NOTICE OF PRIVACY PRACTICES

Moonstone Medical Spa
Allura Medical Spa LLC
DBA Moonstone Medical Spa

Effective Date: October 16, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Our Commitment to Your Privacy

At Moonstone Medical Spa, we respect your privacy and are committed to protecting your personal health information.

Allura Medical Spa LLC is a healthcare provider subject to the Health Insurance Portability and Accountability Act of 1996 (HIPAA), as amended, and applicable Oregon privacy laws.

This Notice of Privacy Practices describes how we may use and disclose your protected health information (PHI), your rights regarding that information, and our legal responsibilities.

This notice applies to the medical information maintained by Moonstone Medical Spa, including information related to medical aesthetics, injectable treatments, medical weight management, hormone optimization, consultations, and other healthcare services.

1. Your Rights Regarding Your Health Information

You have the following rights regarding your protected health information.

Request Access to Your Medical Records

You have the right to inspect and obtain a copy of your medical records and other protected health information maintained in a designated record set, subject to limited legal exceptions.

  • You may request an electronic or paper copy of your records.

  • We generally must respond within 30 days.

  • If additional time is permitted and necessary, we will provide an explanation of the delay.

  • We may charge a reasonable, cost-based fee permitted by law.

Request Corrections to Your Records

You may request that we amend medical information you believe is incorrect or incomplete.

We may deny certain requests as permitted by law but will provide a written explanation and information about your rights to disagree with the denial.

Request Confidential Communications

You may request that we communicate with you in a specific way or at a specific location.

For example, you may request that appointment communications be sent to a particular telephone number or mailing address.

We will accommodate reasonable requests.

Request Restrictions on Information Sharing

You may request restrictions on certain uses or disclosures of your health information.

We are not required to agree to every requested restriction.

However, when you pay out of pocket in full for a healthcare service or item and request that information about that service or item not be disclosed to your health plan for payment or healthcare operations, we generally must honor that request unless disclosure is required by law.

Request an Accounting of Disclosures

You may request a list of certain disclosures of your protected health information made during the preceding six years.

Certain disclosures, including many made for treatment, payment, and healthcare operations, are excluded from this accounting under applicable law.

Obtain a Copy of This Notice

You may request a paper copy of this Notice of Privacy Practices at any time, even if you previously agreed to receive it electronically.

Designate a Personal Representative

You may authorize another person to act on your behalf regarding your health information.

We will recognize legally authorized personal representatives in accordance with HIPAA and applicable Oregon law.

File a Privacy Complaint

You have the right to file a complaint if you believe your privacy rights have been violated.

You may submit a complaint directly to Moonstone Medical Spa or to the U.S. Department of Health and Human Services Office for Civil Rights.

We will not retaliate against you for filing a complaint or exercising your privacy rights.

2. How We May Use and Disclose Your Health Information

We may use or disclose your protected health information without your written authorization for treatment, payment, healthcare operations, and certain other purposes permitted or required by law.

Treatment

We may use and share your health information to provide, coordinate, or manage your medical care.

Examples include:

  • Reviewing medical history before injectable treatments

  • Evaluating medications and health conditions before weight management treatment

  • Coordinating care with another healthcare provider

  • Documenting clinical findings and treatment responses

  • Reviewing laboratory results related to hormone optimization

Payment

We may use or disclose your health information to obtain payment for healthcare services.

Examples include:

  • Processing payments for medical treatments

  • Managing patient account balances

  • Providing necessary information to a payment-related service provider

  • Submitting information to a health plan when applicable and permitted

Healthcare Operations

We may use or disclose health information to support the operation and management of our practice.

Examples include:

  • Quality assurance and patient safety reviews

  • Staff training and professional oversight

  • Maintaining electronic medical records

  • Practice administration and compliance

  • Auditing and evaluating clinical services

3. Electronic Medical Records and Aesthetic Record

Moonstone Medical Spa uses Aesthetic Record as its electronic medical record and practice management platform.

Aesthetic Record supports practice functions that may include:

  • Appointment scheduling

  • Patient registration and intake

  • Medical history documentation

  • Treatment notes and medical records

  • Electronic consent forms

  • Clinical photography

  • Patient communications

  • Billing and payment management

Your protected health information may be stored, accessed, and processed through Aesthetic Record for legitimate healthcare and practice management purposes.

Aesthetic Record functions as a service provider handling protected health information on behalf of Moonstone Medical Spa. Such services are subject to applicable HIPAA requirements and required business associate arrangements.

Only authorized individuals may access patient information for appropriate purposes.

4. Appointment Reminders and Patient Communications

We may use your contact information to communicate about:

  • Appointment confirmations and reminders

  • Treatment-related follow-up

  • Recommended follow-up appointments

  • Laboratory results and care coordination

  • Information about treatment alternatives or other health-related services

Communications may occur through Aesthetic Record, telephone, text message, email, or other authorized methods.

Standard email and text messaging may not be encrypted.

You may request reasonable alternative methods of communication to help protect your privacy.

We will not use your protected health information for marketing communications requiring HIPAA authorization without obtaining the necessary authorization.

5. Clinical Photography and Treatment Documentation

As part of medical aesthetics services, we may take clinical photographs to document treatment planning, outcomes, and medical care.

Clinical photographs that identify you and are maintained as part of your medical record are protected health information.

We may use these photographs for legitimate treatment and healthcare operations purposes as permitted by law.

Marketing and Social Media

We will obtain appropriate written authorization before using identifiable patient photographs, treatment results, or protected health information for advertising, social media, website galleries, or other promotional purposes.

You may decline marketing authorization without affecting your eligibility for treatment.

You may revoke an authorization in writing, except to the extent we have already acted in reliance on it.

6. Other Uses and Disclosures Permitted or Required by Law

We may use or disclose protected health information without written authorization in certain circumstances permitted or required by federal or Oregon law.

These circumstances may include:

Public Health Activities: Reporting certain diseases, adverse events, or other information to authorized public health agencies.

Health Oversight: Disclosures to authorized agencies responsible for healthcare oversight, licensing, audits, and investigations.

Required by Law: Disclosures necessary to comply with applicable federal or state laws.

Abuse, Neglect, or Domestic Violence: Reporting to authorized agencies when required or permitted by law.

Legal Proceedings: Responding to valid court orders, subpoenas, or other legal processes when applicable legal requirements are satisfied.

Law Enforcement: Providing information in limited circumstances authorized by law.

Serious Threats to Health or Safety: Disclosing information when necessary and legally permitted to prevent or lessen a serious threat.

Workers' Compensation: Disclosing information as authorized by applicable workers' compensation laws.

Coroners, Medical Examiners, and Funeral Directors: Disclosures for legally authorized purposes.

Organ and Tissue Donation: Disclosures to authorized organizations when applicable.

Research: Disclosures for research when permitted under HIPAA and other applicable requirements.

Specialized Government Functions: Disclosures for certain military, national security, or other legally authorized government activities.

Family Members and Others Involved in Your Care: We may share relevant information with family members, close friends, or others involved in your care or payment for care when you agree, have an opportunity to object and do not object, or when otherwise permitted by law and professional judgment.

Where Oregon law provides greater privacy protection than HIPAA, we follow the applicable more protective requirements.

7. Uses and Disclosures Requiring Written Authorization

Certain uses and disclosures of protected health information require your written authorization.

These generally include:

  • Most uses or disclosures for marketing purposes

  • The sale of protected health information

  • Most uses or disclosures of psychotherapy notes, if maintained

  • Uses or disclosures of identifiable clinical photographs for promotional purposes

  • Other uses or disclosures not otherwise permitted or required by law

We do not sell protected health information.

You may revoke a written authorization at any time by submitting a written request, except to the extent action has already been taken in reliance on that authorization.

8. Additional Protections for Certain Substance Use Disorder Records

Certain substance use disorder treatment records are subject to additional federal confidentiality protections under 42 CFR Part 2.

When Moonstone Medical Spa receives or maintains records protected by Part 2, we will handle those records in accordance with applicable federal law.

Part 2 records may be subject to special consent requirements and restrictions on their use or disclosure in civil, criminal, administrative, or legislative proceedings against a patient.

Where permitted by applicable law and patient consent, Part 2 records may be used or disclosed for treatment, payment, and healthcare operations.

Records protected by Part 2 may not be used or disclosed for proceedings against a patient except as authorized by applicable law.

Part 2 records used or disclosed for fundraising purposes, where applicable, are subject to additional requirements, including the right to opt out of fundraising communications.

If Moonstone maintains Part 2 records, additional restrictions may apply beyond those described in this notice.

9. Oregon Healthcare Privacy Protections

Moonstone Medical Spa complies with applicable Oregon laws governing the confidentiality, access, and disclosure of medical information, including Oregon Revised Statutes 192.553 through 192.581 and other applicable healthcare privacy provisions.

Oregon law recognizes an individual's right to have protected health information safeguarded against unlawful use or disclosure and to access and review that information.

We follow applicable Oregon requirements regarding:

  • Medical record confidentiality

  • Patient access to health information

  • Authorization for disclosures

  • Disclosure to family members and other involved individuals

  • Medical information involving minors

  • Legally required reporting and disclosures

Minor Patients

When providing services to minors, we follow applicable Oregon laws governing consent to healthcare and confidentiality of medical information.

Depending on the service and circumstances, a minor may have privacy rights that limit a parent or guardian's access to certain information.

We evaluate such requests according to applicable law.

10. Our Responsibilities

Moonstone Medical Spa is required by law to:

  • Maintain the privacy of protected health information

  • Implement appropriate safeguards to protect health information

  • Provide patients with this Notice of Privacy Practices

  • Follow the terms of the notice currently in effect

  • Notify affected individuals following a breach of unsecured protected health information when required by law

  • Respect applicable patient privacy rights

  • Comply with federal and Oregon healthcare privacy requirements

We will not use or disclose your protected health information in ways not described in this notice unless permitted or required by law or authorized by you in writing.

11. Changes to This Notice

We reserve the right to change our privacy practices and the terms of this notice.

Any revised notice may apply to all protected health information we maintain, including information collected before the revision.

When material changes occur, we will make an updated notice available at our office and on our website.

You may request a current copy at any time.

12. Questions, Requests, and Complaints

If you have questions about this notice, wish to exercise your privacy rights, or believe your privacy rights have been violated, please contact our designated Privacy Officer.

Privacy Officer

Alyssa McNair, FNP-C
Moonstone Medical Spa
Allura Medical Spa LLC

Physical Address:
29975 Harbor Way, Suite A, Rms 1, 2, & 3
Gold Beach, OR 97444

Mailing Address:
PO Box 8
Wedderburn, OR 97491

Text: 541-313-5226

You may also file a complaint with:

U.S. Department of Health and Human Services
Office for Civil Rights

Website: https://www.hhs.gov/ocr/privacy/hipaa/complaints/

We will not retaliate against you for submitting a privacy complaint.

Effective Date: October 16, 2026

© 2026 Allura Medical Spa LLC, DBA Moonstone Medical Spa. All rights reserved.