Notice of Privacy Practices

HIPAA Privacy Notice & Data Security

This notice applies to protected health information maintained by Ayah Health PLLC for your care, including telehealth, wellness assessments and follow-up, patient-portal communications, and clinical documentation. HIPAA and applicable state law govern how that information may be used or disclosed. We apply administrative, physical, and technical safeguards, including encrypted connections and access controls. No electronic system can guarantee absolute security.

• Ayah Health does not sell your PHI. Uses for marketing or a sale of PHI require your written authorization unless a narrow legal exception applies.
• Information is transmitted through encrypted connections and access is limited to authorized persons who need it for permitted purposes.
• You have the right to request access to or copies of your digital health chart at any time.
• Technology providers that process PHI on our behalf as business associates are subject to written Business Associate Agreements, including applicable Google Cloud AI services. Laboratories and other treating providers, such as Quest Diagnostics, may receive information as independent healthcare providers rather than as our business associates.
• The Ayah Health portal and, where applicable, PushHealth support patient communication and care. These services do not replace emergency services. See our Care, Wellness & AI Consent for the role and limitations of automated assistance.

Wellness, AI Assistance & Recording Data

Wellness records may include your history, goals, assigned track, answers, self-reported measurements, score trends, messages, uploaded documents, and clinician-approved plans. We use relevant current and earlier records to support your care and help the clinician evaluate changes over time. AI-assisted intake, check-ins, transcription, and draft notes or plans may process this information through our contracted Google Cloud services for treatment and related permitted operations.

Our optional AI scribe captures clinic or telehealth conversations only after staff obtain separate permission from the patient or authorized representative and all participants. Audio is processed temporarily, not kept in a recording library or patient chart. The transcript is temporary working material: after it is used to update the clinical note, it is deleted from the scribe system. The clinician reviews and corrects the note before approving it. Declining recording does not prevent care. See your recording choices.

The updated clinical note, its revision history, and required consent and audit records remain subject to applicable retention requirements and legal holds. Withdrawing recording consent does not erase the note already created. Temporary processing, security logs, and any provider-managed backups are governed by applicable service agreements and safeguards; this notice is not a guarantee of instantaneous erasure from every infrastructure layer. You may request access to health information in the applicable record set or correction of an error. A deletion request does not override medical-record retention duties.

General care consent and scribe permission do not authorize advertising with your health information or identifiable recordings, or unrelated AI-model training. A use outside the purposes described here must have an applicable legal basis and any required separate authorization. This notice does not give a technology provider permission to use your PHI for its own unrestricted purposes.

How We May Use & Disclose Your Health Information

We may use and disclose your PHI without a separate written authorization when HIPAA or another law permits or requires it, including for:

• To address workers' compensation matters, respond to lawful health-oversight activity, or assist law enforcement when the applicable legal requirements are met.
• To respond to lawsuits and legal proceedings, including a valid court or administrative order and other process permitted by law.
• To work with a medical examiner, coroner, funeral director, or organ-procurement organization as allowed by law.
• For certain government functions, including military, national-security, and protective-services activities where authorized by law.

Any use or disclosure not described in this notice requires your written authorization unless the law allows otherwise. You may revoke an authorization in writing at any time, except to the extent action has already been taken in reliance on it.

Information disclosed to a recipient that is not subject to HIPAA may be redisclosed and no longer protected by HIPAA, although other laws may still apply. Additional protections for Part 2 records and more protective state law continue to govern where applicable.

Your Choices

When you tell us your preference, we may share relevant information with family, friends, or another person involved in your care or payment for care, and we may share information for disaster-relief purposes. If you cannot tell us your preference, we may share information when professional judgment and law permit and when it is in your best interest.

We will obtain your written permission before most uses of psychotherapy notes, most marketing uses, or a sale of PHI. Ayah Health does not currently conduct fundraising using patient information. If that changes, any communication will include a clear way to opt out.

Your Rights Regarding Your Health Information

Substance Use Disorder Records

If Ayah Health receives or maintains a substance use disorder patient record protected by 42 C.F.R. Part 2, additional federal confidentiality protections apply. With a valid consent for treatment, payment, and health care operations, a HIPAA-covered recipient may use and redisclose that record as HIPAA permits, subject to Part 2's special restrictions.

• Part 2 records, or testimony conveying their contents, may not be used or disclosed in a civil, criminal, administrative, or legislative investigation or proceeding against you without your specific written consent or a court order meeting Part 2 requirements and a subpoena or other legally required process. A general consent for treatment, payment, and operations is not consent to such use.
• Separate written consent is required for most uses or disclosures of substance-use-disorder counseling notes.
• If Part 2 information is used for fundraising, you must receive clear advance notice and a meaningful opportunity to opt out.
• A breach involving unsecured Part 2 records is subject to applicable breach-notification requirements.

State Jurisdictional Compliance

Telehealth services delivered by Dr. Ahsan Akram through Ayah Health PLLC are restricted exclusively to patients physically present in the state of Texas or the state of Florida at the time of consultation.

Federal & State Controlled Substances Policy

As a practice policy, Ayah Health does NOT prescribe DEA Schedule II–V controlled substances. This policy is a limit on our services, not a statement that all telehealth prescribing of controlled substances is prohibited by law.

Direct-Pay Financial Policy

Ayah Health operates as a direct-pay medical service and does not bill health insurance, Medicaid, or Medicare directly. Eligibility for HSA/FSA payment or insurance reimbursement depends on the service and your plan; it is not guaranteed. See the Wellness Membership Terms for recurring fees and cancellation. Billing consent is separate from acknowledgment of this privacy notice.

Breach Notification

In the unlikely event that a breach of your unsecured Protected Health Information occurs, Ayah Health PLLC will notify you without unreasonable delay, and in accordance with the timelines and requirements of the HIPAA Breach Notification Rule and applicable state law (Texas or Florida, depending on where your visit takes place).

Our Responsibilities

• We are required by law to maintain the privacy and security of your protected health information.
• We will let you know promptly if a breach occurs that may have compromised the privacy or security of your information.
• We must follow the duties and privacy practices described in this notice and give you a copy of it.
• We will not use or share your information other than as described here unless you authorize it in writing; you may revoke that permission in writing at any time, except for action already taken in reliance on it.
• We reserve the right to change the terms of this notice, and any changes will apply to information we already have as well as information we receive in the future. Any revised notice will be posted on this page.

Filing a Complaint