Notice of Privacy Practices

Effective date: October 9, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

This notice applies to Vivian Chin, MD, PLLC, doing business as Koru Wellness Aesthetics, and the patient health information maintained by the practice. Our privacy contact is Dr. Vivian Chin, MD, MPH. To ask a privacy question, make a request, or file a complaint, contact hello@korunyc.com, call 212-396-3672, or write to 341 East 78th Street, Ground Floor, New York, NY 10075.

Your Rights

See or Receive Your Records

You can request access to your medical and billing records and request electronic or paper copies. We may verify your identity and ask for a written request. Under New York's access rules, we will provide an opportunity to inspect records within 10 days of a qualifying written request. Copies are provided within a reasonable time and within applicable HIPAA deadlines, generally no later than 30 days, subject to any legally permitted extension. We will not use the outer deadline to delay a request that can be fulfilled sooner.

Any charge must be permitted by law and may not include prohibited search or retrieval fees. We will explain any applicable fee in advance. Applicable rights to free copies and access despite inability to pay remain intact. If access is denied, we will explain the reason and any applicable review or appeal right.

Request a Correction

You can ask us to amend information you believe is incorrect or incomplete and explain the reason. We may deny a request for a reason allowed by law, but will respond in writing, generally within 60 days, and explain how you can submit a statement of disagreement. An amendment does not require deleting the original medical record.

Request Confidential Communications

You can ask us to contact you in a particular way or at a different address. We will accommodate reasonable requests. Contact the practice rather than entering sensitive information in a general website message.

Ask Us to Limit Use or Sharing

You can ask us not to use or disclose information for treatment, payment, or health care operations. We do not have to agree to every requested restriction. If you pay for a health care item or service out of pocket in full and ask us not to disclose the related information to your health plan for payment or operations, we will agree unless disclosure is required by law.

Ask for an Accounting of Disclosures

You can request a list of certain disclosures during the six years before your request. The list does not include every disclosure, such as most disclosures for treatment, payment, operations, or those you authorized. One accounting in a 12-month period is free; a permitted cost-based charge may apply to an additional request, with advance notice.

Receive This Notice or Choose a Representative

You can request a paper copy promptly, even if you previously accepted electronic delivery. A person legally authorized to act for you may exercise applicable rights. We verify that person's authority and respect legal exceptions, including protections that may apply to a minor's confidential care.

Make a Complaint

You can complain to Dr. Chin using the practice contact details above or to the U.S. Department of Health and Human Services Office for Civil Rights. Visit HHS privacy complaints, call 1-877-696-6775, or write to 200 Independence Avenue, S.W., Washington, D.C. 20201. We will not retaliate against you for making a complaint.

Your Choices

Tell us your preferences about sharing relevant information with family, friends, or others involved in your care or payment, and in disaster relief situations. If you cannot express a choice, we may use professional judgment to share information in your best interests when the law permits. Paying for another person's treatment does not create unrestricted access to that person's medical record.

We obtain written authorization where required for marketing, sale of protected health information, and most disclosures of psychotherapy notes. Clinical photographs or testimonials are not made available for unrestricted marketing use by signing an ordinary payment form or viewing our website. You may revoke an authorization in writing, except to the extent we have already relied on it or another legal exception applies.

If we contact you for a permitted fundraising activity, you may opt out of further fundraising contacts. If fundraising would use substance use disorder records protected by 42 CFR part 2, we will provide the required clear advance notice and choice. These provisions describe legal safeguards; they do not state that Koru currently operates a fundraising program.

Our Uses and Disclosures

Treatment, Practice Operations, and Payment

Treatment: We may use and disclose information as permitted by law to provide and coordinate your care. For example, Dr. Chin may share relevant information with another clinician who is treating you or use your record to plan follow-up care.

Practice operations: We may use and disclose information to manage the practice, review quality and safety, and contact you about care or appointments. For example, we may review treatment records to evaluate and improve the care we provide.

Payment: We may use and disclose information to bill for services and obtain payment. For example, we may provide appropriately limited billing information to process payment for your visit. This does not override a legally required restriction you have requested for a service paid out of pocket in full.

Service providers that handle protected health information for the practice must have appropriate safeguards and any legally required business associate agreement. We limit uses and disclosures as required by law, including applicable minimum-necessary requirements.

Other Permitted or Required Disclosures

Legal conditions must be satisfied before we make other permitted or required disclosures. Depending on the circumstances, these may include public-health reporting; product recalls and adverse reactions; suspected abuse, neglect, or domestic violence; health-oversight activities; workers' compensation; certain law-enforcement requests; military, national-security, or other special government functions; organ or tissue donation; coroners, medical examiners, or funeral directors; and research with the required permissions or safeguards. We may also share information to reduce a serious and imminent threat where the law permits.

We share information when applicable law requires it, including with the U.S. Department of Health and Human Services to review our compliance with privacy law. A subpoena or request is not an automatic entitlement to every record: court orders, subpoenas, and other legal demands are assessed under the applicable privacy and procedural rules before disclosure.

Information With Additional Protections

If we hold substance use disorder patient records protected by 42 CFR part 2, we will not use or disclose those records, or testimony describing them, in civil, criminal, administrative, or legislative investigations or proceedings against you without your written consent or a legally sufficient court order after the required notice and opportunity to be heard. A court order authorizing disclosure must be accompanied by a subpoena or other legal requirement compelling disclosure. These safeguards apply to every disclosure described in this notice. Not every mention of substance use in an ordinary medical history is a Part 2 program record.

New York law can provide additional protections for confidential HIV-related information, certain mental-health records, genetic-test records, and some care received by minors. Where those protections apply, we follow the more protective rule and obtain any required specific permission or legal authority before disclosure. We do not assume that a general treatment or payment consent overrides those requirements.

Our Responsibilities

We are required to maintain the privacy and security of protected health information, provide this notice, and follow the notice currently in effect. We will notify affected individuals as required if a breach of unsecured protected health information occurs. Other uses or disclosures not described in this notice will be made only with your written authorization. You may revoke an authorization in writing, except to the extent we have already relied on it or another legal exception applies.

Changes and Copies

We may update this notice as permitted by law, with revised terms applying to information we already maintain as well as new information. The updated notice will state its effective date and be available in the practice, on our website, and on request.