Notice of Privacy Practices

Effective Date: September 1, 2026  |  Last Updated: September 3, 2026

1. Who We Are

REGEN RX is a telehealth platform operated by Hello Gorgeous PC, a professional corporation providing healthcare services in the State of Illinois. Our services are provided by licensed healthcare providers, including nurse practitioners with Full Practice Authority (FPA) and collaborating physicians.

2. Protected Health Information (PHI) We Collect

We collect the following types of health information:

• Identifying Information: Name, date of birth, address, phone number, email
• Medical History: Current medications, allergies, past diagnoses, surgical history
• Health Questionnaire Responses: Screening questions for treatment eligibility
• Treatment Records: Prescriptions, provider notes, lab results (if applicable)
• Communication Records: Messages between you and your care team
• Payment Information: Billing records (credit card numbers are processed securely by Stripe and not stored by us)

3. How We Use and Disclose Your PHI

We may use and disclose your health information for the following purposes:

Treatment

To provide, coordinate, and manage your healthcare. This includes sharing information with pharmacies to fill your prescriptions, consulting with other healthcare providers involved in your care, and communicating with you about your treatment.

Payment

To obtain payment for services provided to you. This includes billing, claims management, and collection activities.

Healthcare Operations

To support our business activities, including quality assessment, staff training, compliance programs, audits, and business planning.

As Required by Law

We will disclose your PHI when required by federal, state, or local law. This includes:

• Court orders and subpoenas
• Public health reporting (communicable diseases, adverse drug events)
• Reports to law enforcement in certain circumstances
• Reports of abuse, neglect, or domestic violence
• Health oversight activities

With Your Authorization

Other uses and disclosures not described in this notice will only be made with your written authorization. You may revoke an authorization at any time by submitting a written request.

4. Your Rights Regarding Your PHI

You have the following rights concerning your health information:

5. Our Responsibilities

• We are required by law to maintain the privacy and security of your PHI
• We will notify you promptly if a breach occurs that may have compromised your PHI
• We will not use or share your information other than as described here unless you give us written permission
• We will follow the duties and privacy practices described in this notice

6. How We Protect Your Information

We implement the following safeguards to protect your PHI:

• Administrative Safeguards: Staff training, access policies, risk assessments
• Physical Safeguards: Secure facilities, workstation security
• Technical Safeguards: Encryption (TLS 1.3), access controls, audit logs, secure authentication

Our telehealth platform uses industry-standard encryption. Patient communications are transmitted securely. We use HIPAA-compliant infrastructure providers including Supabase (database), Vercel (hosting), and Stripe (payments).

7. Business Associates

We work with third-party service providers ("Business Associates") who may have access to your PHI. These include:

• Compounding Pharmacy: To fill your prescriptions (Formulation Rx — our exclusive pharmacy partner)
• Payment Processors: To process payments securely (Stripe)
• Communication Platforms: For secure messaging and video consultations (Doxy.me)
• Cloud Service Providers: For secure data storage

We require all Business Associates to sign agreements that obligate them to protect your PHI in accordance with HIPAA requirements.

8. Data Retention

We retain your Protected Health Information for the following periods:

• Medical Records: Minimum of 10 years from the date of last treatment, or as required by Illinois law
• Prescription Records: Minimum of 5 years as required by pharmacy regulations
• Billing Records: 7 years for tax and audit purposes
• Communication Records: Duration of treatment relationship plus 6 years

After the retention period expires, records are securely destroyed using industry-standard methods (digital shredding, secure deletion). You may request earlier deletion of non-required records, though we may retain information necessary for legal compliance, dispute resolution, or ongoing care.

9. Changes to This Notice

We reserve the right to change this notice and make the new provisions effective for all PHI we maintain. If we make material changes, we will post the revised notice on our website and update the effective date. The current notice is always available at tryregenrx.com/hipaa.

10. Complaints

If you believe your privacy rights have been violated, you may file a complaint with us or with the U.S. Department of Health and Human Services. You will not be retaliated against for filing a complaint.