NOTICE OF PRIVACY PRACTICES

Effective Date: April 16, 2026

THIS NOTICE EXPLAINS HOW YOUR MEDICAL INFORMATION MAY BE USED AND SHARED, AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

1. Our Duty to Protect Your Data

We are required by law to protect the privacy of your Protected Health Information (PHI). PHI is any information that identifies you and relates to your past, present, or future physical or mental health. We must follow the rules in this notice. If we change these rules, the new rules will apply to all the information we keep. You can always ask for an updated copy.

2. How We Use and Share Your Information

We will only use and share your health information for the following routine purposes:

  • Treatment: We use your information to provide your psychiatric care. For example, your clinician may share your diagnosis with a primary care doctor you are referred to so they can safely prescribe other medications.

  • Payment: We use your information to bill your insurance and get paid for our services. For example, we may need to share your diagnosis with your health plan to get approval for a specific treatment.

  • Healthcare Operations: We use your information to run our clinic safely and efficiently. This includes staff training, quality checks, and using technology to organize our records.

3. Artificial Intelligence (AI) and Digital Transparency

We use Generative AI tools to improve our practices’ efficiency. Under Arizona law (HB 2311 & HB 4080), you have the right to know exactly how machines interact with your care:

  • Human-in-the-Loop (HITL) Guarantee: We use AI to help synthesize and draft clinical notes. However, a human Nurse Practitioner (NP) must review, modify, and sign every note. AI never makes or is involved in clinical decisions or finalizes your medical record.

  • Administrative Chatbots: If you use our website or text systems for scheduling, you are interacting with an AI program, not a human. These bots are strictly for logistics and cannot provide medical advice or crisis help.

  • Protections for Minors: If a patient is under 18, all of our automated systems will display a persistent message stating, "You are talking to an AI."

  • No Public Training: We have a strict legal agreement (Business Associate Agreement) with our AI providers. Your private health data is never used to train public AI models.

4. Digital Safety & Anti-Fraud (The AZBN 2026 Protocol)

Because AI can be used by bad actors to impersonate medical staff, we enforce a strict Digital Defense Policy:

  • The "Call-Back Rule": DCP staff will never call you and demand immediate payment via Zelle, Venmo, Cryptocurrency, or Gift Cards. If you receive a high-pressure call demanding payment, hang up and call our main office at (602) 492-2121.

  • Safe Word Verification: You have the right to set up a private "Safe Word" in your file. Our staff will use this word to prove our identity to you when we call to discuss sensitive medical or financial information.

5. Special Privacy Protections

Some health information has extra legal protection:

  • Substance Use Disorders (42 CFR Part 2): If your records include treatment for substance use, they cannot be used against you in civil, criminal, administrative, or legislative proceedings without your specific written consent or a court order. You may provide a single, one-time consent for us to share this data for standard treatment, payment, and operations.

  • Reproductive Healthcare: We will never use or share your health information for the purpose of investigating or imposing liability on you for seeking lawful reproductive healthcare.

6. When We Must Share Information Without Your Consent

The law requires us to share your information without your permission in specific situations, including:

  • Emergencies: To prevent a serious and imminent threat to your health, safety, or the safety of the public.

  • Public Health & Safety: To report communicable diseases, child abuse, elder abuse, or to the FDA for product defects.

  • Legal & Government: In response to a valid court order, to health oversight agencies, or for worker's compensation claims.

  • Family & Disaster Relief: We may share basic information with family members involved in your care or for disaster relief, provided you are unable to object and we believe it is in your best interest.

7. Your Privacy Rights

You have the following rights regarding your health information:

  • The Right to Opt-Out of Profiling: You have the right to tell us not to use your data for automated "profiling" (analyzing your data to predict behaviors or business trends).

  • The Right to Inspect and Copy: You can ask to see or get a copy of your medical records. We have 30 days to provide this (or 10 working days if you have been identified as having a Serious Mental Illness). We may charge a small fee for copies. You may also request to see the AI-generated "draft" logs of your notes.

  • The Right to Request Restrictions: You can ask us not to share certain information. We do not have to agree, unless you pay for a service completely out-of-pocket and ask us not to share that specific service with your insurance company.

  • The Right to Confidential Communications: You can ask us to contact you in a specific way (e.g., only call your cell phone, or only mail documents to a PO Box) to protect your safety.

  • The Right to Amend: If you believe your records are incorrect, you can ask your clinician in writing to fix them. If we deny your request, you can add a statement of disagreement to your file.

  • The Right to an Accounting of Disclosures: You can ask for a list of the times we shared your information for reasons other than routine treatment, payment, or operations.

  • The Right to Breach Notification: We will notify you legally and promptly if your unsecured health information is ever compromised in a data breach.

  • The Right to Change Your Mind: If you sign an authorization to share your data, you can revoke (cancel) it at any time in writing.

8. How to File a Complaint

If you believe we have violated your privacy rights, you will not be penalized or retaliated against for speaking up. You can file a written complaint with:

  1. DCP Chief Operations Officer: Email info@desertclover.com or mail to 2601 N 3rd St Ste 205, Phoenix, AZ 85004.

  2. The U.S. Government: You may file a complaint with the U.S. Secretary of Health and Human Services