HIPAA Notice of Privacy Practices

GenoGenRx, LLC  |  Effective Date: April 2, 2026

1. About This Notice

GenoGenRx, LLC ("GenoGenRx," "we," "us," or "our") is a licensed 503A compounding pharmacy located in Boca Raton, Florida. As a healthcare provider that transmits health information in electronic form in connection with certain transactions, GenoGenRx is a covered entity under the Health Insurance Portability and Accountability Act of 1996 (HIPAA).

This Notice of Privacy Practices ("Notice") describes how we may use and disclose your protected health information (PHI) and explains your rights regarding that information. PHI is individually identifiable health information — including demographic data — that relates to your past, present, or future physical or mental health or condition; the provision of healthcare to you; or payment for such healthcare.

This Notice applies to all PHI that GenoGenRx creates, receives, maintains, or transmits in connection with our pharmacy services.

2. Our Obligations

We are required by law to:

• Maintain the privacy of your PHI as required by HIPAA and applicable state laws
• Provide you with this Notice of our legal duties and privacy practices with respect to your PHI
• Notify you following a breach of your unsecured PHI
• Abide by the terms of this Notice currently in effect

3. How We May Use and Disclose Your PHI

The following describes the circumstances under which we may use or disclose your PHI without your written authorization:

For Treatment

We may use and disclose your PHI to compound, dispense, and deliver medications prescribed for you and to coordinate your care with your prescribing healthcare provider. For example, we may contact your physician to clarify a prescription order, discuss alternative formulations, or provide information about a compounded medication you have been prescribed.

For Payment

We may use and disclose your PHI to obtain payment for pharmacy services. This may include billing your insurance carrier, contacting a health plan for prior authorization, or communicating with a third-party payer regarding charges for compounded medications.

For Healthcare Operations

We may use and disclose your PHI for activities that support the operation of our pharmacy, including quality assessment and improvement, staff training, compliance auditing, accreditation activities, and business planning. For example, we may review prescription records to evaluate the quality and effectiveness of our compounding services.

Business Associates

We may disclose your PHI to third-party service providers (business associates) who perform functions on our behalf, such as technology support, shipping and delivery, billing services, or legal and compliance services. All business associates are required to enter into a written Business Associate Agreement (BAA) obligating them to protect the confidentiality of your PHI in accordance with HIPAA.

As Required by Law

We will use and disclose your PHI when required to do so by applicable federal, state, or local law.

Public Health Activities

We may disclose your PHI to public health authorities for activities such as preventing or controlling disease, reporting adverse events or product defects, and notifying individuals who may have been exposed to a communicable disease, as permitted or required by law.

Health Oversight Activities

We may disclose your PHI to a health oversight agency for activities authorized by law, such as audits, investigations, inspections, and licensure proceedings.

Judicial and Administrative Proceedings

We may disclose your PHI in response to a court order. We may also disclose PHI in response to a subpoena, discovery request, or other lawful process, provided that the applicable requirements under HIPAA and Florida law (including Florida Statutes §456.057) regarding notice and authorization are met.

Law Enforcement

We may disclose your PHI to law enforcement officials in limited circumstances as required or permitted by law, such as to report certain types of wounds or injuries, or to comply with a court order or grand jury subpoena. Florida law may impose additional restrictions on these disclosures.

To Avert a Serious Threat to Health or Safety

We may use and disclose your PHI when necessary to prevent or lessen a serious and imminent threat to your health and safety or the health and safety of the public or another person.

Decedents

We may disclose PHI to a coroner, medical examiner, or funeral director as necessary for their duties.

Workers' Compensation

We may disclose your PHI as authorized by and to the extent necessary to comply with workers' compensation or similar laws.

Individuals Involved in Your Care

Unless you object, we may disclose limited PHI to a family member, close personal friend, or other individual involved in your care or payment for your care. If you are unable to agree or object due to incapacity or an emergency, we may disclose PHI to such individuals if we determine that the disclosure is in your best interest.

4. Uses and Disclosures Requiring Your Authorization

For uses and disclosures of PHI not described above, we will obtain your written authorization before making the use or disclosure. You have the right to revoke your authorization in writing at any time, except to the extent that we have already taken action in reliance on your authorization.

The following uses and disclosures require your written authorization:

• Most uses and disclosures of psychotherapy notes (if applicable)
• Uses and disclosures of PHI for marketing purposes
• Disclosures that constitute a sale of PHI
• Other uses and disclosures not described in this Notice

5. Your Rights Regarding Your PHI

You have the following rights with respect to your PHI. To exercise any of these rights, please submit a written request to our Privacy Officer using the contact information provided below.

Right to Access

You have the right to inspect and obtain a copy of your PHI contained in a designated record set (such as prescription records and billing records). We may charge a reasonable, cost-based fee for copies. We will respond to your request within 30 days (with a possible 30-day extension if needed). In limited circumstances, we may deny your request, and if so, we will explain the reason and your right to have the denial reviewed.

Right to Amend

You have the right to request that we amend your PHI if you believe it is incorrect or incomplete. We may deny the request if the information was not created by us, is not part of your designated record set, or is accurate and complete. If we deny your request, we will provide a written explanation and inform you of your right to submit a statement of disagreement.

Right to an Accounting of Disclosures

You have the right to request a list of certain disclosures we have made of your PHI. This accounting does not include disclosures made for treatment, payment, or healthcare operations, or disclosures you authorized in writing, among other exceptions. You may request one accounting per 12-month period at no charge; additional requests may be subject to a reasonable fee.

Right to Request Restrictions

You have the right to request restrictions on how we use or disclose your PHI for treatment, payment, or healthcare operations, or to individuals involved in your care. We are not required to agree to your request, with one exception: if you pay for a pharmacy service or item entirely out of pocket and request that we not disclose PHI about that service to your health plan for purposes of payment or healthcare operations, we must honor that request.

Right to Confidential Communications

You have the right to request that we communicate with you about your PHI in a certain way or at a certain location. For example, you may ask that we contact you only by mail at a specific address. We will accommodate reasonable requests.

Right to a Paper Copy of This Notice

You have the right to obtain a paper copy of this Notice at any time, even if you have previously agreed to receive it electronically. You may request a paper copy by contacting our Privacy Officer.

6. Additional Protections Under Florida Law

GenoGenRx operates in the State of Florida and complies with all applicable Florida privacy and health information laws, which in certain areas provide greater protections than HIPAA. Key provisions include:

Florida Statutes §456.057 — Ownership and Control of Patient Records

Under Florida law, medical records may not be disclosed to any person other than the patient, the patient's legal representative, or other healthcare practitioners involved in the patient's care, except upon written authorization of the patient. Exceptions are limited and include disclosures pursuant to a court-issued subpoena from a court of competent jurisdiction (with proper notice to the patient), compulsory process in child abuse investigations, and certain other situations specified by law. Florida law also prohibits the use of patient information for solicitation or marketing without the patient's specific written release.

Florida Statutes §465.016 — Pharmacy Practice Standards

Florida pharmacy law establishes professional standards of conduct, including obligations related to the confidentiality of patient records maintained by pharmacies.

Florida Constitution, Article I, §23

Florida's constitution provides a fundamental right to privacy. Florida courts have recognized this constitutional right as applying to the confidentiality of medical records, providing an additional layer of protection beyond federal law.

7. Changes to This Notice

We reserve the right to change this Notice and to make the revised or changed Notice effective for PHI we already have about you, as well as any PHI we receive in the future. We will post the current Notice on our website at www.genogenrx.com/hipaa-notice-of-privacy-practices with the effective date. We will make copies of the current Notice available upon request. If we make a material change to this Notice, we will post the revised Notice on our website and make it available at our pharmacy location.

8. Complaints

If you believe your privacy rights have been violated, you have the right to file a complaint. You will not be penalized or retaliated against for filing a complaint.

You may file a complaint with:

• GenoGenRx's Privacy Officer (see contact information below)
• The U.S. Department of Health and Human Services, Office for Civil Rights

9. Contact Information

For questions about this Notice, to exercise any of your rights, or to file a privacy complaint, please contact: