The Chouraeshkenazi Group – Master Privacy Policy & Notice of Privacy Practices

Introduction

This Master Privacy Policy and Notice of Privacy Practices explains how The Chouraeshkenazi Group (“we” or “us”) collects, uses, discloses, and safeguards your information, both in providing healthcare services and through digital platforms such as our website, mobile applications, and patient portal (“Online Channels”).

You acknowledge and agree to the terms outlined in this Policy by accessing or using our services in person or online. If you disagree, please do not use our Online Channels or submit personal information.

Notice of Privacy Practices (HIPAA)

1. Our Commitment to Privacy

We are required by law to:

• Protect the confidentiality and security of your Protected Health Information (PHI).
• Provide you with notice about our privacy practices and legal obligations.
• Inform you promptly if your unsecured PHI has been breached.
• Clearly explain your privacy rights.

2. Permitted Uses and Disclosures of PHI Without Authorization

We may use or share your PHI for:

• Treatment: Coordination or management of care with other healthcare providers.
• Payment: Billing, payment, and reimbursement activity.
• Healthcare Operations: Administrative, quality control, compliance, and business management functions.
• Public Health/Safety: Reporting for public health requirements, abuse/neglect, threats to safety.
• Legal & Law Enforcement: To comply with law, legal orders, or law enforcement requests.
• Emergencies/Incapacity: Using professional judgment to disclose relevant PHI when you cannot consent.
• Research, Government Functions, Organ Donation, Workers’ Compensation, Health Oversight Activities, and other purposes permitted under HIPAA.

3. Psychotherapy Notes

We will not use or disclose psychotherapy notes without your written authorization except for purposes permitted by law.

4. Uses Requiring Authorization

Your written authorization is required before:

• Using/disclosing psychotherapy notes except in certain limited situations.
• Using PHI for marketing or advertising.
• Selling your PHI.

Authorization may be revoked at any time in writing (except to the extent already relied upon).

5. Additional Protections for Highly Confidential Information

Special legal protections apply to specific PHI categories, such as substance use disorder records, HIV status, mental health, and sexual assault records. These are disclosed only as permitted or required by law, and with appropriate consent where needed.

6. Your Rights Regarding PHI

You have the right to:

• Access & obtain copies of your PHI.
• Request corrections to your PHI.
• Request confidential communications.
• Request restrictions on disclosure to health plans for services you pay in full.
• Request an accounting of disclosures.
• Obtain a paper copy of this Notice.
• Opt out of health information exchanges (HIE).
• File complaints without fear of retaliation.

To exercise rights, contact our Privacy Officer (details below).

Website Privacy Policy (Online Data Collection & Use)

1. Applicability

This section applies to all personal information collected via our Online Channels.

2. Children Under 13

Our Online Channels are not intended for children under 13. We do not knowingly collect their personal information.

3. Visitors Outside the United States

Our services and website are intended for U.S. residents. Data submitted by non-U.S. residents is processed in the United States.

4. Personal Information We Collect

We may collect the following information categories (as permitted by law):

• Contact information (name, phone, email, address, insurance info).
• Account credentials.
• Demographic, financial, transaction, device, and preference data.
• Online activity data: cookies, beacons, analytics tools.
• Government identifiers (as required for payment or legal compliance).
• Any other information you provide.

Third-party analytics tools (such as Google Analytics, LinkedIn, and WebMD) may collect data via cookies or other technologies.

5. Exclusions (Virginia Consumer Protection Act)

Certain information—like HIPAA-covered health information, public records, or data regulated by other laws—is excluded from VCPA protections. Please review our Notice of Privacy Practices for details on PHI privacy.

6. How We Collect Information

• Directly from you (forms, patient portal, communications)
• Automatically (cookies, web beacons, analytics, tracking technologies)
• Through social media integrations or third-party platforms

7. Cookies & Tracking Technologies

We use:

• Strictly necessary cookies for security and core functionality.
• Functional/performance cookies for usability and analytics.
• Marketing/personalization cookies for targeted content and advertising.
• Third-party cookies from embedded services.

You may manage cookies through our Cookie Consent Tool or browser settings. Disabling cookies may affect site functionality.

8. How We Use Your Information

Information is used to:

• Present and improve our website and services
• Fulfill service and inquiry requests
• Process payments and transactions
• Administer accounts
• Communicate service updates, alerts, and marketing (with consent where required)
• Conduct analytics, research, and audience measurement
• Maintain safety and security
• Meet legal, contractual, and compliance obligations

We may aggregate, de-identify, or anonymize data as permitted.

9. Data Retention

We retain personal information only as needed for the purposes described and as required by law. Data is securely disposed of when no longer necessary per our data retention/deletion protocols.

IV. Personal Information Sharing, Consumer Rights, and Communications

1. Personal Information Sharing

We may share personal information:

• With subsidiaries, affiliates, and contracted service providers for business and patient care purposes.
• To a purchaser or successor in corporate transactions.
• To fulfill the purpose for which you provided it, or as disclosed at collection.
• With your consent.
• In response to lawful requests, court orders, subpoenas, or regulatory requirements.
• When necessary to protect the rights, property, or safety of The Chouraeshkenazi Group, our customers, or others.

We do not sell personal information, including de-identified health information, to third parties.

2. Choices About Use and Disclosure

• Cookies/Tracking: You may refuse cookies, but this may limit site functionality.
• Marketing: By using our site, you consent to marketing communications. Opt out at any time by responding to emails or using unsubscribe options.
• Phone/Email Contact: By providing contact information, you consent to communications for healthcare, billing, or education. Appointment/delivery/billing communications are not subject to marketing opt-out.
• SMS Text: Patients may opt in for text messages about care, reminders, portal access, and health management. Participation is voluntary and does not affect care.

3. Linked Websites/Third-Party Services

We are not responsible for the privacy policies or data handling of third-party sites linked from our website. Please review their privacy notices before providing data. You can also opt out of targeted advertising via industry initiatives, such as the Network Advertising Initiative.

4. Data Security

We use administrative, physical, and technical safeguards to protect personal information. You share responsibility for securing your passwords and credentials. No internet transmission is completely secure.

5. Consumer Privacy Rights (Virginia and Other State Law)

You may exercise the following rights, subject to legal exceptions:

• Right to Know (collection, sources, purposes, recipients)
• Right to Data Portability
• Right to Correct Inaccurate Information
• Right to Delete (with certain exceptions, e.g., to fulfill law, prevent fraud, ensure security)
• Right to Limit or Opt-Out of Sales/Sharing

We verify identity before processing requests and respond as required by law (10-day acknowledgment, response within 45–90 days). We will not discriminate for exercising rights.

6. Exercising Your Rights

Submit requests by:

• Written communication: Privacy Officer, The Chouraeshkenazi Group, 8609 Westwood Center Drive, Suite 110, Tysons Corner, VA 22182
• Online Feedback Form
• For VA residents, via authorized agent (proof may be required)

No account is required. Password-protected account access is considered sufficiently verified.

7. Mobile SMS/Text Terms

By providing your mobile number and opting in:

• You consent to healthcare, operational, and promotional SMS messages as described in Mobile Terms & Conditions.
• Message/data charges may apply. Frequency will vary.
• Opt out at any time by replying STOP. Texts may contain health information and are not guaranteed to be secure.
• You must be at least 18 to participate.

We may revise terms without notice. See current Mobile Terms posted on our website. If you have questions, email info@thechouraeshkenazigroup.com.

Changes to This Policy

We may revise this Policy from time to time. The most recent revision date is posted at the top. Continued use after changes constitutes acceptance.

VI. Contact Information

Privacy Officer
The Chouraeshkenazi Group
8609 Westwood Center Drive 110
Tysons Corner, VA 22182
Email/SMS Opt Out/Questions: info@thechouraeshkenazigroup.com
Online: [Feedback Form Link]

For complaints about PHI privacy:
HHS Office for Civil Rights

• Web: https://ocrportal.hhs.gov/ocr
• Email: ocrprivacy@hhs.gov
• Phone: (800) 368-1019 (TDD: 800-537-7697)

In Emergencies:

• For medical emergencies, dial 911.
• For mental health crisis, dial 988 (Suicide & Crisis Lifeline).