Notice of Privacy Practices

ZALFI (the “Practice”) is committed to protecting your privacy. We are required by federal law (HIPAA) to maintain the privacy of Protected Health Information (PHI), which is information that identifies you or could be used to identify you. This Notice explains our legal duties, our privacy practices, and your rights regarding PHI we collect and maintain.

Your rights

You have the following rights regarding your PHI. To exercise any of these rights, contact our Privacy Officer (see contact information below).

• Access your medical records. You can request a paper or electronic copy of your PHI. We will provide it usually within 30 days. A reasonable, cost-based fee may apply.
• Request amendments. You may request corrections to your PHI. We may deny the request, but will provide a written explanation within 60 days, and you may submit a statement of disagreement.
• Request confidential communications. You may ask us to contact you in a specific way or at a specific location. We will accommodate all reasonable requests.
• Request restrictions. You may ask us not to use or share your PHI for treatment, payment, or healthcare operations. We are not required to agree if it affects care. If you pay out-of-pocket in full, we will honor your request not to share PHI with your health insurer. You may also request that your PHI not be shared with family or friends.
• Accounting of disclosures. You may request a list of disclosures we have made of your PHI for the past six years (except for treatment, payment, healthcare operations, or disclosures you authorized). One free accounting per year; reasonable fees may apply for additional requests.
• Receive a copy of this Notice. You may request a paper copy at any time, even if you agreed to receive it electronically.
• Designate a personal representative. If you have a medical power of attorney or a legal guardian, that person may exercise your rights on your behalf.
• Patient portal / electronic access. You may request access to your PHI via our secure online patient portal. You are responsible for maintaining the confidentiality of your login credentials. Communications through the portal may become part of your medical record.
• File a complaint. You may file a complaint with the Practice or with the U.S. Department of Health and Human Services Office for Civil Rights at 200 Independence Avenue, S.W., Washington, D.C. 20201, by phone at 1-877-696-6775, or at hhs.gov/ocr. We will not retaliate for filing a complaint.

Your choices

You may tell us your preferences about how we share your PHI:

• Share information with family, friends, or others involved in your care or payment for your care.
• Share information for disaster relief purposes.
• Include your information in a hospital or facility directory (if applicable).

We will follow your instructions unless it is an emergency or we are legally required to share information. You must give written permission for us to share PHI for marketing purposes, sale of PHI, or psychotherapy notes.

Fundraising communications: We do not use your information for fundraising unless you provide consent. For SUD records, you will receive clear notice and a choice before any fundraising communications.

Our uses and disclosures

We may use or share your PHI for the following purposes:

• Treatment — share with providers involved in your care.
• Healthcare operations — quality improvement, administrative purposes, and patient communications.
• Payment — to bill and collect payment from insurers or patients.
• Public health and safety — prevent disease, report adverse events, abuse or neglect, or serious threats.
• Research — with appropriate approvals.
• Legal compliance — courts, law enforcement, government agencies.
• Organ and tissue donation — share with procurement organizations.
• Workers' compensation, law enforcement, government requests — as legally required.

Substance use disorder records — 42 CFR Part 2

Zalfi provides psychiatric services that may include the diagnosis, treatment, or referral of individuals with substance use disorders (SUDs). As a result, certain patient records are protected by federal confidentiality regulations, specifically 42 CFR Part 2. These protections apply in addition to HIPAA and provide enhanced confidentiality for SUD-related information.

1. What information is protected. 42 CFR Part 2 protects any information that identifies a patient as having a substance use disorder, relates to SUD diagnosis, treatment, or referral, or is created or maintained by Zalfi in connection with SUD services.
2. How SUD information may be used or disclosed. Zalfi may use or disclose SUD-related information only with the patient's written consent, for medical emergencies, for audits or evaluations by authorized agencies, or as otherwise permitted or required by law. Unlike standard HIPAA-protected information, SUD information cannot be disclosed for treatment, payment, or healthcare operations without written patient consent.
3. Prohibition on redisclosure. Any disclosure of SUD-related information made by Zalfi will include the following statement: “This information has been disclosed to you from records protected by Federal confidentiality rules (42 CFR Part 2). The Federal rules prohibit you from making any further disclosure of this information unless further disclosure is expressly permitted by the written consent of the person to whom it pertains or as otherwise permitted by 42 CFR Part 2.”
4. Patient rights under 42 CFR Part 2. Patients have the right to request restrictions on the use or disclosure of SUD information, revoke consent for disclosure at any time, receive an accounting of disclosures made under Part 2, and access their own SUD-related records unless restricted by law.
5. How we protect SUD information. Zalfi maintains administrative, technical, and physical safeguards to ensure that SUD-related information is segregated or specially flagged within our systems, accessible only to authorized personnel, and disclosed only in compliance with 42 CFR Part 2.

Our responsibilities

• Maintain the privacy and security of your PHI.
• Notify you promptly if a breach occurs that may compromise your PHI.
• Follow the duties described in this Notice.
• Minimum necessary: we will make reasonable efforts to limit PHI use and disclosure to the minimum necessary to accomplish the purpose.
• We will not use or share your PHI for purposes outside this Notice unless you provide written authorization.

Telehealth and electronic communication

Some services may be provided via telehealth. We take reasonable steps to protect your information. Communications via email or text may not be secure; you may request alternative methods at any time.

State law — Indiana

Indiana law provides additional privacy protections for mental health and SUD records. Where state law is more restrictive than HIPAA, we will follow the state law.

Changes to this notice

We may change the terms of this Notice. Updated notices will apply to all PHI we maintain. You may request a copy at any time, or view it on our website.

Privacy contact information

Consent for Treatment and Practice Policies

Effective May 14, 2026 · Version 3

This form is called a Consent for Treatment and Practice Policies (the “Consent”). Your therapist, counselor, psychologist, doctor, nurse practitioner or other health professional (“Provider”) at Zalfi LLC (the “Facility”/“Practice”) has asked you to read and sign this Consent before you start mental health treatment. Please review the information. If you have any questions, contact your Provider.

The treatment process

Treatment is a collaborative process where you and your Provider will work together to achieve goals that you define. Therapy and/or medication management (“Treatment”) generally show positive outcomes for individuals who follow the process. Treatment can further include labs, other diagnostic testing, education, procedures considered advisable, and services rendered by other healthcare professionals. Some clients may be required to be seen in person at least once prior to telehealth services. Some services at the Facility may be rendered to clients by Providers who are independent contractors. Better outcomes are often associated with a good therapeutic relationship between a client and their Provider.

Independent choice and provider selection

You understand that you may locate and select providers through a variety of public sources such as online directories, professional listings, or the practice's website. You acknowledge that your decision to begin care with this provider and/or practice is your own. To the best of your knowledge, the provider or their staff have not personally solicited or contacted you to transfer your care from another organization or platform. This acknowledgment is included to confirm that your choice to receive care through this practice is made independently and voluntarily.

Provider assignment and delegation

You acknowledge and agree that the Practice may assign, delegate, or subcontract aspects of your treatment to other qualified professionals (such as associates, covering clinicians, or consultants) under the supervision or oversight of Zalfi, when clinically appropriate or in the event your assigned provider is unavailable. You will be notified in advance of any such changes in provider whenever feasible. If you object to a proposed provider substitution, you may discuss alternative arrangements or request transfer to another clinician.

Treatment outcomes

You acknowledge that no guarantee has been made to you and/or the patient regarding the outcome of any services provided. This includes all therapy, treatment, tests, procedures and visits while at the Facility. You, the client, understand that our providers exercise their judgment when rendering services and are not employees of the Facility but independent contractors.

Telehealth services

To use telehealth, you need an internet connection and a device with a camera for video. Your Provider can explain how to log in and use any features on the telehealth platform. If telehealth is not a good fit for you, your Provider will recommend a different option. You have the right to withdraw your consent for telehealth at any time. Your provider may also require you to be seen in person and terminate your telehealth sessions at any time.

Risks

• Privacy and confidentiality. You may be asked to share personal information with the telehealth platform to create an account, such as your name, date of birth, location and contact information.
• Technology. At times, you could have problems with your internet, video or sound. If you have issues during a session, your Provider will follow the backup plan that you agree to prior to sessions.
• Crisis management. It may be difficult for your Provider to provide immediate support during an emergency or crisis. You and your Provider will develop a plan for emergencies or crises, such as choosing a local emergency contact, creating a communication plan, and making a list of local support, emergency and crisis services.

Benefits

• Flexibility. You can attend therapy wherever is convenient for you.
• Ease of access. You can attend telehealth sessions without worrying about traveling, meaning you can schedule less time per session and can attend therapy during inclement weather or illness.

Recommendations

• Make sure that other people cannot hear your conversation or see your screen during sessions.
• Do not use video or audio to record your session.
• Make sure to let your Provider know if you are not in your usual location before starting any telehealth session.

Other

• Facility staff may be present during the telehealth visit to help with equipment. Your healthcare provider will omit any sensitive details about your care and ask staff to leave as soon as possible.
• Through telehealth you may be prescribed medications. According to certain federal and/or state laws you may be required to be seen in person to receive some medications.

Limitations of service

You understand and agree to the following limitations of services provided by Zalfi:

• Zalfi is not an emergency service. In an emergency or crisis situation, you must call 911, go to the nearest emergency department, or contact a local crisis hotline.
• Telehealth has inherent limitations, including the inability to perform certain assessments or interventions.
• Certain mental health or medical conditions may require referral to in-person care, hospitalization, or specialized services beyond the scope of Zalfi's providers.
• While every effort is made to provide effective care, outcomes cannot be guaranteed.
• Certain services may be restricted or unavailable due to state laws, licensure limitations, or payer requirements. If a service becomes unavailable for any reason, Zalfi will inform you and assist in identifying appropriate alternative care.

Confidentiality

Your Provider will not disclose your personal information without your permission unless required by law. If your Provider must disclose your personal information without your permission, your Provider will only disclose the minimum necessary to satisfy the obligation. However, there are a few exceptions:

• Your Provider may speak to other healthcare providers involved in your care.
• Your Provider may speak to emergency personnel.
• If you report that another healthcare provider is engaging in inappropriate behavior, your Provider may be required to report this information to the appropriate licensing board. Your Provider will discuss making this report with you first and will only share the minimum information needed while making a report.
• If your Provider believes there is a specific, credible threat of harm to someone else, they may be required by law or may make their own decision about whether to warn the other person and notify law enforcement.
• If your Provider has reason to believe a minor or elderly individual is a victim of abuse or neglect, they are required by law to contact the appropriate authorities.
• If your Provider believes that you are at imminent risk of harming yourself, they may contact law enforcement or other crisis services. However, before contacting emergency or crisis services, your Provider will work with you to discuss other options to keep you safe.

Substance use disorder information and 42 CFR Part 2 consent

Certain health information maintained by Zalfi is protected by federal confidentiality laws, including 42 CFR Part 2. These laws apply to records that identify a patient as having a substance use disorder (SUD) or receiving SUD-related diagnosis, treatment or referral. By signing this consent, you acknowledge and agree to the following:

• Description of information to be disclosed. This consent may include disclosure of SUD-related information, including SUD diagnoses, treatment history, medications, referrals, and clinical notes containing SUD-related details.
• Purpose of disclosure. SUD-related information may be disclosed for treatment, coordination of care, referral, payment, billing, insurance operations, healthcare operations such as audits or quality review, or any additional purpose you specifically authorize.
• Persons or entities permitted to receive information. With your consent, SUD-related information may be disclosed to other treating providers, insurance companies, billing services, laboratories, health information exchanges, or any additional individuals or entities you designate.
• Right to revoke consent. You may revoke this consent at any time except to the extent that Zalfi has already acted in reliance on it. Revocation must be submitted in writing.
• Expiration of consent. Unless otherwise specified, this consent expires one year from the date of signature or upon termination of treatment, whichever occurs first.
• Prohibition on redisclosure. Any disclosure made under this consent must include the following statement: “This information has been disclosed to you from records protected by Federal confidentiality rules (42 CFR Part 2). The Federal rules prohibit you from making any further disclosure of this information unless further disclosure is expressly permitted by the written consent of the person to whom it pertains or as otherwise permitted by 42 CFR Part 2.”
• Patient rights. You understand that you are not required to consent to the disclosure of SUD information. Refusing consent may limit coordination with outside providers or insurers. Your treatment at Zalfi will not be conditioned on signing this consent unless the disclosure is necessary for treatment or payment.

Record keeping

Your Provider is required to keep records about your treatment. These records help ensure the quality and continuity of your care, as well as provide evidence that the services you receive meet the appropriate standards of care. Your records are maintained in an electronic health record (EHR). The EHR has several safety features to protect your personal information.

Communication

You decide how to communicate with your Provider outside of your sessions. You have several options:

Texting and email

• Texting and email are not secure methods of communication and should not be used to communicate personal information. You may choose to receive appointment reminders via text message or email. You should carefully consider who may have access to your text messages or emails before choosing to communicate via either method.
• By providing a telephone number and submitting this form you are consenting to be contacted by SMS text message. Message and data rates may apply. You can reply STOP to opt out of further messaging.

Secure communication

• Secure communications are the best way to communicate personal information, though no method is entirely without risk. Your Provider will discuss options available to you.

Social media and review websites

• If you try to communicate with your Provider via these methods, they will not respond. This includes any form of friend or contact request, @mention, direct message, wall post, and so on. This is to protect your confidentiality and ensure appropriate boundaries in therapy.
• Your provider and the Facility may publish content on various social media websites or blogs. There is no expectation that you will follow, comment on, or otherwise engage with any content. If you do choose to follow your Provider on any platform, they will not follow you back.
• If you see your Provider on any form of review website, it is not a solicitation for a review. Many such sites scrape business listings and may automatically include your Provider. If you choose to leave a review of your Provider on any website, they will not respond. While you are always free to express yourself in the manner you choose, please be aware of the potential impact on your confidentiality prior to leaving a review. It is often impossible to remove reviews later, and some sites aggregate reviews from several platforms leading to your review appearing other places without your knowledge.

Fees and payment for services

You may be required to pay for services and other fees. You will be provided with these costs prior to beginning therapy and should confirm with your insurance if part or all of these fees may be covered.

Balance accrual. Full payment is due at the time of your session. If you are unable to pay, tell your Provider. Your Provider and/or the Facility may offer payment plans or a sliding scale. If not, your Provider may refer you to other low- or no-cost services. Any balance due will continue to be due until paid in full. If necessary, your balance may be sent to a collections service. Your Provider may charge administrative fees for writing a letter or report at your request, consulting with another healthcare provider or other professional outside of normal case management practices, or for preparation, travel and attendance at a court appearance. These fees are listed in the fee agreement. Payment is due in advance.

Insurance benefits

We bill your primary and secondary insurance; please contact your insurance with any questions about coverage. You authorize the Facility to bill your insurance for any services rendered by the facility and authorize the insurance company and any third party payers to pay the Facility directly for any services rendered.

Before starting therapy, you should confirm with your insurance company if:

• Your benefits cover the type of therapy you will receive;
• Your benefits cover in-person and telehealth sessions;
• You may be responsible for any portion of the payment; and
• Your Provider is in-network or out-of-network.

Sharing information with insurance companies. If you choose to use insurance benefits to pay for services, you will be required to share personal information with your insurance company. Insurance companies keep personal information confidential unless they must share to act on your behalf, comply with federal or state law, or complete administrative work.

Covered and non-covered services. When your Provider is in-network, they have a contract with your insurance company. Your insurance plan may cover all or part of the cost of therapy. You are responsible for any part of this cost not covered by insurance, such as deductibles, copays or coinsurance. You may also be responsible for any services not covered by your insurance, which may include any forms that you ask your provider to complete. When your Provider is out-of-network, they do not have a contract with your insurance company. You can still choose to see your Provider; however, all fees will be due at the time of your session. Your Provider will tell you if they can help you file for reimbursement from your insurance company. If your insurance company decides that they will not reimburse you, you are still responsible for the full amount.

Payment methods. The practice encourages clients to keep a valid credit or debit card on file. This card will be charged for the amount due at the time of service and for any fees you may accrue, unless other arrangements have been made with the practice ahead of time. It is your responsibility to keep this information up to date, including providing new information if the card information changes or the account has insufficient funds to cover these charges.

Random drug screening

The practice may require a client provide a random drug screen. This is applicable to those in a medication assisted treatment (MAT) program at the Facility but does not exclude other clients who obtain treatment at the facility.

• You may be required to provide a urine, blood sample/testing, breath, or mouth swab. The testing may be completed by a third party.
• You must be able to perform the testing within 24 hours of the request.
• You must inform your Provider of any substances, licit or illicit, that may be found during the screening.
• You will be required to meet with the Provider if there is an abnormal screening.

Destruction of property

The client is responsible for any and all destruction to Facility property or other property belonging to others that may be in the Facility. By signing this form, the client agrees to these terms of liability and agrees to reimburse the Facility or other individuals for any property destruction and/or damage.

Termination

Length of treatment can vary for each client, and termination of services can come at different times due to various reasons. If you miss three consecutive appointments in a 12-month period without notifying or making arrangements in advance, your provider may consider your Treatment discontinued. Other factors can also contribute to termination of treatment, including but not limited to payment and insurance. Your provider will offer a list of alternative providers that you can follow up with.

Complaints

If you feel your provider has engaged in improper or unethical behavior, you can talk to them, or contact the licensing board that issued your provider's license, your insurance company, or the U.S. Department of Health and Human Services.

You can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by writing to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1-877-696-6775, or visiting hhs.gov/ocr. The Practice will not retaliate against you for filing a complaint.

Consent for treatment may be amended periodically. All changes are applicable to the consent for treatment and a copy may be obtained by contacting the Practice or by viewing a copy on this website.