Notice of Privacy Practices

Dr. Siu's, P.C., dba Forte Health Medical Clinic, Inc.

Effective date: Nov 1, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Our commitment

Forte Health Medical Clinic, Inc. is a direct primary care practice. We do not bill insurance, and your health information stays between you and your physician except as described in this notice.

We are required by law to:

• Keep your health information private and secure.

• Give you this notice of our legal duties and privacy practices.

• Follow the terms of the notice currently in effect.

• Notify you if a breach affects your unsecured health information.

When California law gives you more protection than federal law, we follow California law.

• Privacy Officer: Jonathan Siu, DO

• Email: privacy@fortehealthdpc.com

• Phone: 909-833-6783

• Mail: 112 Harvard Ave #628, Claremont, CA 91711

How we may use and share your health information

We may use and share your information without your written authorization in these situations, and only as much as needed.

• Treatment. To provide and coordinate your care, for example sending orders to a lab or imaging center, sending prescriptions to your pharmacy, or sharing records with a specialist we refer you to.

• Payment. To process your membership fees and charges for non-covered services through our payment processor. We do not bill insurance for our own services. We may share information with your health plan when needed to request prior authorization for medications, tests, imaging, or referrals so those items can be covered.

• Health care operations. To run the practice, for example reviewing the quality of care, maintaining records, and working with vendors.

• Service providers. Our electronic health record and messaging platform, payment processor, labs, and similar vendors handle information on our behalf. They must agree in writing to protect it.

• Appointment reminders and care updates. By text, email, phone, or secure messaging, using the contact methods you choose.

• Family and caregivers. With people involved in your care or payment, if you agree or do not object, or if you cannot respond and we believe sharing is in your best interest.

• Public health and safety. Reporting certain diseases, adverse drug reactions, suspected abuse or neglect, and preventing a serious threat to health or safety.

• Required by law. When federal or California law requires it, including health oversight agencies such as the Osteopathic Medical Board of California.

• Legal proceedings and law enforcement. In response to a valid court order, subpoena, or other lawful process, within the limits of California law.

• Workers' compensation. As allowed by workers' compensation laws.

• Coroners, organ donation, research, and special government functions. Only as specifically permitted by law.

If your employer pays for your membership, we tell your employer only whether you are enrolled and billing information. We do not share your health information with your employer without your written authorization.

When we need your written authorization

For any use or disclosure not described above, we will ask for your signed written authorization first. This includes:

• Sending records or completed forms to third parties you request, such as employers, schools, insurers, attorneys, or care facilities.

• Marketing communications paid for by a third party.

• Selling your health information. We do not sell health information.

• Psychotherapy notes, if any exist.

• HIV test results, genetic test results, and certain mental health and substance use records, unless the law permits disclosure without authorization.

You may revoke an authorization in writing at any time. Revocation does not undo disclosures we already made in reliance on it.

We do not use your information for fundraising.

Your rights

To use any of these rights, contact our Privacy Officer in writing. We may charge a reasonable, cost-based fee for copies as the law allows.

• See and get copies of your records. In paper or electronic form. Under California law, we let you inspect your records within 5 working days and provide copies within 15 days of your written request.

• Ask us to correct your records. If you believe information is wrong or incomplete. If we say no, we will explain why in writing, and you may add a written statement of up to 250 words to your record.

• Request confidential communications. For example, contact only at a certain phone number or address. We will agree to reasonable requests.

• Ask us to limit what we use or share. We are not required to agree, except one case: if you paid in full out of pocket for a service, you can ask us not to share it with your health plan, and we will agree unless the law requires sharing.

• Get a list of disclosures. A list of times we shared your information in the past 6 years, other than for treatment, payment, operations, and disclosures you authorized. One free list per year.

• Get a copy of this notice. On paper or electronically, at any time.

• Choose someone to act for you. A legal guardian or someone with medical power of attorney may use these rights for you.

California privacy protections

The California Confidentiality of Medical Information Act (CMIA) and other state laws give you added protections.

• Stricter limits on sharing. We share your medical information without authorization only when California law allows it.

• Valid authorizations. Any authorization we ask you to sign will state what is shared, with whom, for what purpose, and when it expires.

• Sensitive services. California law adds limits on sharing information about sensitive services, including reproductive and gender-affirming care, even in response to out-of-state legal requests.

• Minors. Minors may consent on their own to certain services under California law. For those services, we keep the minor's information confidential and do not share it with a parent or guardian without the minor's permission, unless the law requires it. Parents and guardians otherwise generally have access to their child's records.

• Employers. California law limits what we may share with your employer without your authorization.

Communication, breaches, changes, and complaints

Electronic communication. Secure messaging in our patient app is the safest way to share health information. Regular text and email may not be encrypted. If you choose to send health information by text or email, we may reply the same way. You can change your communication preferences at any time.

Breach notification. If a breach affects your unsecured health information, we will notify you as required by federal and California law.

Changes to this notice. We may change this notice, and the change will apply to all information we hold. The current notice will be posted on our website and available on request. If we make a material change, we will notify current patients.

Complaints. If you believe your privacy rights were violated, you may file a complaint with us or with:

• U.S. Department of Health and Human Services, Office for Civil Rights: 200 Independence Avenue SW, Washington, DC 20201; 1-877-696-6775; www.hhs.gov/ocr/complaints

• Osteopathic Medical Board of California: www.ombc.ca.gov

We will not retaliate against you for filing a complaint.