NOTICE OF PRIVACY PRACTICES

Effective Date: August 8, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

1. Our Commitment to Your Privacy

Prosper & Bloom Mental Health, Inc. (“Prosper & Bloom,” “we,” “us,” or “our”) is required by law to:

Maintain the privacy and security of your protected health information (“PHI”)
Notify you promptly if a breach occurs that may have compromised the privacy or security of your information
Follow the terms of the Notice currently in effect
Provide you with this Notice of our legal duties and privacy practices

PHI is information that identifies you and relates to your physical or mental health, the care you receive from us, or payment for that care. This Notice applies to all PHI created or maintained by Prosper & Bloom, including information created during in-person visits and telehealth visits, and to all members of our workforce, contractors, and clinicians.

2. How We May Use and Disclose Your Health Information Without Your Authorization

Treatment

We use and disclose your PHI to provide, coordinate, and manage your care. Examples: your prescriber reviews your chart before an appointment; we send a prescription to your pharmacy; we consult with our collaborating physician about your care; we coordinate with your therapist, primary care provider, or another treating

clinician; we check the Louisiana Prescription Monitoring Program before prescribing a controlled substance.

Payment

We use and disclose your PHI to bill and collect payment for services. Examples: we verify your insurance eligibility and benefits; we submit claims containing your diagnosis and services rendered; we obtain prior authorization for a medication; we provide records requested by a health plan to determine coverage or medical necessity.

Health Care Operations

We use and disclose your PHI to run our practice and maintain quality of care. Examples: internal quality review; supervision and training of clinicians and staff; credentialing and licensure; compliance auditing and program-integrity activities; business planning; obtaining legal, accounting, or consulting services; arranging for our billing service, electronic health record, and other vendors.

Business Associates

Some functions are performed for us by outside companies, such as our electronic health record, billing service, e-prescribing platform, secure messaging platform, and clearinghouse. We disclose PHI to them only as needed to perform those functions, and only under a written Business Associate Agreement requiring them to protect your information as we do.

Appointment Reminders and Health-Related Communications

We may contact you to remind you of an appointment, to follow up after a visit, or to tell you about treatment alternatives or other health-related benefits and services that may interest you. We may leave a message on your voicemail or send a reminder by text or email based on the contact preferences you give us.

Individuals Involved in Your Care or Payment

Unless you object, we may share information relevant to a person’s involvement with a family member, friend, or other person you identify as involved in your care or in paying

for your care. In an emergency or when you are not present or able to agree, we will use our professional judgment to disclose only what is directly relevant and in your best interest.

3. Other Uses and Disclosures Permitted or Required by Law

We may use or disclose your PHI without your authorization in the following circumstances, subject to conditions and limits set by federal and Louisiana law:

As required by law, including reporting required by federal, state, or local law
Public health activities, such as preventing or controlling disease, reporting reactions to medications, and reporting births and deaths
Victims of abuse, neglect, or domestic violence, to authorities authorized to receive such reports, including mandatory reporting of suspected abuse or neglect of a child or of an adult who is elderly or disabled
Health oversight activities, such as audits, investigations, inspections, and licensure actions by government agencies and licensing boards
Judicial and administrative proceedings, in response to a court order, subpoena, or discovery request where the required assurances or protective orders are in place
Law enforcement purposes, in the limited circumstances permitted by law
Coroners, medical examiners, and funeral directors, as necessary for them to carry out their duties
Organ and tissue donation, where applicable
Research, where an institutional review board or privacy board has approved a waiver of authorization, or where the information is de-identified or used in preparation for research
To avert a serious and imminent threat to the health or safety of you or another person, to a person reasonably able to prevent or lessen the threat, including as required by Louisiana law regarding a threat of harm
Workers’ compensation, as authorized by workers’ compensation laws
Military, national security, and protective services, in the limited circumstances permitted by law

4. Uses and Disclosures That Require Your Written Authorization

We will obtain your written authorization before we use or disclose your PHI for any purpose not described in this Notice, and specifically before:

Psychotherapy notes. Psychotherapy notes are notes recorded by a mental health professional documenting or analyzing a counseling session that are kept separate from the rest of your record. We will not use or disclose psychotherapy notes without your written authorization, except in narrow circumstances permitted by law (such as our own training use, defending ourselves in a legal action you bring, an oversight investigation of the note’s originator, or to avert a serious and imminent threat to health or safety).
Marketing. We will not use or disclose your PHI for marketing purposes that require authorization without your written authorization.
Sale of PHI. We will never sell your PHI. Any disclosure that would constitute a sale requires your written authorization.
Fundraising. Prosper & Bloom does not use or disclose PHI for fundraising communications. If that ever changes, we will update this Notice, and you will have the right to opt out of receiving fundraising communications, with clear instructions on how to opt out and no effect on your treatment or payment.

You may revoke an authorization at any time, in writing, by contacting our Privacy Officer. Revocation stops future uses and disclosures under that authorization but does not undo anything we already did in reliance on it.

5. Special Protections for Certain Types of Information

Some information in your record is protected more strictly than general PHI. Where federal or Louisiana law provides greater protection, we follow the stricter rule.

Substance Use Disorder Records (42 CFR Part 2)

Some records we receive or maintain may be protected by federal regulations at 42 CFR Part 2, which govern the confidentiality of substance use disorder (“SUD”) treatment records created by federally assisted SUD programs. Because Part 2 records may be sent to us by another provider and may not be separately labeled, we treat this protection as potentially applicable to your record. Where Part 2 applies:

Part 2 materially limits uses and disclosures that HIPAA would otherwise permit. Certain uses and disclosures allowed under the HIPAA Privacy Rule are restricted or prohibited for Part 2 records without your written consent or a court order meeting Part 2’s requirements.
Part 2 records may not be used or disclosed in any civil, criminal, administrative, or legislative proceeding against you, and may not be used to investigate or prosecute you, without your written consent or an authorizing court order that meets Part 2’s requirements.
Once we disclose your information to a recipient, that recipient may in some cases redisclose it, and it may then no longer be protected by the HIPAA Privacy Rule. Part 2 records carry additional redisclosure restrictions, and recipients of Part 2 records are prohibited from redisclosing them except as permitted by Part 2.
If you give a single consent covering treatment, payment, and health care operations, that consent may permit redisclosure for those purposes until you revoke it. You may revoke a Part 2 consent at any time, except to the extent action has already been taken in reliance on it.

Other Specially Protected Information

Louisiana law and other federal law provide additional protections for certain categories of information, which may include HIV/AIDS-related information, genetic information, and certain mental health records. We will not disclose these categories except as specifically permitted by the applicable law or with your written authorization.

Minors

For patients under 18, a parent or legal guardian is generally the personal representative and may exercise privacy rights on the minor’s behalf. However, where Louisiana law allows a minor to consent to care on their own, or where a court or the parent has agreed that the minor and the clinician have a confidential relationship, the minor may control the information about that care. We will not treat a person as a personal representative where we reasonably believe doing so would endanger the patient.

Coaching Services

Our executive function and academic coaching services are non-clinical. When you receive coaching only, the records of that service may not be protected health information under HIPAA and are governed by your coaching services agreement. When you receive both coaching and clinical care from us, your clinical record is PHI and is protected as described in this Notice.

6. Your Rights Regarding Your Health Information

Right to inspect and receive a copy. You have the right to inspect and obtain a copy of the PHI we maintain about you in a designated record set, including an electronic copy if we hold it electronically. You may also direct us to transmit a copy to a person or entity you name. Submit your request in writing. We will act on it within 30 days and may extend once by 30 days with written notice. We may charge a reasonable, cost-based fee. In limited circumstances we may deny access, and some denials are subject to review by a licensed health care professional. Psychotherapy notes are not part of the designated record set and are not subject to this right.

Right to request an amendment. If you believe information in your record is incorrect or incomplete, you may ask us in writing to amend it, stating the reason. We may deny the request if we did not create the information, if it is not part of the designated record set, if it is not available for inspection, or if we determine it is accurate and complete. If we deny it, you may submit a written statement of disagreement to be included with your record.

Right to an accounting of disclosures. You have the right to request a list of certain disclosures we made of your PHI in the six years before your request. This does not include disclosures for treatment, payment, or health care operations, disclosures made to you or with your authorization, and certain other categories. The first accounting in any 12-month period is free; we may charge a reasonable fee for additional requests, and will tell you the cost in advance.

Right to request restrictions. You may ask us to limit how we use or disclose your PHI for treatment, payment, or health care operations, or to limit what we share with a person involved in your care. We are not required to agree to most requested restrictions, but if we agree, we will honor the restriction except in an emergency.

Right to restrict disclosure to a health plan. We must agree to your request not to disclose PHI to your health plan for payment or health care operations if the disclosure is for a service you paid for in full, out of pocket, and the disclosure is not otherwise required by law.

Right to request confidential communications. You may ask us to communicate with you in a certain way or at a certain location — for example, by a specific phone number, by mail only, or without voicemail. We will accommodate reasonable requests, and we will not require you to explain why.

Right to a paper copy of this Notice. You may request a paper copy at any time, even if you agreed to receive it electronically. A current copy is posted at prosper-bloom.com.

Right to be notified of a breach. You have the right to be notified if a breach occurs that may have compromised the privacy or security of your PHI.

Right to choose someone to act for you. If you have given someone a valid medical power of attorney, or if someone is your legal guardian, that person can exercise your rights and make choices about your PHI. We will verify authority before taking action.

To exercise any of these rights, contact our Privacy Officer using the information in Section 9. Most requests must be in writing, and we will provide the necessary forms.

7. Your Choices

For the following, you have both the right and choice to tell us to:

Share information with your family, close friends, or others involved in your care or in payment for your care
Include your information in a health information exchange or directory
Contact you for fundraising (we do not currently do this)

If you are not able to tell us your preference — for example, if you are unconscious — we may go ahead and share information when we believe it is in your best interest or necessary to lessen a serious and imminent threat to health or safety.

We will never share your information for marketing purposes or sell your information without your written permission, and we will never share psychotherapy notes without your written permission except as narrowly allowed by law.

8. Complaints

If you believe your privacy rights have been violated, you may file a complaint with us, with the U.S. Department of Health and Human Services, or both. You will not be retaliated against, penalized, or denied services for filing a complaint.

With us: Privacy Officer, c/o Practice Administrator Prosper & Bloom Mental Health, Inc. 9800 Airline Hwy, Ste 219, Baton Rouge, LA 70816 Email: contact@prosper-bloom.com | Phone: 225-605-3103

With the federal government: U.S. Department of Health and Human Services Office for Civil Rights 200 Independence Avenue SW, Room 509F, HHH Building Washington, D.C. 20201 Phone: 1-800-368-1019 | TDD: 1-800-537-7697 Online: ocrportal.hhs.gov/ocr/portal/lobby.jsf

9. Contact for Privacy Questions and Requests

Privacy Officer, c/o Practice Administrator Prosper & Bloom Mental Health, Inc. 9800 Airline Hwy, Ste 219 Baton Rouge, LA 70816 Email: contact@prosper-bloom.com Phone: 225-605-3103

10. Changes to This Notice

We reserve the right to change this Notice and to make the revised Notice effective for PHI we already have as well as information we receive in the future. The current Notice will always be posted at prosper-bloom.com, displayed in our office, and available on request. The effective date appears at the top of the first page.