In this notice we use the term "we" and "our" to include SPROUT THERAPY PDX, its mental health care providers, interns, contractors, and employees.

I. OUR PLEDGE REGARDING YOUR PERSONAL HEALTH INFORMATION

SPROUT THERAPY PDX understands that health information about you and your health care is personal and is committed to protecting your privacy.

This Notice is provided to you as a requirement of the Health Insurance Portability and Accountability Act (HIPAA) and applies to all of the records of your care generated by this mental health care practice. This Notice describes SPROUT THERAPY PDX's duties to you regarding your personal health information ("PHI"), how we may use or disclose your PHI, and your rights with respect to your PHI. The privacy practices described in this Notice will be followed by all SPROUT THERAPY PDX providers and employees while the Notice is in effect.

II. CHANGES TO THIS NOTICE

The effective date of this Notice is shown below. SPROUT THERAPY PDX reserves the right to change this Notice and our privacy practices at any time, as long as the change is consistent with state and federal law. Any revised notice will apply both to the PHI we already have about you at the time of the change, and any PHI created or received after the change takes effect. If we make an important change to our privacy practices, we will promptly change this Notice. A copy of this or any revised Notice will be available upon request and is available for you to review at any time in your client portal. You also have the right to receive a paper and/or e-mail copy of this Notice upon request.

III. WHAT IS PHI?

PHI is individually identifiable health information, including demographic information, about your past, present or future physical or mental health or condition, health care services you receive, and past, present or future payment for your health care. Demographic information means information such as your name, social security number, address, and date of birth. PHI information also relates to your past, present, or future mental health care services. PHI may be in oral, written or electronic form.

Your provider at SPROUT THERAPY PDX will create a record of the care and services you receive. SPROUT THERAPY PDX needs this record to provide you with quality care and to comply with certain legal requirements. "Psychotherapy notes" (as that term is defined in 45 CFR § 164.501) kept by your provider and communications between you and your health care provider about your care are examples of PHI.

IV. OUR DUTIES TO YOU REGARDING PROTECTED HEALTH INFORMATION

SPROUT THERAPY PDX is required by law to do the following:

• Make sure that your PHI is kept private;

• Give you a copy of this Notice of our legal duties and privacy practices for the use and disclosure of your PHI;

• Follow the terms of the Notice currently in effect;

• Communicate any changes in the Notice to you; and

• Notify you if a breach occurs that may have compromised the privacy or security of your PHI.

Other ways SPROUT THERAPY PDX safeguards your PHI:

• Treats all of your personal information that we collect as confidential;

• States confidentiality policies and practices in our employee handbook;

• Restricts access to your personal information to only those employees who need to know your personal information in order to provide services to you, such as submitting a claim for a covered benefit;

• Discloses only your personal information necessary for a service provider to perform its functions on your behalf, and the provider agrees to protect and maintain the confidentiality of your personal information; and

• Maintains physical, electronic, and procedural safeguards that comply with federal and state regulations to guard your personal information.

V. HOW WE MAY USE OR DISCLOSE YOUR PROTECTED HEALTH INFORMATION

SPROUT THERAPY PDX can only disclose your personal information when allowed or required by law to make the disclosure, or if you (or your authorized representative) give us permission. If there are other legal requirements that further restrict our use or disclosure of your personal information, we will comply with those legal requirements as well. Your provider will not use or disclose your PHI for marketing purposes, or sell your PHI in the regular course of business.

The following types of uses and disclosures of your PHI are allowed or required by law:

• Treatment: SPROUT THERAPY PDX may use your PHI to carry out your treatment or services and contact you to remind you about appointments. We may disclose your medical information other health care providers who are involved in your treatment. In emergencies, SPROUT THERAPY PDX may use and disclose your protected health information to assist you in obtaining treatment.

• Payment: SPROUT THERAPY PDX may use and disclose your PHI so that the treatment and services you receive may be properly billed and paid. For example, SPROUT THERAPY PDX will share your protected health information with third-party business associates and/or programs who perform various billing activities for SPROUT THERAPY PDX.

• Death; Organ Donation: SPROUT THERAPY PDX may disclose the PHI of a deceased person to a coroner, funeral director, next of kin, or organ procurement organization for certain purposes. For example, we may disclose protected health information to a funeral director to enable them to carry out their duties.

• Legal Proceedings; Criminal Activity: SPROUT THERAPY PDX may disclose your PHI during any judicial or administrative proceeding, in response to a court order, subpoena, discovery request, or other lawful process. For example, if you are a victim of a crime or you commit a crime, SPROUT THERAPY PDX may disclose information as required by law.

• Military Activity and National Security: SPROUT THERAPY PDX may also disclose your PHI to authorized officials conducting national security and intelligence activities as required by law.

• Public Health and Safety/Abuse or Neglect: SPROUT THERAPY PDX may disclose your PHI if we believe disclosure is necessary to avert a serious and imminent threat to your health or safety or the health or safety of others. For example, we may disclose your protected health information to appropriate authorities if we reasonably believe that you are a possible victim and/or perpetrator of abuse, neglect, or other crimes.

• Law Enforcement: SPROUT THERAPY PDX may disclose your PHI to authorized officials for law enforcement purposes, for example, to respond to a search warrant, report a crime on our premises, or help identify or locate someone.

• Required Uses and Disclosures: By law, SPROUT THERAPY PDX must make disclosures when required by federal or state law to disclose your PHI to others. For example, the Secretary of the Department of Health and Human Services may review our compliance efforts, which may include seeing your PHI. the Secretary of the U.S. Department of Health and Human Services to investigate or determine our compliance with the requirements of Section 164.500 of HIPAA.

In some circumstances, you have the opportunity to authorize or object to the use or disclosure of all or part of your PHI. The following are examples in which your agreement or objection are required:

• Disclosure of your PHI to a member of your family, a relative, a close friend, or any other person you identify, that directly relates to that person's involvement in your health care.

• Disclosure of your PHI to someone who helps pay for your care.

You may revoke such an authorization in writing at any time, except to the extent that we have already taken action in reliance on the authorization.

VI. YOUR RIGHTS WITH RESPECT TO YOUR PHI

You may exercise the following rights by submitting a request to SPROUT THERAPY PDX. Depending on your request, you may also have rights under the Privacy Act of 1974. SPROUT THERAPY PDX can guide you in pursuing these options. Please be aware that SPROUT THERAPY PDX may deny your request; however, you may seek a review of the denial. With respect to your PHI, you have the following rights:

• The Right to a Notice of Privacy Practices. You have right to receive a notice that tells you how your PHI may be used and shared;

• The Right to See and Get Copies of Your PHI. Other than "psychotherapy notes," you have the right to get an electronic or paper copy of your record and other information that SPROUT THERAPY PDX has about you. SPROUT THERAPY PDX will provide you with a copy of your record, or a summary of it, if you agree to receive a summary, within 30 days of receiving your written request, and may charge a reasonable, cost based fee for doing so;

• The Right to Correct or Update Your PHI. If you believe that there is a mistake in your PHI, or that a piece of important information is missing from your PHI, you have the right to request that SPROUT THERAPY PDX correct the existing information or add the missing information. SPROUT THERAPY PDX may say "no" to your request, but will tell you why in writing within 60 days of receiving your request;

• The Right to Request Limits on Uses and Disclosures of Your PHI. You have the right to ask SPROUT THERAPY PDX not to use or disclose certain PHI for treatment, payment, or health care operations purposes. SPROUT THERAPY PDX is not required to agree to your request, and may say "no" if SPROUT THERAPY PDX believes it would adversely affect your health care;

• The Right to Restrict Disclosures to Health Plans for Self-Pay Services. If you pay for a service or health care item out-of-pocket in full, you have the right to ask SPROUT THERAPY PDX not to share that information with your health insurer for the purpose of payment or health care operations. SPROUT THERAPY PDX will agree to your request, except where we are required by law to share that information;

• The Right to Choose How We Send PHI to You. You have the right to ask SPROUT THERAPY PDX to contact you in a specific way (for example, home or office phone) or to send mail to a different address, and SPROUT THERAPY PDX will agree to all reasonable requests;

• The Right to Get a List of the Disclosures We Have Made. You have the right to request a list of instances in which SPROUT THERAPY PDX has disclosed your PHI for purposes other those described in "HOW WE MAY USE OR DISCLOSE YOUR PROTECTED HEALTH INFORMATION" earlier in this Notice. SPROUT THERAPY PDX will respond to your request for an accounting of disclosures within 60 days of receiving your request. The list SPROUT THERAPY PDX will give you will include disclosures made in the last six years unless you request a shorter time. SPROUT THERAPY PDX will provide the list to you at no charge, but if you make more than one request in the same year, SPROUT THERAPY PDX will charge you a reasonable cost-based fee for each additional request;

• The Right to Be Notified of a Breach. You have the right to be notified if a breach occurs that may have compromised the privacy or security of your PHI; and

• The Right to Get a Paper or Electronic Copy of this Notice. You have the right to get a paper copy of this Notice, and you have the right to get a copy of this notice by e-mail. And, even if you have agreed to receive this Notice via e-mail, you also have the right to request a paper copy of it.

VII. COMPLAINTS

If you believe your rights are being denied or your health information isn't being protected, you can file a written complaint with SPROUT THERAPY PDX. You may contact our HIPAA Security Officer for further information about the complaint process at 7704 N Hereford Ave, Portland, OR 97203, or reach us at info@sprouttherapypdx.com. You may also lodge a complaint with the U.S. Department of Health and Human Services.

No retaliation will occur against you for making a complaint about our privacy practices.

VIII. ELECTRONIC RECORDS DISCLOSURE

SPROUT THERAPY PDX keeps and stores records for each client in a record-keeping system produced and maintained by Simple Practice. This system is "cloud-based," meaning the records are stored on servers which are connected to the Internet. Here are the ways in which the security of these records is maintained:

· SPROUT THERAPY PDX has entered into HIPAA Business Associate Agreement with SimplePractice. Because of this agreement, SimplePractice is obligated by federal law to protect these records from unauthorized use or disclosure.

· The computers on which these records are stored are kept in secure data centers, where various physical security measures are used to maintain the protection of the computers from physical access by unauthorized persons.

· SimplePractice employs various technical security measures to maintain the protection of these records from unauthorized use or disclosure.

o You can learn more about these methods here: https://www.simplepractice.com/security/ SPROUT THERAPY PDX has our own security measures for protecting the devices that we use to access records:

o On computers, we employ firewalls, antivirus software, passwords, and encryption to protect our computers from unauthorized access and thus to protect the records from unauthorized access.

o With mobile devices, we use passwords, remote tracking, and remote wipe to maintain the security of the device and prevent unauthorized persons from using it to access records.

Here are things to keep in mind about our record-keeping system:

· While our record-keeping companies and SPROUT THERAPY PDX both use security measures to protect these records, their security cannot be guaranteed.

· Some workforce members at SimplePractice such as engineers or administrators, may have the ability to access these records for the purpose of maintaining the system itself. As a HIPAA Business Associate, SimplePractice is obligated by law to train their staff on the proper maintenance of confidential records and to prevent misuse or unauthorized disclosure of these records. This protection cannot be guaranteed, however.

· Our record-keeping company keeps a log of our transactions with the system for various purposes, including maintaining the integrity of the records and allowing for security audits.

IX. USE OF ARTIFICIAL INTELLIGENCE TOOLS

SPROUT THERAPY PDX uses artificial intelligence (AI) tools to support both clinical documentation and internal operations. This section describes those uses, the protections in place, and your rights in connection with AI tools that may be used as part of your care. Staff who use AI tools as part of client care or documentation complete required training on their appropriate and confidential use before doing so.

AI Tools Currently in Use

1. Google Gemini (Google Meet) — Intern Clinical Supervision (Active)

For clients working with Graduate Interns, SPROUT THERAPY PDX uses Google Gemini within Google Meet to transcribe telehealth sessions for the purpose of clinical supervision. A separate consent form is required for this use.

•    Transcripts are used by the Intern and their Licensed Supervisor to review clinical skills — they are not part of your permanent medical record.

•    A HIPAA Business Associate Agreement (BAA) is in place with Google.

•    Under SPROUT THERAPY PDX's Google Workspace Enterprise agreement, your data is not used to train Google's public AI models.

•    Transcripts are temporary and are permanently deleted after supervisory review.

•    If this applies to you, a separate consent will be sent. You have the ability to opt out from this tool now or at any time in the future.

2. SimplePractice NoteTaker and CareAide — Clinical Documentation

Some SPROUT THERAPY PDX clinicians have opted in to AI-powered tools built into our SimplePractice electronic health records platform. CareAide would help clinicians prepare for sessions, access relevant context during sessions, and complete documentation afterward — including AI-assisted session notes (NoteTaker), intake summaries, session preparation, and treatment planning support. With your separate written consent, this tool would listen to and transcribe session audio, generate a draft clinical note for your clinician to review, edit, and sign, and then delete the audio and transcript on the following schedule:

•    Audio recordings are deleted immediately after the transcript is created, generally within minutes of a session ending.

•    Transcripts are deleted within 7 days, or when your clinician signs and locks the note — whichever comes first.

This use will be voluntary and will require your separate written consent before it is used in your sessions. You can opt out now or at any time in the future.

SimplePractice is HIPAA-compliant and HITRUST certified. A Business Associate Agreement (BAA) is in place between SPROUT THERAPY PDX and SimplePractice, which covers this tool. Third-party companies that help power Note Taker are contractually prohibited from using your data to train their own AI models.

Note on transcript retention: SimplePractice may retain a de-identified, de-coupled version of a session transcript to help improve its AI tools, unless a practice opts out. SPROUT THERAPY PDX has chosen to configure our account to opt out of transcript retention.

3. Administrative and Operational Tools

SPROUT THERAPY PDX uses AI-assisted tools to support internal administrative functions, including operational reporting, document drafting, and internal communications. These tools are used in a way that does not involve your protected health information. PHI is not entered into any administrative AI tool.

What AI Tools at SPROUT THERAPY PDX Do Not Do

•    Make clinical decisions, diagnoses, or treatment recommendations

•    Replace your clinician's professional judgment or legal responsibility for your care

•    Share your information beyond what HIPAA and Oregon law allow

•    Use your information to train AI models — our vendor agreements explicitly prohibit this

•    Produce any final clinical documentation without clinician review and sign-off

•    Affect your billing or payer coverage

What SPROUT THERAPY PDX Requires of Any AI Vendor

•    A signed, HIPAA-compliant Business Associate Agreement (BAA)

•    Encryption of PHI in transit and at rest

•    A prohibition on using client data to train AI models or improve vendor products without our authorization

•    Documented data retention and deletion practices

Oregon Law

•    Oregon Revised Statute 165.540 — requires all-party consent before any conversation is recorded (addressed in the separate client consent forms for Google Gemini/intern supervision and, when applicable, Note Taker)

•    Oregon Revised Statute 179.505 — provides specific protections for mental health records beyond federal HIPAA requirements

•    Oregon Health Authority (OHA) requirements for Medicaid/OHP documentation

•    Oregon Board of Licensed Professional Counselors and Therapists (OBLPCT) ethical standards

•    Oregon Medical Board requirements applicable to prescribers at SPROUT THERAPY PDX

A Note on OHP and Insurance Documentation

Many SPROUT THERAPY PDX clients are served through Oregon Health Plan (OHP/Medicaid) or commercial insurance, which require clinical notes to meet specific documentation standards for services to be billed appropriately. No AI-generated note is signed or submitted without a licensed clinician reviewing and confirming it meets those standards.

Policy Updates

SPROUT THERAPY PDX will review our AI vendors' policies periodically and will update this Notice and notify clients of any changes that materially affect how your information is handled. Your rights under this Notice are not reduced by SPROUT THERAPY PDX's use of AI tools.

IX. ACKNOWLEDGEMENT OF RECEIPT OF PRIVACY NOTICE

SPROUT THERAPY PDX requests that [clients] provide a signed acknowledgment of receipt of this Notice. Our intent is to make you aware of the possible uses and disclosures of your protected health information and your privacy rights. If you decline to provide a signed acknowledgment, SPROUT THERAPY PDX may determine not to continue to provide you with requested services. SPROUT THERAPY PDX will disclose your protected health information for treatment, payment, and health care operations when necessary.