Privacy Policy

Privacy Policy & Notice of Privacy Practices

Tri Valley Plastic Surgery Professional Medical Corporation
11820 Dublin Blvd, Dublin, CA 94568  |  925-875-0700  |  www.trivalleyplasticsurgery.com

Effective Date: June 1, 2026

1. Our Commitment to Your Privacy

Tri Valley Plastic Surgery Professional Medical Corporation is committed to protecting the privacy of your personal and health information. This Privacy Policy and Notice of Privacy Practices ("Notice") describes how we collect, use, and protect your information and your rights regarding that information. As a HIPAA-covered entity, we are required by law to maintain the privacy of your protected health information ("PHI") and to provide you with this Notice.

This Notice applies to all services provided by our practice, including plastic surgery, medical spa services, our medically supervised weight loss program, and telehealth services.

2. Information We Collect

We collect information necessary to provide you with medical care, including your name, contact information, date of birth, medical history, treatment records, medication records, insurance information, and payment information. We also collect information submitted through the Symplast patient mobile application and through telehealth visits. All information collected through our telehealth and AI-enabled technologies is protected under HIPAA and California privacy laws, consistent with our Consent for Medical Photography, Telehealth & AI-Enabled Technologies form.

3. How We Use and Disclose Your Information

We use and disclose your PHI for the following purposes without requiring your authorization:

• Treatment: to provide, coordinate, and manage your care
• Payment: to bill for services and process insurance claims
• Healthcare Operations: for quality review, staff training, and compliance
• As required by law, including court orders, public health reporting, and government oversight

We will obtain your written authorization before using your PHI for marketing, before selling your PHI, or for any other purpose not described in this Notice. You may revoke any authorization in writing at any time. We obtain separate written consent before using photographs or recordings for educational, promotional, or portfolio purposes, consistent with our Consent for Medical Photography form.

4. Your Privacy Rights

You have the following rights regarding your PHI. To exercise any of these rights, contact our Practice Director using the information at the end of this Notice.

• Right to Access: request a copy of your medical records
• Right to Amend: request corrections to inaccurate or incomplete records
• Right to Accounting: receive a list of disclosures we have made of your PHI
• Right to Restrict: request limits on how we use or disclose your PHI
• Right to Confidential Communications: request we contact you in a specific way
• Right to a Paper Copy: receive a paper copy of this Notice at any time

5. California Privacy Rights (CCPA/CPRA)

California residents have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) for personal information not governed solely by HIPAA. These rights include the right to know what personal information we collect, the right to request deletion, the right to correct inaccurate information, and the right to non-discrimination for exercising these rights. We do not sell your personal information. To submit a California privacy request, contact our Practice Director at [email protected].

6. How We Protect Your Information

We maintain administrative, physical, and technical safeguards to protect your PHI as required by the HIPAA Security Rule. All staff with access to patient information are required to sign a Confidentiality and Non-Disclosure Agreement as a condition of employment. Electronic communications containing PHI are encrypted and archived for a minimum of six (6) years in accordance with HIPAA requirements. We require all third-party vendors who handle PHI on our behalf to enter into a Business Associate Agreement that obligates them to protect your information and comply with HIPAA. In the event of a breach of unsecured PHI, we will notify you as required by the HIPAA Breach Notification Rule and California law.

7. Retention and Disposal of Your Records

We retain your medical records for a minimum of ten (10) years from the date of service in accordance with California law, or until age 28 for patients who were minors at the time of treatment. When records are no longer required to be retained, they are destroyed in a manner that renders them unreadable and unrecoverable.

8. Changes to This Notice

We reserve the right to update this Notice at any time. The current version will always be available at www.trivalleyplasticsurgery.com. You may request a paper copy at any time.

9. Complaints and Contact

If you have questions about this Notice or believe your privacy rights have been violated, please contact:

Practice Director — Tri Valley Plastic Surgery Professional Medical Corporation
11820 Dublin Blvd, Dublin, CA 94568
Phone: 925-875-0700  |  Email: [email protected]

You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, at www.hhs.gov/ocr/privacy/hipaa/complaints or 1-877-696-6775. We will not retaliate against you for filing a complaint.