brush365 Notice of Privacy Practices

Effective/Last Revised: February 16, 2026

Introduction

This Notice of Privacy Practices (“Notice“) describes how brush365 and its affiliates (“we,” “us,” “our,” or “brush365“) create, receive, maintain, and use your health information, and what rights and protections you have regarding that information.

Please read this Notice carefully. This Notice applies to health information created, received, or maintained by brush365 in connection with the health care services we provide to you. We are required by law to:

• Maintain the privacy and security of your health information
• Provide you with this Notice describing our privacy practices
• Notify you if a breach of your unencrypted health information occurs
• Follow the privacy practices outlined in this Notice

Some of your health information may be protected by additional federal law (42 C.F.R. Part 2) if it relates to diagnosis, treatment, or referral for treatment of substance use disorder. These records have extra privacy protections beyond HIPAA, which are described in this Notice.

Our Privacy Responsibilities

We understand that your health information is personal and sensitive, and we are committed to protecting it. brush365 is required by federal and state law to maintain the privacy of health information that individually identifies you. This Notice describes the types of health information we maintain, how we may use and disclose that information, and the rights you have regarding your health information.

brush365 complies with:

• The Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its Privacy Rule
• 42 C.F.R. Part 2 regulations governing substance use disorder records
• Texas Health & Safety Code Chapter 181 (HB 300) and other applicable Texas privacy laws

If we change the terms of this Notice, we will notify you of the changes and will provide an updated Notice. We will post the revised Notice in our office(s) and on our website (www.brush365dental.com), and any changes will apply to all health information we maintain.

How We Collect and Maintain Your Health Information

brush365 collects and maintains health information about you in order to:

• Provide you with dental and health care services
• Bill for services and process insurance claims
• Obtain payment from your insurance company or other responsible parties
• Conduct health care operations including quality improvement, training, and business management
• Comply with legal and regulatory requirements

Health information we collect includes your medical and dental history, examination findings, clinical notes, laboratory results, X-rays, insurance information, payment information, and any other information you provide to us.

How We May Use and Disclose Your Health Information

For Treatment

We use your health information to diagnose your condition, provide treatment, arrange for specialized care, and coordinate care with other health care providers. For example, we may disclose information to a specialist you are being referred to, or to another provider involved in your care.

For Payment

We use and disclose your health information to obtain payment for dental services we provide to you. This includes:

• Submitting claims to your dental insurance plan or other health insurance plans
• Billing you for services not covered by insurance
• Collecting payment from you or your insurance company
• Determining eligibility for benefits
• Managing claims, appeals, and disputes with insurers

For Health Care Operations

We use and disclose your health information to support our business operations, including:

• Quality assessment and performance improvement
• Training dental students and staff
• Accreditation and licensing
• Peer review and credentialing
• Compliance with legal and regulatory requirements
• Facility planning and management
• Cost management and business operations

Substance Use Disorder (SUD) Records

If your health information includes records related to the diagnosis, treatment, or referral for treatment of substance use disorder, those records are protected by 42 C.F.R. Part 2 (federal regulation governing SUD information). Part 2 provides additional and more stringent privacy protections than HIPAA.

Use and Disclosure for Treatment, Payment, and Operations: Unlike other health information, Part 2 generally requires your written consent before brush365 may use or disclose SUD records for treatment, payment, or health care operations, even though these uses and disclosures would normally be permissible under HIPAA without your consent. You may provide a single written consent that authorizes brush365 to use and disclose your SUD records for all treatment, payment, and health care operations purposes for a specified period of time.

Restrictions on Legal Proceedings: SUD records or testimony relaying the content of such records shall not be used or disclosed in civil, criminal, administrative, or legislative proceedings against you, unless you provide written consent or a court order is obtained that meets the requirements of 42 C.F.R. Part 2. A court order authorizing use or disclosure must be accompanied by a subpoena or other legal requirement compelling disclosure, and you must be provided notice and opportunity to be heard before disclosure occurs.

Your Consent and Revocation Rights: You may provide a written consent authorizing brush365 to use and disclose your SUD records for treatment, payment, and health care operations. This consent may be revoked at any time in writing, except that revocation will not affect uses or disclosures that occurred before we received your written revocation request.

Additional SUD Protections: SUD information is more sensitive and restricted than other health information. brush365 will not disclose your SUD records to law enforcement, attorneys, or other third parties for purposes of investigation, prosecution, or civil proceedings unless you have specifically authorized such disclosure in writing or a court has ordered disclosure consistent with Part 2.

Other Uses and Disclosures

Redisclosure of Information

Information disclosed from your health record may be subject to redisclosure by the recipient and may no longer be protected by HIPAA or 42 C.F.R. Part 2. For this reason, you should be cautious about requesting that we disclose your health information to third parties. Once information is disclosed by brush365, we have no control over how the recipient uses or further discloses that information.

When Authorization Is Required

Except as described in this Notice, we will not use or disclose your health information without your written authorization. If we use or disclose your information for a purpose other than those described above, we will obtain your specific written authorization first.

Uses and Disclosures with Your Authorization

You may authorize us to use and disclose your health information for any purpose you specify. Any authorization you provide must be in writing. You may revoke your authorization at any time by submitting a written revocation request to our Privacy Officer (contact information below).

Fundraising

If brush365 intends to contact you for fundraising purposes, we will first provide you with a clear and conspicuous opportunity to elect not to receive such fundraising communications. Fundraising communications will not include your health information; they may only include demographic information (such as your name and contact information) and information that reflects the type of health care we provide.

Additional Permitted Uses and Disclosures (without your authorization)

We may use and disclose your health information without your authorization in the following circumstances:

• Public Health Activities: To public health authorities for disease reporting, public health surveillance, or public health investigation
• Health Oversight Activities: To health agencies for licensing, credentialing, audits, and investigations
• Judicial and Administrative Proceedings: When required by law, court order, subpoena, or other legal process (consistent with Part 2 protections for SUD records)
• Law Enforcement: When required by law enforcement officials, consistent with Part 2 protections
• Organ and Tissue Donation: To organizations engaged in procurement, banking, and transplantation of organs and tissues
• Workers’ Compensation: As required by workers’ compensation laws
• Communicable Disease Control: To prevent or control disease, injury, or disability
• Abuse, Neglect, Domestic Violence, or Exploitation: To appropriate agencies when required or authorized by law
• Serious Threats to Health or Safety: To prevent serious harm to you or others
• Military Personnel: When required by military command authority
• National Security: When authorized by federal law
• Incarcerated Individuals: To correctional institutions or law enforcement when you are an inmate

Reproductive Health Information

brush365 will not use or disclose your health information for the purpose of investigating or imposing liability on you for seeking, obtaining, providing, or facilitating lawful reproductive health care. When we receive requests for your health information that may relate to reproductive health care, we may require additional assurances from the requestor (such as written certification that the information is not being sought for a prohibited investigation or proceeding) before using or disclosing that information.

Your Privacy Rights

You have the following rights with respect to your health information:

Right to Access, Inspect, and Obtain Copies

You have the right to inspect and obtain a copy of your health information, including SUD records, subject to certain legal limits. To request access to your health information, contact our Privacy Officer at the address, telephone number, or email address listed below. We will provide access to your health information within 30 days of your request. If we deny access, we will provide you with a written explanation of the reason(s) for the denial and information about how you may appeal the denial.

Right to Request Amendments

You have the right to request that we amend or add to your health information if you believe it is inaccurate or incomplete. To request an amendment, submit your request in writing to our Privacy Officer. We will respond to your amendment request within 60 days. If we deny your request, we will provide a written explanation of the reason(s) for the denial.

Right to Request Restrictions

You have the right to request restrictions on the use and disclosure of your health information, including SUD records. However, we are not required to agree to a restriction unless it is required by law. To request a restriction, submit your request in writing to our Privacy Officer, specifying what information should be restricted and how it should be restricted. If we agree to your restriction request, we will honor that restriction unless it involves an emergency situation.

Right to Request Confidential Communications

You have the right to request that we communicate with you about your health information by alternative means or at alternative locations. For example, you may request that we send bills and other communications to a different address or telephone number. To request confidential communications, submit your request in writing to our Privacy Officer.

Right to Receive Notice of Breaches

You have the right to be notified if there is a breach of the security or privacy of your unencrypted health information. We will notify you of any breach without unreasonable delay and no later than 60 calendar days after discovery of the breach.

Right to an Accounting of Disclosures

You have the right to request an accounting (list) of disclosures of your health information made by brush365, including disclosures of SUD records that require accounting under Part 2. The accounting will not include certain routine disclosures such as those made for treatment, payment, and health care operations (unless required by law), or disclosures made with your authorization. To request an accounting of disclosures, submit your request in writing to our Privacy Officer. We will provide the accounting within 30 days of your request.

Right to a Paper or Electronic Copy

You have the right to request and obtain a paper or electronic copy of your health information. We may charge a reasonable fee for copying, mailing, and other labor costs associated with your request.

Right to Revoke Authorization

You may revoke any authorization you have given to brush365, including authorizations for SUD records, at any time by submitting a written revocation request to our Privacy Officer. Your revocation will not be effective for uses or disclosures that occurred before we received your revocation request.

Our Privacy Safeguards

brush365 is committed to protecting your health information through reasonable administrative, physical, and technical safeguards. These safeguards include:

• Restricted access to health information based on job duties
• Secure storage of physical records
• Encryption of electronic health information
• Secure authentication and access controls for computer systems
• Regular training of staff on privacy and security
• Policies and procedures to prevent unauthorized use and disclosure
• Incident response procedures for potential security breaches

Complaints

If you believe that brush365 has violated your privacy rights, you have the right to file a complaint. You may file a complaint with:

1. brush365
   Contact our Privacy Officer:

• Name: Michelle Field, Vice President of Operations
• Address: 800 Forest Oaks Lane. Ste. A  Hurst, TX 76053
• Telephone: 817-770-0272
• Email: compliance@brush365dental.com

We will not retaliate against you for filing a complaint. All complaints will be handled promptly and confidentially.

2. U.S. Department of Health and Human Services (HHS)
   Office for Civil Rights (OCR)
   Individuals may file a complaint with the HHS Office for Civil Rights if they believe a covered entity has violated their HIPAA privacy rights. Complaints must be filed in writing and may be submitted electronically or by mail:

• Website: https://ocrportal.hhs.gov/ocr/cp/complaint_frontpage.jsf
• Mail: Office for Civil Rights, U.S. Department of Health and Human Services, 200 Independence Avenue SW, Washington, DC 20201

3. Texas Attorney General
   Because brush365 is located in Texas and complies with Texas Health & Safety Code Chapter 181 (HB 300), you may also file a complaint with the Texas Attorney General regarding violations of Texas privacy law:

• Website: https://www.texasattorneygeneral.gov/
• Telephone: (512) 463-2100

Additional Information

Your Rights Are Not Affected

The privacy protections described in this Notice do not limit any other rights you may have under federal or state law. For example, you may have additional rights under Texas state privacy law.

Contact Information

If you have questions about this Notice or brush365’s privacy practices, please contact our Privacy Officer at:

• Name: Michelle Field, Vice President of Operations
• Address: Address: 800 Forest Oaks Lane. Ste. A  Hurst, TX 76053
• Telephone: 817-770-0272
• Email: compliance@brush365dental.com

 

Effective Date

This Notice is effective as of February 16, 2026, and applies to all health information created, received, maintained, or used by brush365 on or after this date.

Acknowledgment

I acknowledge that I have received and reviewed brush365’s Notice of Privacy Practices.

Client Name (Print): ________________________________

Client Signature: ________________________________

Date: ________________________________

This Notice has been prepared in compliance with the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule (45 C.F.R. Part 164), 42 C.F.R. Part 2 (Confidentiality of Substance Use Disorder Patient Records), and Texas Health & Safety Code Chapter 181 (HB 300).

Last Updated: January 2026