Notice of Privacy Practices

Effective date: October 18, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Privacy contact: Heather Van Buren, Privacy Contact Riviera Hand Therapy 2512 Bath St, Santa Barbara, CA 93105 (805) 680-6558 | info@rivierahandtherapy.com www.rivierahandtherapy.com

This notice describes the handling of health information in Riviera's occupational therapy and hand therapy services, including mobile visits. It applies to information maintained in paper or electronic form. We use Acuity for patient intake and scheduling. Access is limited to authorized practice personnel according to their responsibilities. This notice is separate from a website cookie or general website privacy policy.

How we use and share information

Treatment. We use health information to evaluate and treat you and coordinate care. For example, we may discuss a postoperative protocol with your surgeon or share a therapy progress report with another treating provider, as permitted by law.

Payment. We use relevant information to prepare invoices, receipts, estimates and payment records. Disclosures to an insurer or another payer occur only when permitted and appropriate to your billing arrangements. This notice does not establish that Riviera accepts or bills a particular insurance plan.

Practice operations. We use information for scheduling, recordkeeping, quality review, staff oversight and other lawful practice activities. Vendors handling health information for us must have the privacy protections and agreements required by law. We limit disclosures where the law requires it.

Contacting you. We may contact you about appointments, care instructions and treatment-related services. Tell us your preferred contact method and any restrictions. Ordinary email or text may carry privacy risks; ask about an alternative before sending sensitive details.

Family and caregivers. We may share information relevant to care or payment with people you identify, consistent with your preferences and the law. If you cannot express a preference, limited sharing may be permitted in your best interest or an emergency. Naming an emergency contact is not permission to release your entire record.

Other disclosures and your choices

When authorized or required by law, information may be disclosed for public health; reporting abuse or neglect; product safety; preventing a serious threat; licensing and health oversight; workers' compensation; qualifying law-enforcement or special government functions; organ donation; and coroners, medical examiners or funeral directors. Research disclosures require applicable legal protections. Court orders, subpoenas and other legal requests are reviewed for the conditions and protections required by law; a request alone does not create unrestricted access.

California and specially protected information. We follow California confidentiality law, including the Confidentiality of Medical Information Act, and apply stronger protections when required. Some mental-health, HIV, genetic, reproductive-health and substance-use information may require additional permission or limits. We do not treat a general treatment consent as permission to release specially protected records.

Substance-use-disorder records. If we receive records protected by 42 CFR Part 2, we will not use or disclose them in civil, criminal, administrative or legislative investigations or proceedings against you without your written consent or a qualifying court order and subpoena, as required by law. Additional Part 2 protections apply when relevant.

Written authorization. Uses outside those described in this notice require your written authorization unless otherwise allowed by law. Marketing disclosures, a sale of health information and most disclosures of psychotherapy notes require specific authorization. Public use of patient images or testimonials requires separate permission. You may revoke an authorization in writing; revocation does not undo actions already taken in reliance on it. Declining optional permissions does not prevent treatment. If fundraising communications are used, you may opt out; use of Part 2 information requires advance notice and a choice where applicable.

Your rights

Inspect or receive records. Contact Heather to request access or an electronic or paper copy. We verify identity and authority and respond within applicable California and federal deadlines. California generally provides inspection within five working days and copies within 15 days after a proper written request, subject to lawful exceptions. Only lawful fees may apply; records are not withheld solely because a treatment bill is unpaid.

Request a correction. Ask in writing to correct or amend information you believe is inaccurate or incomplete and explain why. If we deny a request, we explain the reason and available response rights. Where HIPAA applies, we generally act within 60 days, with a permitted extension when necessary.

Confidential communications. Request a particular telephone number, mailing address or reasonable communication method. We will accommodate reasonable requests. You do not need to explain why you want a different contact location.

Your rights, continued

Restrictions. Ask us to limit certain uses or disclosures. We may decline a restriction unless the law requires it; we will explain our decision. Where required, if you pay in full out of pocket and request it, we will not disclose that service to a health plan for payment or operations unless disclosure is required by law.

Accounting of disclosures. Where applicable, you may request an accounting of certain disclosures during the previous six years. It generally excludes treatment, payment, operations and other exempt disclosures. One accounting in a 12-month period is free; we will notify you of any lawful charge for additional requests and allow you to change or withdraw the request.

Copies and representatives. Ask for a paper copy of this notice at any time, even after agreeing to electronic delivery. A person with verified legal authority may exercise your rights. Parent or guardian access to a minor's information is subject to California minor-consent and confidentiality protections.

Our responsibilities

We must protect health information as required by applicable law, maintain appropriate safeguards, provide the notices required by law and follow the privacy practices in effect. If a breach requires notification, we will notify affected people without unreasonable delay and within legal deadlines. Where HIPAA applies, we follow its privacy, security and breach-notification duties.

We may revise this notice as permitted by law and make revisions apply to information already maintained and information received later. A revised notice will show its effective date and be available upon request and on our website once published.

Questions, requests or complaints

Contact Heather Van Buren at the address or phone on page 1. For email, start with a request for a secure way to communicate rather than including sensitive medical details. We may ask for a written request or proof of authority when appropriate.

You may also complain to the U.S. Department of Health and Human Services, Office for Civil Rights: 200 Independence Avenue SW, Washington, DC 20201; 1-877-696-6775; www.hhs.gov/hipaa/filing-a-complaint/index.html. You may contact the appropriate California oversight agency. We will not retaliate for a complaint or for exercising privacy rights.