Notice of Privacy Practices

Effective date: September 28, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Questions or concerns? Contact our Privacy Officer, Kathryn Hall, MD, DipABLM, at (610) 365-4727, by mail at 107 Chesley Drive, Suite 5C, Media, PA 19063, or through the Ardea patient portal.

Your Rights

You have the right to:

• Get a copy of your medical record. Ask to see or receive an electronic or paper copy of your records. We will respond, usually within 30 days, and may charge a reasonable, cost-based fee. Much of your information is also available in the patient portal.
• Ask us to correct your record if you believe it is incorrect or incomplete. If we say "no," we will tell you why in writing within 60 days.
• Request confidential communications, such as contacting you at a specific phone number or address. We will say "yes" to all reasonable requests.
• Ask us to limit what we use or share. We are not required to agree, but if we do, we may still share information in an emergency. If you pay for a service in full out-of-pocket, you may ask us not to share that information with your health insurer, and we will agree unless the law requires otherwise.
• Get a list of disclosures we have made in the past six years, other than those for treatment, payment, operations, and certain others. One list per year is free.
• Get a paper copy of this notice at any time.
• Choose someone to act for you, such as a person with your medical power of attorney or your legal guardian.
• File a complaint with our Privacy Officer or with the U.S. Department of Health and Human Services Office for Civil Rights (200 Independence Avenue, S.W., Washington, D.C. 20201; 1-877-696-6775; www.hhs.gov/hipaa/filing-a-complaint). We will not retaliate against you for filing a complaint.

Your Choices

You may tell us whether to share information with family, friends, or others involved in your care or payment (you may tell us your preferences when you enroll or at any time), or in a disaster relief situation. If you cannot tell us your preference, for example if you are unconscious, we may share information if we believe it is in your best interest or to lessen a serious and imminent threat to health or safety. We will never use your information for marketing, sell your information, or share most psychotherapy notes without your written permission. Ardea does not sell health information or use it for fundraising.

How We Use and Share Your Information

Treatment: with other professionals caring for you, for example sharing lab results with a specialist.

Operations: to run our practice, improve your care, and contact you, for example appointment reminders.

Payment: to collect membership fees through our secure billing system; Ardea does not bill health insurance.

Service providers: companies that help us provide care, such as our electronic health record and patient portal, laboratories, telehealth platforms, and documentation tools, must protect your information by law and by written agreement.

We may also share information when permitted or required by law, including for public health and safety (such as preventing disease, reporting adverse drug reactions, or reporting suspected abuse, neglect, or domestic violence); research; compliance with state or federal law, including reviews by the Department of Health and Human Services; organ and tissue donation; medical examiners and funeral directors; workers' compensation, law enforcement, health oversight, and special government functions; and court orders, administrative orders, or subpoenas.

If we have substance use disorder records about you that are subject to 42 CFR part 2, we will not use or share them in civil, criminal, administrative, or legislative investigations or proceedings against you without your written consent or a court order and a subpoena.

Pennsylvania and Delaware law provide added protection for HIV-related information, mental health treatment records, and drug and alcohol treatment records. We will not share this information without your written consent unless it is for treatment or the law otherwise permits or requires it.

Our Responsibilities

We are required by law to protect the privacy and security of your health information, to notify you promptly of any breach that may have compromised it, and to follow this notice. We will not use or share your information in any other way unless you give us written permission, which you may revoke in writing at any time. We may change this notice, and changes will apply to all information we have about you. The current notice is available upon request, in our office, on our website, and in the patient portal.

Effective date of this notice: September 28, 2026