This Notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

Your Protected Health Information: Your Protected Health Information (“PHI”) includes anything that identifies you and relates to your health, your care, or payment for that care. This includes your name and contact details, medical history, diagnoses, photographs taken for clinical purposes, treatment records, and conversations between you and Nadir Qazi.

Our Legal Duty: Nadir Qazi is required by law to protect the privacy and security of your PHI. We must follow the practices described in this Notice, notify you promptly if a breach of your unsecured PHI occurs, and abide by the terms of this Notice as currently in effect. We may change our privacy practices in the future, and if we do, we will post an updated Notice on our website and make copies available in our office.

Telehealth Exclusion: PHI from telehealth services conducted through Qazi Cosmetic Center’s California facility is governed by Qazi Cosmetic Center’s separate Notice of Privacy Practices, not this Notice.

How We May Use and Disclose Your PHI: Without Your Written Permission For Your Treatment We may share your PHI to provide, coordinate, or manage your care. This includes sharing information among Nadir Qazi, or sending records to a specialist you are referred to. For Payment, we may use your PHI to obtain payment for the services we provide, including processing your payment, verifying eligibility, and billing or billing disputes. Nadir Qazi does not participate in insurance plans, so payment is primarily your responsibility. If you elect to pay using a third-party financing partner (such as Cherry Financial), limited PHI may be shared with that financing partner so your payment can be processed. For Healthcare Operations, we may use your PHI to run our practice and maintain quality care. This includes quality assurance and operational review, reviewing outcomes, and using properly de-identified data for permitted research. Other Permitted Uses- We may also use or disclose your PHI without your written permission when the law requires it; to public health authorities; to prevent a serious threat to your health or safety or that of another person; to remind you of appointments; with our business associates who perform services for us under strict HIPAA contracts; or with your family, friends, or caregivers who are involved in your care, as you direct or as permitted when you are unable to agree.

Uses and Disclosures That Require Your Written Authorization: Any use or disclosure not described above requires your specific written authorization. This includes disclosures for marketing purposes, other than face-to-face conversations or small promotional gifts permitted by HIPAA. The use of your photographs or videos for marketing or social-media purposes is governed by Nadir Qazi’s separate Photography and Social Media Consent. You may revoke any written authorization in writing at any time, except to the extent we have already acted on it. We do not sell your PHI.

Sale or Transfer of the Practice If Nadir Qazi is sold, merged, reorganized, or otherwise transferred, your PHI may be transferred to the successor entity as part of that transaction, consistent with HIPAA (45 CFR § 164.501). The successor entity will be bound by the terms of the then-current Notice of Privacy Practices with respect to your PHI.

Your Rights Right to Access: You may ask to see and obtain a copy of your PHI. We will respond within 30 days. Reasonable copying fees may apply. Right to Amend You may request corrections to your PHI if you believe something is wrong or incomplete. We will respond within 60 days. Right to Restrictions You may request limits on how we use or disclose your PHI for treatment, payment, or healthcare operations. We are not required to agree, but if we do, we will honor that restriction. If you pay for a service out of pocket in full, you may also request that we not disclose information about that service to your health plan, and we will honor that request unless the law requires us to disclose it.

Right to Confidential Communications: You may ask us to contact you at a specific address or phone number. Right to an Accounting You may request a list of certain disclosures we made of your PHI in the past six years.

Right to Breach Notification: You have the right to be notified without unreasonable delay if your unsecured PHI is breached. Right to a Paper Copy You may obtain a paper copy of this Notice even if you agreed to receive it electronically. Right to Receive ePHI in Electronic Format You have the right to receive a copy of your electronic protected health information (ePHI) in the electronic format and manner you request, if it is readily producible in that format, or in another agreed-upon format, in accordance with 45 CFR § 164.524.

Complaints: If you believe your privacy rights have been violated, you may file a complaint with Nadir Qazi or with the U.S. Department of Health and Human Services. We will not retaliate against you for filing a complaint.

Privacy Officer

Nadir Qazi

20271 SW Birch Street, STE 100, Newport Beach, CA 92660

Phone: 949-336-7293

Email: contact@nadirqazi.com

U.S. Department of Health and Human Services Office for Civil Rights Online: https://ocrportal.hhs.gov Mail: 200 Independence Avenue, S.W., Washington, D.C. 20201 Phone: 1-800-368-1019

Changes to This Notice: We may change the terms of this Notice at any time. The revised Notice will apply to all PHI we maintain, regardless of when it was created. If we make material changes, we will post the updated Notice in our office and on our website, and paper copies will be made available on request.

This Notice is effective as of May 2026.