IRISIV Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

IRISIV LLC — Mobile IV Hydration & Vitamin Therapy
5110 28th St #1044, Grand Rapids, MI 49512
(616) 577-8189 · info@irisiv.com · irisiv.com

Effective date: November 1, 2026

IRISIV provides IV hydration and vitamin therapy in patients' homes, offices, hotels and event locations across West Michigan. Because we treat you outside a traditional clinic, we take extra steps to protect your health information wherever we see you. This notice explains how we use your information, when we may share it, and the rights you have over it.

Our duties to you

We are required by law to keep your protected health information (PHI) private and secure. PHI includes your name, contact details, intake forms, medical history, treatment records, vital signs, payment records and anything else that identifies you and relates to your health or care.

We must:

• Protect the privacy and security of your PHI, on paper, on mobile devices and in our electronic records systems
• Give you this notice and follow the terms of the notice currently in effect
• Notify you promptly if a breach occurs that may have compromised your unsecured PHI
• Use or share only the minimum information necessary for the purpose, except for treatment
• Not use or share your information other than as described here unless you give us written permission, which you may revoke at any time

Our nurses and staff are trained on these rules. Records and devices carried to appointments are kept locked or password-protected, and we do not discuss your care where others can overhear when it can reasonably be avoided.

How we typically use and share your information

Treatment. We use your information to screen you, decide whether IV therapy is safe for you, give your treatment and monitor you afterward. Our registered nurses, nurse practitioner and medical director share information with each other to provide your care. If you need emergency care during a visit, we will share what responders need, such as with 911/EMS or a hospital. We may also share information with your other health care providers, or with the pharmacy that supplies your IV fluids and medications, when it helps your care. Before your first treatment, we share your information with Qualiphy, the independent telehealth service whose licensed practitioners complete your Good Faith Exam, and we receive the results of that exam.

Example: A nurse reviews your intake form and current medications with our medical director before starting a drip.

Payment. IRISIV is a self-pay practice and does not bill insurance. We use your information to process payments, collect cancellation or no-show fees charged to your card on file, and give you receipts or superbills you can submit to your own insurer or HSA/FSA.

Health care operations. We use your information to run our practice: reviewing quality and safety, training staff, managing supplies and inventory, credentialing, legal and compliance reviews, and business planning.

Appointment reminders and follow-up. We may contact you by phone, text or email to confirm appointments, give pre-visit instructions, check how you are feeling after treatment, or send thank-you notes, offers or information about IRISIV's own services. Tell us if you prefer a particular contact method, and contact us anytime to stop promotional messages.

Business associates. We work with outside companies that handle information for us, such as our electronic health record and booking system, payment processor and IT providers. Each signs a business associate agreement requiring it to protect your information.

Our medical director's practice. Clinical services are provided under the supervision of a licensed medical director. Information is shared between IRISIV and the medical director's practice as needed for treatment, payment and operations.

Care at your location. Because we come to you, others may be present during your visit. You choose who stays in the room. Unless you object, we may discuss your care in front of people you allow to be present, such as a family member, friend or event host.

Family and friends involved in your care. If you agree, or do not object when given the chance, we may share information with a person involved in your care or paying for it. If you are unable to agree, such as in an emergency, we may share what we believe is in your best interest.

Other ways we may share your information

The law allows or requires us to share information without your written permission in these situations, and only as the law permits:

• Required by law — when federal, state or local law requires it
• Public health and safety — reporting disease, reporting adverse reactions or product defects to the FDA, enabling product recalls, or preventing a serious threat to someone's health or safety
• Abuse, neglect or domestic violence — reporting suspected abuse or neglect to the proper authorities
• Health oversight — audits, inspections, investigations and licensing by agencies such as the Michigan Department of Licensing and Regulatory Affairs (LARA)
• Lawsuits and legal actions — in response to a court order, subpoena or other lawful process
• Law enforcement — for limited purposes, such as identifying a suspect or reporting a crime on our premises or during a visit
• Coroners, medical examiners and funeral directors — as needed to carry out their duties
• Organ and tissue donation — with organ procurement organizations
• Research — only with your written authorization
• Workers' compensation — as authorized by workers' compensation laws
• Government functions — military, national security and protective services, as the law allows
• HHS — to the U.S. Department of Health and Human Services to show we comply with HIPAA

Uses that need your written permission

We will never do the following without your signed authorization:

• Marketing that uses your health information, other than face-to-face conversations or promotional gifts of nominal value
• Sale of your health information — IRISIV does not sell patient information
• Testimonials, photos or videos — we will not post your name, image, before/after photos, reviews or treatment details on our website or social media without your written consent
• Psychotherapy notes, if any exist
• Any other use not described in this notice

You may revoke an authorization at any time by writing to our Privacy Officer. Revoking stops future sharing but cannot undo sharing already done in reliance on it.

Michigan law. Michigan law may give extra protection to certain information, such as HIV/AIDS and communicable disease status, substance use disorder treatment records and mental health records. When state law is stricter than HIPAA, we follow the stricter rule.

Your rights

To use any of these rights, contact our Privacy Officer (see below). We may ask you to make requests in writing.

• Get a copy of your records. You can see or get an electronic or paper copy of your medical and billing records. We will respond within 30 days and may charge a reasonable, cost-based fee.
• Ask us to correct your records. If you think information is wrong or incomplete, you can ask us to amend it. We may say no, but we will tell you why in writing within 60 days.
• Request confidential communications. You can ask us to contact you a certain way, such as only by cell phone or at a different address. We will agree to all reasonable requests.
• Ask us to limit what we use or share. You can ask us not to use or share certain information. We are not required to agree if it would affect your care. If you pay in full out of pocket for a service, you can ask us not to share that information with your health insurer, and we will agree unless the law requires us to share it.
• Get a list of those we've shared with. You can ask for a list of times we shared your information in the 6 years before your request, who we shared it with and why. It excludes treatment, payment, operations and disclosures you authorized. One list per year is free.
• Get a copy of this notice. You can ask for a paper copy at any time, even if you agreed to receive it electronically.
• Choose someone to act for you. If you have given someone medical power of attorney or someone is your legal guardian, that person can exercise your rights. We will confirm their authority first.
• Be notified of a breach. We will tell you if your unsecured information is compromised.

Complaints, changes and contact

Complaints. If you believe your privacy rights have been violated, you may file a complaint with us or with the U.S. Department of Health and Human Services, Office for Civil Rights: 200 Independence Avenue SW, Washington, DC 20201 · 1-877-696-6775 · www.hhs.gov/ocr/privacy/hipaa/complaints. We will not retaliate against you for filing a complaint.

Changes to this notice. We may change this notice, and the changes will apply to all information we have about you. The current notice will be posted on our website, available at every visit, and provided on request.

Privacy Officer
Moniqua Ballard, BSN, RN, Privacy Officer
IRISIV LLC
5110 28th St #1044, Grand Rapids, MI 49512
(616) 577-8189 · info@irisiv.com