Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Effective date: October 22, 2026

Epione Beverly Hills (“Epione,” “the Practice,” “we,” “us”) is required by law to protect the privacy of your health information and to give you this notice of our legal duties and privacy practices. This notice explains how we may use and share your protected health information (“PHI”), meaning information that identifies you and relates to your past, present, or future health, the care you receive, or payment for that care. It also explains your rights and how to use them. Clinical photographs, consultation notes, treatment records, and billing records are all PHI.

Federal law (the Health Insurance Portability and Accountability Act, or HIPAA) sets a floor for protecting your information. Where California law gives you more protection, including the Confidentiality of Medical Information Act (California Civil Code section 56 and following) and the California Health and Safety Code, we follow the more protective law.

This notice applies to Epione Beverly Hills at 444 North Camden Drive, Beverly Hills, CA 90210, including Simon Ourian, M.D., and all of the physicians, nurses, medical staff, front-office team members, and trainees who provide or support your care, whether you see us in person, by phone, by text, or through a virtual consultation. It also applies to health information you share with us through our website forms, booking tools, and patient communications.

This notice does not cover information you share on social media platforms, review sites, or other websites that we do not control. Information you share on this website that is not health information is described in our Privacy Policy, and our use of cookies is described in our Cookie Policy. If this notice and the Privacy Policy ever conflict about your health information, this notice controls.

We are required by law to maintain the privacy and security of your PHI; to give you this notice of our legal duties and privacy practices; to follow the terms of the notice currently in effect; and to let you know promptly if a breach occurs that may have compromised the privacy or security of your information.

We will not use or share your information other than as described in this notice unless you tell us we can in writing. If you give us permission, you may change your mind at any time by letting us know in writing.

The following categories describe the ways we typically use and share your information. Not every use is listed, but every way we are permitted to use or share information falls within one of these categories.

To treat you. We use your information and share it with other professionals who are treating you. For example, your physician reviews your medical history, medications, allergies, and photographs to plan and perform your treatment, and we may share information with a laboratory, a pharmacy, a referring physician, or another provider involved in your care.

To bill and get payment for your care. We use and share your information to bill and collect for the services we provide. Because most aesthetic treatments are self-pay, this usually means sharing limited information with our payment processor, a patient financing company you choose to use, or, where applicable, your health plan.

To run our practice. We use and share your information to operate the Practice, improve your care, and contact you when necessary. For example, we use information to review the quality and safety of our treatments, train staff, keep clinical photographs in your record to track your progress, manage scheduling, and meet our legal, licensing, and accreditation obligations.

With our business associates. We work with outside companies that perform services for us, such as electronic health record, scheduling, phone, messaging, secure email, payment, accounting, information technology, and legal services. These companies may receive your information only as needed to do their work, and they are required by contract and by law to protect it.

Appointment reminders, treatment information, and care communications. We may contact you by phone, text message, email, or mail to confirm appointments, send pre- and post-treatment instructions, follow up on your results, or tell you about treatment options or health-related services that may interest you. You may ask us to contact you only in a particular way or at a particular number or address. Standard text and email are not fully secure; if you prefer that we not use them, tell our office and we will use another method.

People involved in your care. Unless you object, we may share information with a family member, friend, or other person you identify who is involved in your care or in paying for it, limited to what is relevant to that person’s involvement. If you are not present or are unable to agree, for example in an emergency, we may share information if we believe it is in your best interest. We may also share information with a disaster relief organization so that your family can be notified about your condition and location.

We are allowed or required to share your information in the following ways, usually in ways that contribute to the public good, such as public health and research. We must meet many conditions in the law before we can share your information for these purposes, and we share only the minimum necessary.

As required by law. We will share information when federal, state, or local law requires it, including with the U.S. Department of Health and Human Services if it wants to confirm that we are complying with federal privacy law.

Public health and safety. We may share information to prevent or control disease, injury, or disability; to report adverse reactions to medications, devices, or cosmetic products to the U.S. Food and Drug Administration or a manufacturer; to help with product recalls; to report suspected abuse, neglect, or domestic violence; and to prevent or reduce a serious and imminent threat to anyone’s health or safety.

Health oversight. We may share information with agencies that oversee the health care system, such as the Medical Board of California, for audits, investigations, inspections, and licensure.

Lawsuits and legal actions. We may share information in response to a court or administrative order, or in response to a subpoena or other lawful process when the requirements of federal and California law are met.

Law enforcement. We may share information with a law enforcement official as required or permitted by law, for example to comply with a court order or warrant, to identify or locate a suspect or missing person, or to report a crime on our premises. Under California law, we will not share information related to an abortion or other reproductive health care with out-of-state law enforcement, or in response to an out-of-state subpoena, in connection with an inquiry into care that is lawful in California.

Coroners, medical examiners, and funeral directors. We may share information with these officials when an individual dies, as permitted by law.

Organ and tissue donation. We may share information with organ procurement organizations.

Research. We may use or share information for research only when an institutional review board or privacy board has approved the research and established protections for your information, or when you have given written authorization.

Workers’ compensation. We may share information as authorized by workers’ compensation laws or similar programs.

Specialized government functions. We may share information for military, national security, and presidential protective services, and with correctional institutions or law enforcement officials having lawful custody of an individual, as permitted by law.

We will ask for your written authorization before we use or share your information in the following ways:

Marketing. We will not use or share your information for marketing, or receive payment from anyone in exchange for communicating with you about their products or services, without your written authorization. Face-to-face conversations with you, and promotional gifts of nominal value, are not marketing under the law.

Sale of your information. We will never sell your health information. Any sale would require your written authorization.

Photographs, videos, and testimonials. Clinical photographs taken for your medical record are part of your treatment. We will never use your photographs, videos, name, likeness, or story on our website, social media, advertising, or any other public material without a separate written authorization that you sign. You may revoke that authorization at any time, and we will stop future uses, although we cannot recall materials that were already published or distributed.

Psychotherapy notes, HIV test results, and genetic information. Most uses and disclosures of psychotherapy notes, the results of an HIV test, and genetic test information require your specific written authorization under federal and California law.

Any other use not described in this notice. Other uses and disclosures will be made only with your written authorization. You may revoke an authorization at any time by giving us written notice, except to the extent we have already acted in reliance on it.

When you request an appointment, complete a form, or book a virtual consultation, the information you provide becomes part of your patient record and is protected under this notice. Virtual consultations are conducted on platforms that meet our privacy and security requirements.

We do not share your health information, or the content of the forms you submit, with advertising platforms or social media companies. Analytics and advertising technologies on our website are loaded only with your consent through the cookie banner, and you can change your choices at any time. We honor Global Privacy Control signals.

We will never confirm or discuss that someone is our patient, or share any information about their care, when we reply to an online review or a social media comment.

When it comes to your health information, you have certain rights. To exercise any of them, contact our Privacy Officer using the information at the end of this notice. Some requests must be made in writing, and we will help you with the form.

Get a copy of your medical record. You may inspect or get a paper or electronic copy of your medical and billing records, including your photographs. You may also ask us to send a copy directly to another person you designate. Under California law, we will let you inspect your records within five working days of your request and will provide copies within 15 days. We may charge a reasonable, cost-based fee as allowed by federal and California law, and we will not withhold records because of an unpaid bill. In limited circumstances we may deny access; if we do, we will tell you why in writing and explain how to have the decision reviewed.

Ask us to correct your record. If you believe information in your record is incorrect or incomplete, you may ask us to amend it. We will respond within 60 days. If we deny your request, we will explain why in writing, and you may submit a statement of disagreement. Under California law, you may also add a written addendum of up to 250 words about any item you believe is incomplete or incorrect, and we will attach it to your record.

Request confidential communications. You may ask us to contact you in a specific way (for example, only on your mobile phone) or at a different address. We will agree to all reasonable requests and will not ask why.

Ask us to limit what we use or share. You may ask us not to use or share certain information for treatment, payment, or our operations. We are not required to agree, and we may say no if it would affect your care. If you pay for a service or item out of pocket in full, you may ask us not to share that information with your health plan for payment or operations, and we will agree unless a law requires us to share it.

Get a list of those with whom we have shared your information. You may ask for an accounting of the times we have shared your information for six years before the date you ask, who we shared it with, and why. The list will include all disclosures except those for treatment, payment, and operations, and certain others such as those you asked us to make. We will provide one accounting a year free of charge and may charge a reasonable, cost-based fee if you ask for another within 12 months.

Get a copy of this notice. You may ask for a paper copy of this notice at any time, even if you have agreed to receive it electronically. It is also posted in our office and at www.epionebh.com/notice-of-privacy-practices.

Choose someone to act for you. If you have given someone medical power of attorney, or if someone is your legal guardian, that person can exercise your rights and make choices about your health information. We will confirm the person has this authority before we take any action.

Be notified of a breach. We will notify you if a breach of your unsecured health information occurs, as required by federal and California law.

File a complaint if you feel your rights are violated. See “Questions and complaints” below.

Our services are generally intended for adults. When a minor receives care, a parent or guardian usually acts as the minor’s personal representative. Where California law allows a minor to consent to certain care on their own, the minor controls the information about that care, and we will not share it with a parent or guardian without the minor’s authorization, except as the law allows.

We do not use or share your health information for fundraising. If that ever changes, we will update this notice first, and you would have the right to opt out of any fundraising communication.

We may change the terms of this notice, and the changes will apply to all information we have about you, including information created or received before the change. The new notice will be available on request, in our office, and on our website, with the effective date at the top.

If you have questions about this notice, want to exercise any of your rights, or believe your privacy rights have been violated, please contact our Privacy Officer: Privacy Officer, Epione Beverly Hills, 444 North Camden Drive, Beverly Hills, CA 90210; phone 310.651.6267; email info@epione.com.

You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, online at ocrportal.hhs.gov, by email at OCRComplaint@hhs.gov, by phone at 1-877-696-6775, or by mail at Centralized Case Management Operations, U.S. Department of Health and Human Services, 200 Independence Avenue S.W., Room 509F HHH Bldg., Washington, D.C. 20201. Complaints to the Office for Civil Rights generally must be filed within 180 days of when you knew of the problem. More information is available at www.hhs.gov/hipaa/filing-a-complaint.

We will not retaliate against you in any way for filing a complaint.

Will you post my before-and-after photos? Only if you sign a separate written authorization that says exactly where they may appear. Declining has no effect on your care, and you can revoke your permission later.

Do you share my information with advertisers or social media companies? No. We do not share your health information or form submissions with advertising platforms, and we will never sell your information.

How do I get a copy of my records or photos? Contact our office. We will let you inspect your records within five working days and provide copies within 15 days, electronically if you prefer.

Can I ask you not to text or email me? Yes. Tell our office how you would like to be contacted and we will follow your request.

Will you tell anyone I am a patient? Not without your permission, except as described in this notice. We do not confirm patient relationships in response to reviews, social media comments, or calls from people you have not authorized.

Do I have to sign anything? At your first visit we will ask you to sign an acknowledgment that you received this notice. Signing is not a condition of treatment.