Notice of Privacy Practices

Effective Date: October 29, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Aláry Inc., doing business as Aláry Health Spa and Aláry Health ("Aláry," "we," "us"), is required by law to protect the privacy of your health information, to give you this notice of our legal duties and privacy practices, and to follow the notice currently in effect. This notice applies to all care you receive from Aláry, in person at 3 Neptune Rd, Poughkeepsie, NY and by telehealth.

How we may use and share your health information
• Treatment. To provide and coordinate your care, for example sharing information among our clinicians, with Guardian Medical Group (our medical oversight partner), with a pharmacy filling your prescription, or with another provider treating you.
• Payment. To bill and collect payment for your care, for example processing your card payment or preparing an itemized receipt you ask for.
• Health care operations. To run our practice, for example quality review, staff training, supervision of clinicians, licensing, audits and legal services.
• Appointment reminders and service information. To remind you of appointments and tell you about treatment options related to your care.
• Business associates. With companies that perform services for us, such as our electronic health record (Healthie), scheduling and payment processors. They must sign agreements to protect your information.

Other uses and disclosures allowed or required by law
We may share your information without your written permission when the law allows or requires it, including: as required by federal, state or local law; for public health activities, such as reporting disease, adverse reactions to medications or product recalls (including FDA reporting); to report suspected abuse, neglect or domestic violence; for health oversight activities such as audits and licensing inspections; in response to a court order, subpoena or other lawful process; to law enforcement in limited circumstances; to prevent a serious and imminent threat to the health or safety of you or others; to coroners, medical examiners and funeral directors; for organ and tissue donation; for workers' compensation; for specialized government functions such as military and national security; and for research approved under privacy rules.

Uses that require your written authorization
We will not use or share your information for the following without your written authorization: most uses of psychotherapy notes; marketing (including using your photos or testimonials to promote Aláry); and the sale of your health information. Any other use not described in this notice also requires your written authorization. You may revoke an authorization in writing at any time, except to the extent we have already acted on it.

Extra protections under New York and federal law
Certain information has added protection and generally requires your specific written consent before we share it, including HIV-related information, certain mental health records, substance use disorder treatment records protected by federal law (42 CFR Part 2), and genetic testing information.

Your rights
• Get a copy of your records. You can ask to see or get a paper or electronic copy of your health information. We will usually respond within 30 days and may charge a reasonable, cost-based fee.
• Ask us to correct your records. You can ask us to correct information you believe is incorrect or incomplete. We may say no, but will tell you why in writing within 60 days.
• Request confidential communications. You can ask us to contact you in a specific way (for example, a certain phone number or email) or at a different address. We will agree to reasonable requests.
• Ask us to limit what we use or share. You can ask us not to use or share certain information. We are not required to agree, except that if you pay for a service in full out of pocket, you can ask us not to share information about it with your health insurer, and we will agree unless the law requires us to share it.
• Get a list of those we have shared information with. You can ask for a list (accounting) of the times we shared your information in the six years before your request, other than for treatment, payment, operations and certain other disclosures. One list per year is free.
• Get a copy of this notice. You can ask for a paper copy at any time, even if you agreed to receive it electronically.
• Choose someone to act for you. If you have given someone medical power of attorney or have a legal guardian, that person can exercise your rights.
• Be notified of a breach. We will notify you if a breach occurs that may have compromised the privacy or security of your information.

Changes to this notice
We may change this notice, and the changes will apply to all information we have about you. The current notice will be posted on our website and available in our office, and a copy is available on request.

Complaints
If you believe your privacy rights have been violated, you can file a complaint with our Privacy Officer (contact below) or with the U.S. Department of Health and Human Services Office for Civil Rights, 200 Independence Avenue SW, Washington, D.C. 20201, by calling 1-877-696-6775, or online at www.hhs.gov/ocr/privacy/hipaa/complaints. We will not retaliate against you for filing a complaint.

Contact our Privacy Officer
Dino Alexander, Privacy Officer, Aláry Inc.
3 Neptune Rd, Poughkeepsie, NY 12601
Phone: 845-284-1455
Email: hello@alaryhealthspa.com