Notice of Privacy Practices

About this Notice

Effective date: June 26, 2026.

NU Health Medical Wellness is a “covered entity” under the federal Health Insurance Portability and Accountability Act of 1996 and the regulations issued under it (collectively, “HIPAA”). HIPAA requires us to protect the privacy of Protected Health Information (PHI), provide you this Notice describing our legal duties and privacy practices with respect to PHI, and abide by the terms of the Notice currently in effect.

This Notice covers PHI created or received in the course of your care at NuHealth, including telehealth and in-person services. It is distinct from the website Privacy Policy, which covers general information collected through nuhealthwellness.co before a clinical relationship exists.

Who we are

NU Health Medical Wellness is a Michigan-based telehealth and in-person medical wellness clinic providing weight loss, hormone optimization, sexual health, performance, hair & skin, and IV hydration services. Telehealth is provided in Michigan, Florida, Alabama, and Mississippi. In-person services are provided at our Royal Oak, MI clinic.

For purposes of this Notice, NuHealth includes our providers, employees, workforce members, and contractors who participate in your care.

Uses & disclosures for treatment, payment, and health care operations

We may use and disclose your PHI without your written authorization for the following routine healthcare purposes:

Treatment

We use your PHI to provide medical care, including consultations with our providers, ordering and reviewing labs, prescribing medications, coordinating with the 503A compounding pharmacy that prepares prescriptions you may receive, scheduling follow-ups, and communicating with you about your care.

Payment

We may use your PHI to bill and collect payment for the services we provide. For example, we may share PHI with a payment processor to charge a card on file, with CareCredit (a third-party financing provider) only if you choose to apply, or with our accounting team for normal billing operations.

Health care operations

We may use your PHI to operate the clinic, including quality improvement, training, licensing, accreditation, legal services, and business management activities. This may include de-identified analyses to improve our programs.

Other permitted uses & disclosures (no authorization required)

HIPAA permits or requires us to use and disclose PHI without your authorization for a number of purposes, including:

• As required by law— for example, in response to court orders, subpoenas, or regulatory inquiries we are legally required to answer.
• Public health activities— reports to public health authorities to prevent or control disease, injury, or disability; reports of suspected abuse, neglect, or domestic violence; reporting of certain communicable conditions where required.
• Health oversight— audits, investigations, licensure, and inspections by government regulators.
• Workers’ compensation— as authorized by, and to the extent necessary to comply with, workers’ compensation laws.
• Law enforcement— in response to a court order, subpoena, warrant, or similar legal process; to identify a suspect, fugitive, witness, or missing person; or in other limited circumstances permitted by law.
• To avert a serious threat— to prevent or lessen a serious threat to your health or safety or that of another person or the public.
• Coroners, medical examiners, funeral directors— for identification or other duties required by law.
• Organ & tissue donation— to organizations that handle donation, procurement, or transplantation.
• Research— only with approval by an Institutional Review Board (IRB) and subject to HIPAA’s research protections.
• Military & veterans, national security, inmates— in the specific circumstances HIPAA defines.
• Business associates— vendors who perform functions on our behalf (e.g., electronic health records, secure messaging, billing) are bound by HIPAA Business Associate Agreements that limit how they may use your PHI.

Uses & disclosures that require your written authorization

We will obtain your written authorization (which you may revoke at any time, in writing) before using or disclosing your PHI for:

• Marketing communications beyond communications about your own treatment or services we provide.
• The sale of PHI. We do not sell PHI.
• Most uses of psychotherapy notes (if any are ever created).
• Any other purpose not described elsewhere in this Notice.

If you authorize us to disclose PHI, you may revoke that authorization in writing at any time. Revocation will not apply to disclosures already made in reliance on it.

Your rights regarding your PHI

Right to access and copy

You have the right to inspect and obtain a copy of your PHI in the designated record set we maintain, in the form and format you request (including electronic copies) if readily producible. We may charge a reasonable, cost-based fee. We will respond within 30 days of receiving your written request.

Right to request an amendment

If you believe PHI we hold about you is incorrect or incomplete, you may request an amendment. Submit your request in writing and include the reason. We may deny your request in limited circumstances permitted by HIPAA; if we do, we will explain why and you may submit a statement of disagreement.

Right to an accounting of disclosures

You have the right to request an accounting of disclosures of your PHI we have made for purposes other than treatment, payment, and health care operations during the prior six (6) years. The first accounting in any 12-month period is free; we may charge a reasonable fee for additional requests.

Right to request restrictions

You have the right to request restrictions on certain uses and disclosures for treatment, payment, or operations. We are not required to agree to your request, except that we must agree to a request to restrict disclosure of PHI to a health plan if (a) the disclosure is for payment or operations (not treatment) and (b) the PHI pertains to a health-care item or service for which you paid out of pocket in full.

Right to confidential communications

You have the right to request that we communicate with you about your PHI by alternative means or at alternative locations (for example, to a specific email address or only via phone). We will accommodate reasonable requests.

Right to a paper copy of this Notice

You are entitled to a paper copy of this Notice on request, even if you have agreed to receive it electronically.

Right to be notified of a breach

You have the right to be notified if there is a breach of your unsecured PHI, as required by the HIPAA Breach Notification Rule.

Right to opt out of certain communications

You may opt out of fundraising communications. We do not currently use PHI for fundraising.

Our duties

NuHealth is required by law to:

• Maintain the privacy and security of your PHI.
• Provide you this Notice of our legal duties and privacy practices with respect to PHI.
• Notify you in the event of a breach of unsecured PHI.
• Abide by the terms of the Notice currently in effect.

We reserve the right to change this Notice and to make the new Notice provisions effective for all PHI that we maintain. We will post a current copy of this Notice on this page, and materially revised versions will be made available on request.

How to file a complaint

If you believe your privacy rights under HIPAA have been violated, you may file a complaint with us, with the U.S. Department of Health and Human Services, or both. You will not be retaliated against for filing a complaint.

With NuHealth

Send a written complaint to:

With the federal government

You may file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, by following the instructions at hhs.gov/hipaa/filing-a-complaint, by calling 1-800-368-1019, or by writing to:

Changes to this Notice

We may change this Notice at any time. If we make material changes, we will update the “Last updated” date at the top of the page and post the revised Notice. The new Notice will apply to all PHI we maintain, including PHI created or received before the effective date of the change.

Contact us

For questions about this Notice or our privacy practices, contact our Privacy Officer: