S2G MEDICAL SPA NOTICE OF PRIVACY PRACTICES (HIPAA)

Applies to: S2G Medical Spa and all of its entities, including its locations in West Bloomfield, Commerce Township, Shelby Township, and Clarkston, Michigan, to the extent they operate under this legal entity and notice.

IMPORTANT NOTICE REGARDING YOUR MEDICAL INFORMATION

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED, HOW YOU MAY ACCESS YOUR INFORMATION, AND YOUR RIGHTS REGARDING THE PRIVACY OF YOUR HEALTH INFORMATION. PLEASE REVIEW IT CAREFULLY.

S2G Medical Spa, operated by Salon2Go Spa LLC, is committed to protecting the privacy, security, and confidentiality of our patients' personal and medical information.

We comply with applicable federal and Michigan privacy laws, including the Health Insurance Portability and Accountability Act (HIPAA), to the extent applicable to our operations.

Protected Health Information (PHI) includes information that identifies you and relates to your past, present, or future physical or mental health, medical conditions, treatments, healthcare services, or payment for healthcare.

This Notice explains how we may use and disclose your information, your privacy rights, and our legal responsibilities.

1. USES AND DISCLOSURES OF PROTECTED HEALTH INFORMATION

We may use or disclose your protected health information for treatment, payment, and healthcare operations without obtaining separate written authorization when permitted by law.

Treatment

We may use and share your medical information with our medical director, licensed healthcare providers, registered nurses, authorized clinical personnel, and other healthcare professionals involved in your treatment.

This may include medical consultations, reviewing medical history, coordinating care, documenting procedures, evaluating treatment outcomes, prescribing when appropriate, and referrals to other healthcare professionals.

Payment

We may use or disclose information necessary to process payments, verify payment information, manage financing arrangements, collect outstanding balances, and complete other lawful payment-related activities.

When you request third-party financing, relevant information may be shared with the financing provider as permitted by law and subject to any required authorization.

Healthcare Operations

We may use your information for normal business operations, including:

• Appointment scheduling and management
• Quality assurance and patient safety
• Employee training and supervision
• Licensing, compliance, and audits
• Medical record management
• Patient communication and follow-up
• Billing and administrative services
• Improving our healthcare services

We limit access to protected information to authorized individuals and service providers with an appropriate business need.

2. ELECTRONIC COMMUNICATIONS, TEXT MESSAGING & EMAIL

S2G Medical Spa uses Mangomint, our practice management and communication platform, to assist with appointment scheduling, confirmations, reminders, client communications, and administrative services.

With the appropriate consent, patients may receive electronic communications, including SMS text messages, emails, and automated notifications.

Messages may include appointment confirmations, reminders, scheduling changes, pre-appointment instructions, and administrative follow-ups.

Text Messaging Opt-Out

Patients may opt out of Mangomint text messages at any time by replying STOP to a text message.

After opting out, patients will no longer receive messages through that SMS messaging service, except for any permitted confirmation of the opt-out.

When an email address is available and email communication is authorized, our office may use email instead for routine appointment communications.

Patients may also contact our office to update their communication preferences.

Electronic Communication Privacy

Standard SMS text messages and ordinary emails may not be fully secure. Messages could potentially be viewed by others with access to your phone, email account, or electronic devices.

We take reasonable precautions to protect your information and limit sensitive medical details in routine electronic communications.

Patients may request alternative or confidential communication methods, and we will accommodate reasonable requests as required by law.

Message and data rates may apply. Message frequency varies. Patients may reply HELP to eligible Mangomint messages for assistance.

3. ARTIFICIAL INTELLIGENCE (AI) COMMUNICATIONS — MIRA

S2G Medical Spa utilizes Mira, an AI-powered virtual assistant integrated with Mangomint, to assist with client communication and administrative services.

Mira may assist with:

• Answering incoming telephone calls
• Scheduling, rescheduling, and canceling appointments
• Responding to routine client inquiries
• Providing general information about our services
• Explaining appointment and booking policies
• Sending or responding to administrative text messages
• Directing questions to our staff when necessary

Disclosure of AI Use

Patients may interact with an AI-powered assistant rather than a live employee. S2G Medical Spa will provide appropriate disclosures and obtain any legally required consent for AI-assisted communications.

Mira may process call audio, real-time transcriptions, text messages, chat content, and relevant appointment information through Mangomint and its authorized technology providers.

Where permitted and properly configured, information may be processed to generate responses, maintain communication records, and facilitate scheduling and other administrative functions.

AI Limitations

Mira is not a licensed healthcare professional and does not independently diagnose medical conditions, prescribe medications, provide individualized medical advice, or make clinical treatment decisions.

Medical concerns requiring professional evaluation will be directed to appropriate healthcare personnel.

AI Privacy and Security

When protected health information is processed through Mira, we will use HIPAA-authorized services and appropriate contractual and security safeguards.

Calls with Mira may be recorded and transcribed for scheduling, quality, and record-keeping purposes.

S2G Medical Spa requires a Business Associate Agreement with Mangomint and with any AI or technology service provider that creates, receives, maintains, or transmits protected health information on our behalf, including in connection with Mira, before such information is processed.

Information processed through AI-supported systems may be shared with authorized service providers as necessary to deliver those services, subject to applicable privacy laws and agreements.

Any required consent for call recording, transcription, monitoring, or AI-assisted analysis will be obtained separately when required by law.

Patients may request assistance from a human staff member instead of continuing an AI-assisted interaction.

4. MARKETING AND PROMOTIONAL COMMUNICATIONS

S2G Medical Spa may offer information regarding services, promotions, special events, skincare products, and other offerings.

Where required by law, we will obtain separate consent or authorization before sending promotional text messages or using protected health information for marketing.

Consent to promotional messages is not a condition of receiving medically necessary treatment.

Patients may withdraw consent for promotional text messages by replying STOP or contacting our office.

We will not sell protected health information without legally required authorization.

5. OTHER PERMITTED OR REQUIRED DISCLOSURES

We may use or disclose protected health information without separate authorization when permitted or required by law, including for:

Public Health and Safety: Reporting communicable diseases, adverse medication reactions, product recalls, or circumstances involving a serious threat to health or safety.

Health Oversight: Authorized investigations, inspections, licensing reviews, and regulatory audits.

Abuse or Neglect: Reporting suspected abuse, neglect, or domestic violence when permitted or required by law.

Legal Proceedings: Responding to lawful court orders, subpoenas, or other legal processes when applicable requirements are met.

Law Enforcement: Disclosures permitted or required under applicable federal or state law.

Workers' Compensation: Disclosures authorized by workers' compensation laws.

Coroners and Medical Examiners: Disclosures authorized for identification or other legally permitted purposes.

Research: Disclosures for approved research activities when applicable privacy requirements are satisfied.

Other Legal Obligations: Disclosures to government agencies or authorities when legally required.

We will apply any additional protections required by Michigan law or other applicable privacy laws.

6. SUBSTANCE USE DISORDER RECORDS AND SPECIALLY PROTECTED INFORMATION

Certain substance use disorder treatment records are subject to additional federal confidentiality protections under 42 CFR Part 2.

To the extent we receive or maintain records protected by Part 2, we will handle those records according to applicable requirements.

Such records generally may not be used or disclosed in civil, criminal, administrative, or legislative proceedings against a patient without the patient's written consent or an appropriate court order accompanied by a subpoena or similar legal mandate, as required by law.

Other categories of particularly sensitive medical information may receive additional protection under applicable federal or Michigan law.

When additional consent or authorization is legally required, we will obtain it before using or disclosing the information.

7. PATIENT PRIVACY RIGHTS

You have the following rights regarding your protected health information.

Right to Access Medical Records

You may request to inspect or obtain an electronic or paper copy of your medical records and other protected health information maintained in a designated record set.

We generally must respond within 30 days, subject to legally permitted extensions or exceptions.

A reasonable, cost-based fee may apply when permitted by law.

Right to Request Corrections

You may request an amendment to information you believe is inaccurate or incomplete.

We may deny certain requests as permitted by law and will provide an explanation of a denial.

Right to Request Restrictions

You may request limitations on certain uses or disclosures of your information for treatment, payment, or healthcare operations.

We are not generally required to agree to every restriction.

However, when you pay out of pocket in full for a healthcare service, you may request that we not disclose information about that service to your health plan for payment or healthcare operations. We will honor such requests unless disclosure is otherwise required by law.

Right to Confidential Communications

You may request that we contact you using a particular telephone number, email address, mailing address, or other reasonable communication method.

We will accommodate reasonable requests.

Right to an Accounting of Disclosures

You may request an accounting of certain disclosures of your protected health information made during the preceding six years, subject to applicable exceptions.

One accounting within a 12-month period is generally provided without charge. Additional requests may be subject to a reasonable, cost-based fee.

Right to a Copy of This Notice

You may request a paper copy of this Notice of Privacy Practices at any time, even if you previously agreed to receive it electronically.

Right to Designate a Personal Representative

A legally authorized personal representative may exercise applicable privacy rights on your behalf, subject to verification and applicable law.

Right to Withdraw Authorization

When we rely on your written authorization for a use or disclosure, you may revoke that authorization in writing, except to the extent we have already acted in reliance on it.

Right to Be Notified of a Breach

You have the right to receive notification of a breach of unsecured protected health information when notification is required by law.

8. FAMILY MEMBERS AND OTHERS INVOLVED IN YOUR CARE

When permitted by law, we may share relevant health information with family members, caregivers, or other individuals involved in your care or payment for your care.

You may express preferences regarding these disclosures.

When you are unable to communicate your preferences, we may use professional judgment and applicable legal standards to determine whether limited disclosure is appropriate.

9. PATIENT PHOTOGRAPHS, VIDEOS AND TESTIMONIALS

S2G Medical Spa may take clinical photographs or videos when appropriate for treatment documentation, medical evaluation, or monitoring treatment progress.

Clinical photographs and videos that identify a patient may constitute protected health information.

We will not use identifiable patient photographs, before-and-after images, videos, testimonials, or medical information for public advertising or social media without obtaining the required separate authorization.

Patients may decline optional promotional photography without affecting their access to treatment.

10. THIRD-PARTY SERVICE PROVIDERS

We may use authorized third-party service providers to support scheduling, medical records, communications, payment processing, information technology, and other administrative functions.

These may include Mangomint and other service providers used in our operations.

When required under HIPAA, appropriate Business Associate Agreements and safeguards will be maintained.

We disclose only information permitted by law and reasonably necessary for the applicable purpose.

11. OUR PRIVACY AND SECURITY RESPONSIBILITIES

S2G Medical Spa is committed to maintaining appropriate administrative, physical, and technical safeguards to protect patient information.

Our responsibilities include:

• Protecting the privacy and security of PHI
• Limiting unauthorized access and disclosure
• Training authorized staff on privacy practices
• Maintaining appropriate access controls
• Following applicable record retention requirements
• Responding to patient privacy requests
• Providing legally required breach notifications
• Maintaining appropriate agreements with business associates
• Following the privacy practices described in this notice

We will not use or disclose your protected health information in ways not described in this notice unless permitted or required by law or authorized by you.

12. COMPLAINTS AND PRIVACY CONCERNS

If you believe your privacy rights have been violated, you may file a complaint with S2G Medical Spa, operated by Salon2Go Spa LLC, or with the U.S. Department of Health and Human Services Office for Civil Rights.

To file a complaint with our office, please contact our Privacy Officer at 248-254-3055 or 6253 Orchard Lake Road, West Bloomfield, MI 48322.

You may also file a complaint with HHS at www.hhs.gov/hipaa/filing-a-complaint.

We will not retaliate against you for filing a complaint or exercising your privacy rights.

13. CHANGES TO THIS NOTICE

S2G Medical Spa reserves the right to revise this Notice of Privacy Practices as permitted by law.

Changes may apply to protected health information already maintained by our practice, as well as information obtained in the future.

Updated notices will be made available upon request, at our locations, and on our website.