Notice of Privacy Practices

eDermatology Medical Group P.C. (the “Practice”, “we”, “us”), the professional medical corporation whose dermatologists provide care through the eDermatology™ platform · 24881 Alicia Pkwy, Suite E-199, Laguna Hills, CA 92653

Effective date: November 6, 2026 · Version 1.0

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Who this notice covers

This notice is issued by the Practice, the licensed medical corporation whose physicians and clinicians evaluate and treat you. The Practice is a “covered entity” under the federal Health Insurance Portability and Accountability Act (HIPAA). The eDermatology™ platform — the website, the patient and clinician portals at app.edermatology.com, and the systems behind them — is operated for the Practice by eDermatology, Inc., which handles your health information only as the Practice’s business associate, under a written agreement that binds it to the same protections. Your use of the website and the apps as such is described separately in eDermatology, Inc.’s Privacy Policy; this notice is about your medical information.

“Protected health information” (PHI) is information that identifies you and relates to your health, the care you receive, or payment for that care — including the photographs you send us, the clinicians’ notes, your messages with the care team, your prescriptions, and your billing records.

How we may use and disclose your health information

For treatment. We use your information to evaluate and treat you, and we may share it with others involved in your care. Example: the dermatologist reviews the photographs and history you or your referring clinic submitted; we send the dermatologist’s report and care plan back to the clinic that referred you; we transmit a prescription to the pharmacy you chose; we refer you to another specialist.

For payment. We use and share your information to bill and collect payment for your care. Example: we send a claim to your health plan, or we charge the membership or per-visit fee you agreed to and keep the record of that charge.

For health care operations. We use your information to run the Practice and improve the care we give. Example: reviewing the quality of our clinicians’ work, training clinicians and staff, resolving complaints, planning our services, and the business associate’s work of keeping the platform secure and working. We may use de-identified information — information from which everything that identifies you has been removed by the methods HIPAA requires — for any purpose, including research and improving the tools our clinicians use; de-identified information is no longer PHI.

Appointment reminders, results and care information. We may contact you — by the e-mail address and, if you choose it, the mobile number you gave us — to tell you that a result is ready, to remind you of a visit, or to tell you about treatment options and services related to your care.

Other uses and disclosures permitted or required by law, without your authorization, in the limited circumstances the law describes:

As required by law — when federal, state or local law requires it.
Public health — to public health authorities, for example to report a communicable disease, an adverse reaction to a medication, or a product recall.
Abuse, neglect or domestic violence — to the government authorities permitted to receive such reports.
Health oversight — to agencies that audit, inspect, license or investigate the health care system.
Judicial and administrative proceedings — in response to a court or administrative order, or a subpoena or lawful process when the law’s conditions are met.
Law enforcement — for law-enforcement purposes within the limits the law sets, such as to comply with a warrant.
Coroners, medical examiners and funeral directors, and for organ and tissue donation where applicable.
Research — under the approval of a privacy board or institutional review board, or when the researcher receives only de-identified information.
To avert a serious threat to a person’s health or safety.
Specialized government functions — military, national security, protective services, correctional institutions.
Workers’ compensation — as authorized by the workers’ compensation laws.
To our business associates — companies that work for us, such as eDermatology, Inc. (the platform), our cloud provider, our e-prescribing network and our payment processor — each bound by a written agreement to protect your information.
To family and friends involved in your care, or for notification in an emergency, when you agree, when you are given the opportunity to object and do not, or when, in our professional judgment, it is in your best interest and you are unable to agree.

Uses and disclosures that require your written authorization. We will not use or disclose your information for the purposes below without your written authorization, which you may revoke in writing at any time (except to the extent we have already acted on it):

Marketing — communications that encourage you to buy or use a product or service, other than the care-related communications described above.
Sale of your protected health information.
Psychotherapy notes (we do not ordinarily create them).
Any other use or disclosure not described in this notice.

California and Connecticut law. Where state law gives your information greater protection than HIPAA — for example California’s Confidentiality of Medical Information Act, and the laws of both states on mental health, HIV, substance use disorder and reproductive health information — we follow the stricter law. If we ever receive records of substance use disorder treatment protected by federal law (42 CFR Part 2), we protect them as that law requires and will not use or disclose them in legal proceedings against you without your consent or a court order meeting that law’s conditions.

Your rights

You have the following rights regarding your health information. To exercise any of them, contact the Privacy Officer (below); we will tell you how to make the request in writing and will respond within the time the law allows.

To inspect and get a copy of your medical and billing records, in paper or electronic form, including the record set kept on the platform; much of it is available to you at any time in your patient portal. We may charge a reasonable cost-based fee for copies. In limited cases we may deny access; if so, you may ask for the denial to be reviewed.
To ask us to correct information you believe is incorrect or incomplete. We may deny the request in writing, and you may file a statement of disagreement that we keep with the record.
To an accounting of disclosures — a list of the disclosures we have made of your information for six years before your request, other than for treatment, payment and operations and certain others the law excludes. The first list in any twelve months is free.
To request restrictions on how we use or disclose your information. We are not required to agree, except: if you pay in full out of pocket for a service and ask us not to disclose that service to your health plan for payment or operations, we must agree.
To confidential communications — to ask us to contact you in a particular way or at a particular place (for example, only by the portal, or only at a certain e-mail address). We will accommodate reasonable requests.
To a paper copy of this notice, even if you agreed to receive it electronically. It is always available on the platform and at edermatology.com.
To be notified of a breach of unsecured protected health information that affects you.
To choose someone to act for you — a person with a medical power of attorney, or a legal guardian, may exercise these rights for you; we verify that authority before acting.

Our duties

We are required by law to keep your protected health information private, to give you this notice of our legal duties and privacy practices, and to follow the notice currently in effect. We reserve the right to change our practices and this notice, and to make the new notice apply to all information we hold. The current notice is always posted on the platform and at edermatology.com; a material change will be presented to you at your next sign-in.

Complaints

If you believe your privacy rights have been violated, you may complain to us — to the Privacy Officer below — and to the Secretary of the U.S. Department of Health and Human Services, Office for Civil Rights (200 Independence Avenue S.W., Washington, D.C. 20201; 1-800-368-1019; www.hhs.gov/ocr/privacy/hipaa/complaints). We will not retaliate against you for filing a complaint.

Contact

Privacy Officer, eDermatology Medical Group P.C. 24881 Alicia Pkwy, Suite E-199, Laguna Hills, CA 92653 support@edermatology.com (attention: Privacy Officer) · (877) 656-DERM (3376)