HIPAA Notice of Privacy Practices

Effective date: 10/05/2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Who this notice covers

This notice describes the privacy practices of Lifebulb LLC and its workforce when providing or supporting your care. It covers protected health information in electronic, paper, spoken, and other forms. Protected health information is identifiable information about your health, your health care, or payment for your health care.Lifebulb provides outpatient mental health therapy in New Jersey, Virginia, Pennsylvania, Delaware, Georgia, Texas, and Massachusetts, and psychiatry and medication management in New Jersey, Virginia, and Pennsylvania. Care is provided through telehealth and, where available, in person. Substance-use-related care is provided through talk therapy.This notice explains our legal duties and your choices. It is not your consent to treatment, your consent to receive texts, or an authorization to disclose information for a purpose that requires separate written permission.

Our responsibilities

We are required by law to protect the privacy of your protected health information, give you notice of our legal duties and privacy practices, and follow the notice currently in effect. We must notify affected individuals following a breach of unsecured protected health information as required by law.The uses and disclosures described below are subject to all applicable legal conditions. When state law, professional confidentiality rules, or federal substance-use-record protections impose stricter limits, we follow those limits. General HIPAA permission does not override a more protective law.

Uses and disclosures for care and administration

Treatment. We may use information to assess your needs, provide therapy or psychiatric care, coordinate services, and communicate with other treating professionals as permitted by law. For example, your therapist and prescribing clinician may share information needed to coordinate your treatment. We obtain additional consent when required by applicable confidentiality law.Payment. We may use and disclose information needed to obtain payment for care. For example, we may send your health plan information about a visit and diagnosis so it can determine coverage and process a claim. We follow any legally required limits on disclosure and any restriction we must honor for a service paid in full out of pocket.Health care operations. We may use and disclose information to administer the practice, evaluate quality, supervise clinicians, conduct appropriate training, review compliance, and maintain secure systems. For example, a clinical supervisor may review records to help assess the quality of care.Service providers. Vendors that perform functions involving protected health information for us, such as patient-record hosting, billing, or telehealth support, must have the safeguards and business-associate arrangements required by law. A business-associate agreement does not permit uses that the law otherwise prohibits.Communications about care. We may contact you about appointments, care coordination, treatment alternatives, and health-related services where permitted. You may request a reasonable alternative contact method or location. Ordinary emails and texts can be visible to people with access to your device or account; ask about the patient portal or another appropriate channel for sensitive information.

People involved in your care

Where the law permits, we may share information directly relevant to a family member’s, friend’s, or other identified person’s involvement in your care or payment when you agree, have an opportunity to object and do not, or the circumstances reasonably indicate your agreement.If you cannot express your wishes, we may use professional judgment to make a permitted disclosure in your best interests. Disaster-relief notifications may also be permitted. These provisions do not eliminate consent requirements for specially protected records.A legally authorized personal representative may exercise rights on your behalf after we verify that authority. Different rules can apply to minors, services to which a minor may consent, custody arrangements, and situations involving abuse, neglect, or endangerment. A parent’s or other person’s access is determined under applicable law, not solely by who pays for care.

Other uses and disclosures permitted or required by law

The following categories apply only when the legal conditions for disclosure are met, including any stricter mental health, privilege, or Part 2 requirements:Public health and safety. We may make legally authorized reports concerning communicable diseases, product recalls, adverse reactions to medication, or other public health matters; report suspected abuse, neglect, or domestic violence; and make permitted disclosures to prevent or lessen a serious and imminent threat. The recipient and information disclosed must satisfy the applicable law.Health oversight. We may provide information for authorized audits, licensing matters, inspections, investigations, and other oversight of health care or benefit programs.Legal requirements and proceedings. We disclose information when law requires it and may respond to a valid court or administrative order or other lawful process when the applicable privacy and privilege conditions are met. A subpoena alone does not always permit release. The Part 2 limitations below apply to covered substance-use records and testimony about them.Law enforcement. Limited disclosures may be allowed for specified purposes, such as a legally required report, a qualifying request concerning a crime, or a crime on our premises. We do not release all records merely because a law-enforcement official requests them.Workers’ compensation and special government functions. We may make disclosures permitted by workers’ compensation law or for legally authorized military, national-security, protective-service, or correctional purposes, subject to applicable restrictions.Research. Information may be used or disclosed for research only with your authorization or a legally permitted alternative, such as an approved waiver and the required safeguards.After death and donation. Legally permitted disclosures may be made to coroners, medical examiners, funeral directors, and organ or tissue procurement organizations.Privacy enforcement and access. We must provide information to you when the access rules require it and to the U.S. Department of Health and Human Services when required to evaluate compliance.

Special protections for mental health and other sensitive records

Psychotherapy notes. Separately maintained notes analyzing the content of counseling conversations receive special protection. Most uses and disclosures require your written authorization, subject to narrow exceptions permitted by law. These notes are different from routine progress notes, diagnosis, medication information, and treatment plans.State confidentiality and privilege. Depending on your clinician’s profession, the type of record, and the law governing your care, written consent may be required before disclosing mental health communications or records even when HIPAA alone would permit disclosure. Exceptions, such as mandatory reporting, specified treatment disclosures, threats of serious harm, and qualifying legal orders, are limited by the applicable law.For example, New Jersey professional counseling rules restrict disclosure of confidential client information; Virginia provides additional rules for psychotherapy notes; Pennsylvania protects privileged treatment communications; Delaware and Georgia recognize protections for confidential mental health professional-client communications; Texas restricts disclosure of mental health communications and records to authorized circumstances; and Massachusetts imposes mental health confidentiality and privilege protections. These protections can limit disclosures to family members, insurers, other providers, employers, or parties in a legal proceeding. We obtain written permission when required and do not treat this notice as a waiver of privilege.Other sensitive information. Additional requirements may apply to HIV-related information, genetic information, a minor’s confidential services, and other protected categories. We apply the additional consent or disclosure limits when they govern your records.

Substance use disorder records protected by 42 CFR Part 2

Some substance use disorder records are protected by a federal law called 42 CFR Part 2. Its protections can apply to records received from a Part 2 program even when the receiving provider is not itself a Part 2 program. Not every mention of substance use in a medical record is automatically a Part 2 record.When we hold Part 2 records, we use and disclose them only as Part 2 permits. Where required, we obtain written consent before a use or disclosure. If we receive records under a valid consent covering treatment, payment, and health care operations, HIPAA may permit certain further uses and disclosures, but Part 2’s restrictions on proceedings against you and any stricter applicable law continue to apply.We will not use or disclose Part 2 records, or testimony describing their contents, in civil, criminal, administrative, or legislative investigations or proceedings against you without your qualifying written consent or a qualifying Part 2 court order. For the court-order route, you or the record holder must receive the notice and opportunity to be heard required by Part 2, and an order authorizing disclosure must be accompanied by a subpoena or other legal requirement compelling disclosure. A general consent to treatment, payment, and health care operations does not authorize use in proceedings against you.A separate consent is required for uses or disclosures of substance use disorder counseling notes when Part 2 requires it. Those specially protected notes are distinct from the ordinary treatment record.

Uses requiring your authorization

We obtain a valid written authorization for uses and disclosures that HIPAA requires to be authorized, including most uses and disclosures of psychotherapy notes, marketing requiring authorization, and disclosures that constitute a sale of protected health information. We also obtain consent or authorization when another applicable law requires it.Other uses and disclosures not described in this notice will be made only with your written authorization. You may revoke an authorization by contacting the Privacy Officer in writing. Revocation applies going forward, subject to actions already taken in reliance on it and other exceptions permitted by law.If we conduct fundraising using information that the law allows us to use for that purpose, you may opt out of fundraising communications. If Part 2 records would be used or disclosed for fundraising, we first provide a clear, conspicuous opportunity to decline those communications. Your choice will not affect treatment or payment.

Your rights and how to exercise them

Contact the Privacy Officer using the details below. We may ask you to put a request in writing and verify your identity or your representative’s authority. We will help you understand the process and will apply any more protective state requirements.Access and copies. You may ask to inspect or obtain an electronic or paper copy of the medical and billing records, and other records used to make decisions about you, that the law makes available. Tell us the records and format you want. We generally act within 30 days under HIPAA, sooner when another law requires, and explain any legally permitted extension. Any charge must comply with applicable law and HIPAA’s reasonable, cost-based limits. Certain records, including separately maintained psychotherapy notes, are excluded from HIPAA’s access right. If we deny access, we explain why and any available review rights.Corrections. You may request an amendment to information you believe is incorrect or incomplete and explain the reason. We generally act within 60 days under HIPAA, subject to permitted extensions or shorter applicable deadlines. We may deny a request for a legally permitted reason, but we will explain the decision and your right to submit a statement of disagreement.Confidential contact. You may ask us to communicate in a particular way or at a different location, such as using a different telephone number or mailing address. We accommodate reasonable requests and do not require you to explain the reason.Restrictions. You may ask us to limit uses or disclosures for treatment, payment, or operations, or disclosures to people involved in your care. We are not generally required to agree. However, when you or someone on your behalf pays for an item or service in full out of pocket, we must honor a request not to disclose information solely about that item or service to your health plan for payment or health care operations, unless the disclosure is required by law. Make the request before the information is submitted to the plan.Accounting of disclosures. You may request a list of disclosures for the preceding six years, or a shorter period you specify, that must be included under applicable accounting rules. The HIPAA list generally excludes disclosures for treatment, payment, and operations, disclosures made with your authorization, and certain other disclosures. The first accounting in a 12-month period is free. We will explain any permitted charge for an additional request and let you withdraw or narrow it.A copy of this notice. You may request a paper copy without charge even if you previously accepted an electronic copy.A representative and complaints. You may have a legally authorized representative exercise rights where permitted and may complain directly to us or to a regulator. We will not retaliate for making a complaint or exercising privacy rights.

Questions and complaints

Lifebulb LLC — Privacy OfficerEmail: privacy@lifebulb.comTelephone: 855-722-4422Mail: 505 Main Street, Toms River, NJ 08753You may submit a privacy complaint to us by email, telephone, or mail. Please describe your concern and a safe way to contact you. We can arrange a suitable channel for sensitive details.You may also complain directly to the U.S. Department of Health and Human Services, Office for Civil Rights. Use the HHS privacy complaint instructions, call 1-877-696-6775, or write to 200 Independence Avenue, S.W., Washington, D.C. 20201. You do not need our permission or have to complain to us first.