be used or disclosed in a civil, criminal, administrative, or legislative investigation or proceeding against you without your written consent or a court order accompanied by any legally required subpoena.

Other uses and disclosures of Part 2 records will be handled according to applicable federal law.

Communications About Products and Services

We may communicate with you about treatment alternatives, care coordination, health-related products, benefits, or services that may be of interest to you when permitted by law.

Marketing communications that require a HIPAA authorization will not be sent without the required authorization.

Our Duties Regarding Breaches

We will notify you as required by law if we discover a breach of unsecured protected health information that may have compromised the privacy or security of your information.

Changes to This Notice

We may change the terms of this notice and apply the revised notice to all health information we maintain, including information created or received before the change.

The current notice will be:

  • Available at our clinic
  • Available upon request
  • Posted on our website
  • Identified by its effective date

Questions and Contact Information

For questions about this notice, medical-record requests, privacy concerns, restrictions, confidential communications, or complaints, contact:

Privacy Officer
Elysian Medspa & Rejuvenation Center
6280 Shadeland Ave., Suite A
Indianapolis, IN 46220
Phone: (317) 526-5090
Email: info@elysianmedirejuv.com