HIPAA Notice of Privacy Practices

Spectrum Solutions Rx, LLC d/b/a Genesis Compounding Pharmacy
12278 S Lone Peak Parkway, Suite 106, Draper, UT 84020
Phone: 888-500-4711 | Direct: 385-279-4420 | Fax: 385-855-1221
Email: pharmacy@genesiscompounding.com
Website: www.genesiscompounding.com

1. Our Commitment to Your Privacy

Spectrum Solutions Rx, LLC, doing business as Genesis Compounding Pharmacy ("Genesis," "we," "us," or "our"), is a PCAB-accredited 503A compounding pharmacy licensed in all 50 states. We are a covered entity under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (collectively, "HIPAA"), and we are required by law to:

• Maintain the privacy and security of your Protected Health Information ("PHI"), including reproductive health care information and any substance use disorder information protected under 42 CFR Part 2;
• Provide you with this Notice of Privacy Practices describing our legal duties and privacy practices regarding your PHI;
• Notify you in the event of a breach of your unsecured PHI;
• Follow the terms of the Notice currently in effect; and
• Abide by any state law that is more protective of your PHI than federal law.

PHI is any information — written, spoken, or electronic — that identifies you and relates to your past, present, or future physical or mental health, the health care you have received, or the payment for that care.

2. How We May Use and Disclose Your PHI Without Your Authorization

We may use and disclose your PHI without your written authorization for the following purposes:

2.1 Treatment

To dispense your prescription, compound your medications, communicate with your prescriber and other members of your care team, provide pharmacist counseling, and coordinate your care. Example: a pharmacist contacting your prescriber to clarify a dosage or recommend a formulation.

2.2 Payment

To bill and collect payment for the medications and services we provide. Example: processing your credit card, debit card, or HSA/FSA payment, or, where applicable, submitting a claim to a third-party payer.

2.3 Healthcare Operations

To run our pharmacy, including quality assurance, sterility and potency testing, batch record review, USP <795>/<797>/<800> compliance, peer review, staff training, licensing and accreditation activities (including PCAB), audits, business planning, and customer service.

2.4 Mail-Order and Patient Communications

As a mail-order pharmacy, we ship medications to the address you provide using third-party carriers. Packaging may include the minimum information needed for safe, accurate delivery. We take reasonable steps to limit PHI on the outside of packages.

We may contact you by phone (including voicemail), SMS/text, email, or secure messaging about your prescriptions, refills, shipping, payment, recalls, and pharmacist counseling. You may request alternative communication methods at any time (see Section 5).

2.5 Business Associates

We may share your PHI with vendors who perform services on our behalf — such as our pharmacy management system, eRx and EMR integrations, payment processors, shipping carriers, third-party testing laboratories, IT and security providers, and document destruction services. Each is bound by a written Business Associate Agreement requiring them to safeguard your PHI consistent with HIPAA.

2.6 Individuals Involved in Your Care

With your verbal agreement, or in your best interest if you are unable to agree (e.g., emergency or incapacity), we may share PHI relevant to a person's involvement with someone helping with your care or payment, such as a family member, caregiver, or personal representative.

2.7 Required by Law and Public Interest Activities

We may use or disclose your PHI without your authorization when permitted or required by law, including for:

• Public health activities (disease reporting, FDA-required adverse event and product quality reports, recalls);
• Health oversight activities (audits, investigations, and inspections by FDA, DEA, Utah DOPL, state boards of pharmacy, and HHS);
• Judicial and administrative proceedings (court orders, subpoenas with required safeguards);
• Law enforcement purposes as permitted by HIPAA;
• Coroners, medical examiners, and funeral directors;
• Organ, eye, or tissue donation purposes;
• Research, subject to required privacy protections or your authorization;
• To avert a serious threat to health or safety;
• Specialized government functions (e.g., military, national security);
• Workers' compensation as authorized by and to the extent necessary to comply with law.

2.8 De-identified Information

We may use and disclose information that has been de-identified in accordance with HIPAA standards. De-identified information is no longer PHI.

3. Uses and Disclosures That Require Your Written Authorization

We will obtain your written authorization before using or disclosing your PHI for any purpose not described in this Notice. In particular, we will obtain your written authorization for:

• Marketing communications, except for face-to-face communications, gifts of nominal value, or communications about a drug or treatment you are currently using;
• Sale of your PHI;
• Most uses and disclosures of psychotherapy notes (where applicable);
• Substance use disorder treatment records protected by 42 CFR Part 2, except as permitted by law for medical emergencies, research, audits, or evaluations.

You may revoke an authorization in writing at any time. A revocation will not apply to information we already used or disclosed in reliance on the authorization.

4. Special Protections for Sensitive Information

• Reproductive health care information is protected under HIPAA, and we will not disclose it for prohibited purposes (such as conducting a criminal, civil, or administrative investigation into, or imposing liability on, a person for the mere act of seeking, obtaining, providing, or facilitating lawful reproductive health care).
• Substance use disorder ("SUD") information is protected under 42 CFR Part 2. Part 2 information disclosed with your consent may not be re-disclosed unless permitted by further written consent or by law.
• HIV/AIDS, genetic, and mental health information may be subject to additional state-law protections, which we will follow when they are more protective than HIPAA.

5. Your Rights Regarding Your PHI

You have the following rights with respect to your PHI:

5.1 Right to Access and Receive a Copy

You have the right to inspect and obtain a copy of your PHI we maintain, including in electronic form when readily producible. Submit your request in writing to our Privacy Officer (see Section 9). We will respond within 30 days (with one 30-day extension if necessary), unless a more restrictive state statute applies. We may charge a reasonable, cost-based fee permitted by law.

5.2 Right to Request Amendment

If you believe your PHI is inaccurate or incomplete, you may request that we amend it. Requests must be in writing and include the reason for the amendment. We may deny a request in limited circumstances; if we do, you may submit a written statement of disagreement.

5.3 Right to an Accounting of Disclosures

You have the right to request an accounting of certain disclosures of your PHI made by us in the six (6) years prior to the date of your request. Certain disclosures (e.g., for treatment, payment, healthcare operations, and disclosures made pursuant to your authorization) are excluded. The first accounting in any 12-month period is free; reasonable, cost-based fees may apply to additional requests.

5.4 Right to Request Restrictions

You may request that we restrict how we use or disclose your PHI for treatment, payment, or healthcare operations, or to persons involved in your care. We are not required to agree, except that we must agree to restrict disclosure to your health plan for a service you paid for in full out of pocket, where the disclosure is not otherwise required by law.

5.5 Right to Confidential Communications

You may request that we communicate with you about your PHI by alternative means or at alternative locations (e.g., a different phone number, address, or email). We will accommodate reasonable requests.

5.6 Right to a Paper Copy of This Notice

You may request a paper copy of this Notice at any time, even if you have agreed to receive it electronically.

5.7 Right to Be Notified of a Breach

We will notify you if a breach of your unsecured PHI occurs, as required by HIPAA.

5.8 Right to File a Complaint

You may file a complaint with our Privacy Officer or directly with the Secretary of the U.S. Department of Health and Human Services, Office for Civil Rights. We will not retaliate against you for filing a complaint.

To file with HHS:

• Online: hhs.gov/hipaa/filing-a-complaint
• Mail: U.S. Department of Health and Human Services, 200 Independence Avenue SW, Room 509F HHH Building, Washington, D.C. 20201
• Phone: 1-877-696-6775

6. Mail-Order and Shipping Privacy Practices

Because we ship nationwide, please note:

• We may use third-party carriers (e.g., UPS, FedEx, USPS) and provide the minimum information necessary for delivery (your name, address, and tracking information).
• We take reasonable steps to limit PHI visible on the outside of packaging.
• If the integrity of your package was compromised during shipping, or if your medication requires specific storage conditions (e.g., refrigeration) that were not met during shipment, please contact our pharmacy immediately at 385-279-4420. Do not use the medication.
• Written information about your prescription(s), including package inserts and this Notice, is provided with your shipment. A pharmacist is available during normal business hours to answer questions.

7. Electronic Communications and the Genesis Website

If you communicate with us through www.genesiscompounding.com (e.g., contact forms, secure messaging, live chat) or by email, we use administrative, technical, and physical safeguards designed to protect your PHI. However, standard email and SMS are not fully secure, and you should not send sensitive PHI through unsecured channels. Use our secure messaging or call 888-500-4711 for sensitive communications.

Our Site may use cookies and analytics tools that collect non-PHI usage data (such as pages visited and device type). Marketing communications you receive from us are governed by your communication preferences and applicable law, and you may unsubscribe from non-essential marketing at any time.

8. Changes to This Notice

We reserve the right to change this Notice at any time, and to make the revised Notice effective for PHI we already have about you as well as any information we receive in the future. The current Notice will be posted at www.genesiscompounding.com with its effective date, and copies will be available at our pharmacy and on request.

9. Contact Information — Privacy Officer

Katie Sawyer
Vice President of Quality Assurance & Regulatory
Spectrum Solutions Rx, LLC
12278 S Lone Peak Parkway, Suite 106, Draper, UT 84020
Phone: 888-500-4711 | Direct: 385-279-4420
Email: ksawyer@nuviacm.com

For prescription questions, please call our pharmacy:
Phone: 888-500-4711 | Direct: 385-279-4420
Hours: Monday–Friday 7:00 AM – 3:30 PM MST; Saturday 8:00 AM – 12:00 PM MST

10. Acknowledgment

By using our pharmacy services, you acknowledge that this Notice of Privacy Practices has been made available to you. If you would like a signed acknowledgment, please contact our Privacy Officer.