Effective Date: September 22, 2026 | Privacy Officer: Elyra Healthcare | info@elyrahealthcare.com | (951) 904-3342

Our Commitment to Your Privacy

Elyra Healthcare provides virtual mental health services and is committed to protecting the privacy, security, and confidentiality of your health information. This Notice explains how Elyra may use and disclose protected health information (PHI), the rights you have regarding your records, and Elyra’s responsibilities under the Health Insurance Portability and Accountability Act (HIPAA) and applicable California privacy and mental health confidentiality laws.

1. How We May Use and Disclose Your PHI

Treatment

We may use and share your health information to provide, coordinate, and manage your care. This may include conducting secure video or audio therapy sessions, developing and updating your treatment plan, coordinating with members of your treatment team, and consulting with another health care provider involved in your care.

Payment

We may use and share health information to obtain payment for services. This may include verifying benefits, submitting claims to health plans, responding to coverage or medical-necessity questions, processing permitted payment transactions, or preparing documentation such as superbills when requested.

Health Care Operations

We may use and share health information for activities needed to operate Elyra and improve care, such as quality assessment, clinical supervision where permitted, credentialing, compliance activities, business planning, administrative functions, and security reviews of our telehealth, electronic health record, and related systems.

2. Uses and Disclosures Requiring Written Authorization

Psychotherapy Notes

Psychotherapy notes, as specifically defined by HIPAA, are notes recorded by a mental health professional that document or analyze the contents of a counseling conversation and are kept separate from the rest of the medical record. Most uses and disclosures of psychotherapy notes require your written authorization. Limited exceptions may apply, including use by the note’s originator for treatment, certain training activities, defense of a legal action brought by you, health oversight of the note’s originator, disclosures required by law, and disclosures needed to prevent or lessen a serious and imminent threat when permitted by law.

Marketing and Sale of PHI

Elyra will not sell your PHI. Elyra will not use or disclose PHI for marketing when HIPAA requires authorization unless you first provide a valid written authorization. A HIPAA authorization is separate from this Notice and may be revoked in writing, subject to actions already taken in reliance on it.

Other Uses

Uses or disclosures not described in this Notice will be made only with your written authorization unless another law permits or requires the use or disclosure.

3. Uses and Disclosures Permitted or Required Without Your Authorization

  • Public health and safety. We may disclose information when permitted or required for public health activities, health oversight, reporting required by law, or to prevent or lessen a serious and imminent threat to health or safety.
    • Duty to protect. Under California law, a psychotherapist may have a duty to protect when a patient communicates a serious threat of physical violence against a reasonably identifiable victim or victims. When the law applies, reasonable protective steps may include notifying the potential victim and law enforcement.
    • Abuse and neglect reporting. Mandated reporters may be required to report known or reasonably suspected child abuse or neglect and certain abuse or neglect of elders or dependent adults.
    • Judicial and administrative proceedings. We may disclose information in response to a court or administrative order or other lawful process when the disclosure is permitted or required by HIPAA and California law. California law provides additional protections for psychotherapy and mental health information, and a subpoena does not automatically authorize every requested disclosure.
    • Law enforcement, health oversight, workers’ compensation, coroners, and other legal requirements. We may disclose information when and to the extent applicable law permits or requires.
    • Research. We may use or disclose health information for research only as permitted by law, such as with your authorization or an approved waiver of authorization.

Substance Use Disorder Records (If Applicable)

If Elyra creates or maintains patient records that are subject to 42 CFR Part 2, additional federal confidentiality protections apply. To the extent we maintain such records, we will not use or disclose them in civil, criminal, administrative, or legislative investigations or proceedings against you unless permitted by Part 2, including with your written consent or with the court order and legal process required by law.

4. Telehealth and Electronic Communication Safeguards

  • Elyra uses administrative, technical, and physical safeguards designed to protect PHI, including secure telehealth and electronic record technologies and encryption where appropriate.
    • When a vendor handles PHI on Elyra’s behalf and HIPAA requires it, Elyra requires appropriate contractual protections, including a Business Associate Agreement.
    • Email, text messaging, internet service interruptions, device loss, and other electronic communications carry some inherent privacy and security risk. You may ask Elyra to use an alternative or more secure communication method when available.
    • Elyra does not intentionally send PHI from secure treatment, intake, telehealth, or EHR systems to third-party advertising trackers. Website analytics and tracking technologies should be configured so that health-related intake information and PHI are not disclosed to advertising platforms.

5. Your Rights Regarding Your Health Information

Inspect and Obtain a Copy

You may ask to inspect or obtain an electronic or paper copy of your medical record and other health information we maintain about you, subject to limited exceptions. Under California Health and Safety Code section 123110, when that law applies, inspection generally must be permitted within five working days after a proper request, and requested copies generally must be transmitted within 15 days. HIPAA also provides an access right and generally requires action within 30 days. Reasonable, cost-based fees may apply where permitted by law. HIPAA does not provide a right of access to psychotherapy notes as specifically defined by HIPAA.

Request an Amendment

You may ask Elyra to amend health information you believe is incorrect or incomplete. We may deny the request in circumstances allowed by law, but we will explain the denial in writing and describe any additional rights you may have.

Request Restrictions

You may ask us not to use or disclose certain PHI for treatment, payment, or health care operations. We are not generally required to agree to every requested restriction. However, if you pay in full out-of-pocket for a service and

ask us not to disclose information about that service to your health plan for payment or health care operations, we will honor the request unless the disclosure is required by law.

Request Confidential or Alternative Communications

You may ask us to contact you in a specific way or at a different location, such as through a secure portal, a particular email address, or a particular phone number. We will accommodate reasonable requests as required by law.

Request an Accounting of Disclosures

You may request an accounting of certain disclosures of your PHI made during the six years before your request. The accounting does not include every disclosure, including many disclosures for treatment, payment, and health care operations. One accounting in a 12-month period is provided without charge; a reasonable cost-based fee may apply to additional requests.

Receive a Paper Copy of This Notice

You may request a paper copy of this Notice at any time, even if you agreed to receive it electronically.

Choose a Personal Representative

A person with legal authority to act for you, such as a properly authorized health care agent or legal guardian, may exercise your privacy rights as permitted by law. Elyra may verify that person’s authority before acting.

Breach Notification

Elyra is required to notify affected individuals when a breach of unsecured PHI requires notice under applicable law. HIPAA requires individual notice without unreasonable delay and, when required, no later than 60 days after discovery of the breach.

6. Your Choices About Certain Disclosures

When the law gives you a choice, you may tell us whether and how to share information with family members, close friends, or others involved in your care or payment for care. If you cannot communicate your preference, we may share information when permitted by law and when we determine the disclosure is in your best interest or is needed to address a serious and imminent threat.

Elyra does not maintain a hospital directory. Elyra does not sell PHI. Most uses or disclosures of psychotherapy notes and uses or disclosures of PHI for marketing require your written authorization.

7. Elyra’s Responsibilities

  • Maintain the privacy and security of your PHI as required by law.
    • Provide you with this Notice and follow the privacy practices described in the current Notice.
    • Use or disclose only the minimum necessary information when the minimum-necessary standard applies.
    • Notify you of breaches when required by law.
    • Honor valid authorizations, restrictions, and confidential communication requests as required by law.
    • Revise this Notice when our privacy practices materially change and make the revised Notice available on our website and upon request.

8. Questions or Complaints

If you have questions about this Notice or believe your privacy rights have been violated, contact:

Privacy Officer, Elyra Healthcare
Email: info@elyrahealthcare.com
Phone: (951) 904-3342
Website: elyrahealthcare.com

You may also file a health information privacy complaint with the U.S. Department of Health and Human Services, Office for Civil Rights (OCR), including through the HHS complaint process, by mail to Centralized Case Management Operations, U.S. Department of Health and Human Services, 200 Independence Avenue, S.W., Room 509F HHH Building, Washington, DC 20201, or by contacting OCR through HHS.

For complaints about a California licensed mental health professional, you may also contact the professional licensing board that regulates the clinician. For example, the California Board of Behavioral Sciences can be reached at (916) 574-7830, and the California Board of Psychology can be reached at (916) 574-7720 or toll-free at (866) 503-3221.

Elyra will not retaliate against you for filing a privacy complaint or exercising a privacy right.

9.  Changes to This Notice

Elyra may change the terms of this Notice and make the revised terms effective for all PHI we maintain, including information created or received before the revision. The current Notice will be available on Elyra’s website and upon request.