Effective date:** August 1, 2026

Room to Breathe Intensives is referred to as Room to Breathe throughout this document.

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Who This Notice Covers

This notice describes the privacy practices of Room to Breathe and applies to all records of your care created or maintained here.

Room to Breathe is a separate legal entity from Back to You Counseling Services, even though the same clinician practices at both. The two maintain separate records. This notice does not cover Back to You, which has its own Notice of Privacy Practices. Information does not move between the two practices without your written authorization.

Journey Clinical is a separate medical practice. If you receive ketamine-assisted psychotherapy, they hold your medical record, including eligibility evaluation, prescribing, and medical follow-up. This notice does not cover their records or their privacy practices. Request their notice from them directly.

Your Health Information

Protected health information means information about you, including demographic details, that can reasonably identify you and relates to your past, present, or future physical or mental health, the care you receive, or payment for that care.

We are required by federal and Virginia law to protect the privacy of this information, to provide you with this notice, and to follow the terms of the notice currently in effect.

How We May Use and Share Your Information Without Your Authorization

Treatment

We may use and share your information to provide and coordinate your care. Examples:

- Coordinating with your weekly therapist about your intensive, before and after

- Coordinating with Journey Clinical's medical team about your ketamine treatment

- Sharing relevant information with another provider you have been referred to

Payment

We may use and share your information to obtain payment for services. Because Room to Breathe does not accept insurance and does not file claims, this is limited. Examples:

- Processing your payment card through our payment system

- Pursuing an unpaid balance through collection, in which case only your name, the nature of services provided, and the amount owed are disclosed

Health care operations

We may use and share your information to run this practice and maintain quality of care. Examples:

- Reviewing our own documentation and processes

- Consulting with professional colleagues or supervisors about your care, without identifying you unless you have authorized it

- Business planning and administration

Business associates

We use outside services that require access to your information in order to function. Each has signed a Business Associate Agreement legally requiring them to protect your information to the same standard we are held to.

- Sessions Health, our electronic health record and payment platform

- Berries, our AI documentation assistant, used only with your separate written consent and never during ketamine dosing sessions

Appointment and practice communications

We may contact you about appointments, scheduling, paperwork deadlines, and payment. You may request that we contact you by a particular method or at a particular location. See Your Rights below.

When We May Be Required or Permitted to Share Without Your Authorization

Required by law. When federal, state, or local law requires disclosure.

Abuse or neglect. We are required to report suspected abuse or neglect of a child, and suspected abuse, neglect, or exploitation of an older adult or an incapacitated adult, to the appropriate authorities.

Serious threat to health or safety. If there is a serious and imminent threat to your safety or the safety of an identifiable person, we may disclose information necessary to prevent harm, including to potential victims, law enforcement, or emergency services.

Judicial and administrative proceedings. In response to a court order, or to a subpoena, discovery request, or other lawful process where required conditions are satisfied. See the Court, Litigation, and Records Requests policy.

Health oversight. To agencies overseeing licensure, audits, investigations, or compliance.

Law enforcement. In limited circumstances defined by law, such as responding to a court order or reporting certain injuries.

Public health. To authorities responsible for preventing or controlling disease, injury, or disability.

Coroners and medical examiners. As authorized by law.

Workers' compensation. As authorized by and to the extent necessary to comply with workers' compensation laws.

Specialized government functions. For national security or military purposes as permitted by law.

Emergencies. If you are unable to consent because of an emergency, we may share information necessary for your treatment.

When We Need Your Written Authorization

Any use or disclosure not described above requires your written authorization. This includes:

- Psychotherapy notes, described below

- Marketing of any kind

- Sale of your information, which we do not do

You may revoke an authorization at any time, in writing. Revocation applies going forward and does not undo disclosures already made in reliance on it.

Some releases are conditions of receiving services here. If that applies to a release you are considering revoking, you will be told plainly what the consequences are. See the Authorization for Release of Information.

Psychotherapy Notes

In some cases your therapist keeps separate process notes analyzing the content of a session. These are maintained separately from your clinical record and receive additional protection under federal law.

Psychotherapy notes are not released as part of a standard records request. Disclosing them requires your specific written authorization, separate from any other authorization you sign, and separate from a general release.

Psychotherapy notes do not include your diagnosis, treatment plan, symptoms, progress, session times, or the approaches used. That information is part of your regular clinical record.

Your Rights

To see and get a copy of your record

You may request access to your clinical record. Requests use the Records Request Form and may involve a reasonable cost-based fee as permitted by Virginia Code § 32.1-127.1:03. We will respond within the time frames required by law.

In limited circumstances access may be denied. If so, you will be told why in writing and, where applicable, how to have that decision reviewed.

To request a correction

If you believe something in your record is inaccurate or incomplete, you may request an amendment in writing, with your reason. If we deny the request, you will be told why and you may submit a statement of disagreement to be kept with your record.

To request confidential communications

You may ask us to contact you at a specific phone number, email address, or location, or by a specific method. We will accommodate reasonable requests and will not ask why.

To request restrictions

You may request that we limit how we use or share your information. We are not required to agree to every request, and will tell you if we cannot.

To an accounting of disclosures

You may request a list of certain disclosures we have made in the six years prior to your request. Disclosures for treatment, payment, and health care operations, and those you authorized, are generally not included. One accounting per twelve-month period is free.

To a paper copy of this notice

You may request one at any time, even if you agreed to receive it electronically.

To be told about a breach

We are required to notify you if a breach compromises the privacy or security of your information.

To file a complaint

Described below. We will not retaliate against you for filing one.

To choose someone to act for you

If you have a legal representative or have given someone medical power of attorney, that person can exercise these rights on your behalf. We will confirm their authority before acting.

Our Responsibilities

- We are required by law to maintain the privacy and security of your health information.

- We will notify you promptly if a breach occurs that may have compromised your information.

- We must follow the terms of this notice as currently in effect and give you a copy of it.

- We will not use or share your information in ways not described here without your written permission.

- Where Virginia law provides greater protection than federal law, we follow the more protective standard.

Complaints

If you believe your privacy rights have been violated, please tell your therapist first. Most concerns can be resolved directly and quickly.

You may also file a complaint with:

Room to Breathe, Privacy Officer

Emily Tate, LPC, NCC, RPT

2303 N. Parham Rd, Suite 3, Henrico, VA 23229

(804) 669-9342 | emily@roomtobreatheintensives.com

www.roomtobreatheintensives.com

U.S. Department of Health and Human Services, Office for Civil Rights

200 Independence Avenue SW, Washington, D.C. 20201

1-877-696-6775

www.hhs.gov/ocr/privacy/hipaa/complaints/

You may also file a complaint with the Virginia board that licenses your therapist.

Filing a complaint will not affect your care in any way and no retaliation of any kind will occur.

Changes to This Notice

We may change this notice at any time, and changes will apply to information we already hold as well as information we receive in the future.

The current notice will always be available on request, and the effective date appears at the top. If we make material changes, you will be provided with the updated notice.

Questions

Contact:

Emily Tate, LPC, NCC, RPT, Privacy Officer

Room to Breathe

2303 N. Parham Rd, Suite 3, Henrico, VA 23229

(804) 669-9342 | emily@roomtobreatheintensives.com

www.roomtobreatheintensives.com