James Gerard Brewer, M.D., Inc.

NOTICE OF PRIVACY PRACTICES James Gerard Brewer, M.D., Inc.

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

In plain words: this notice explains how we use and share your health information, and what rights you have over it.

Effective date: July 27, 2026

1. OUR COMMITMENT TO YOUR PRIVACY

James Gerard Brewer, M.D., Inc. is required by law to protect your health information ("PHI"). We must give you this notice. We must follow the terms of the notice that is currently in effect. We must notify you if there is a breach of your health information.

PHI means health information that can be tied to you. It includes your past, present, or future health conditions, the care you receive, and how you pay for that care.

2. HOW WE MAY USE AND SHARE YOUR HEALTH INFORMATION

We may use and share your PHI without your written permission in these situations:

A. Treatment. We may use and share your PHI to provide and manage your care. This includes sharing information with other providers, ordering lab tests, and writing prescriptions.

B. Payment. We may use and share your PHI to get paid for your care. This includes checking your insurance, submitting claims, and collecting unpaid balances.

C. Health care operations. We may use and share your PHI for our business operations. This includes quality reviews, staff training, credentialing, and licensing.

D. Family and friends involved in your care. We may share your PHI with a family member, friend, or other person you choose who helps with your care or helps pay for it. We share only what that person needs to know. If you are there, we will ask you first or give you a chance to say no. If you cannot tell us what you want, we will use our best judgment. In a disaster, we may share your PHI so your family can be told where you are.

E. Required by law. We will share your PHI when the law requires it. This includes public health activities, cases of abuse or domestic violence, and law enforcement requests.

F. Public health and safety. We may share your PHI with public health authorities or the FDA. We may also share it to stop a serious threat to health or safety.

G. Health oversight. We may share your PHI with agencies that oversee the health care system. This includes audits, investigations, inspections, and licensing or disciplinary actions. Our state licensing board and government health programs are examples.

H. Lawsuits and legal actions. We may share your PHI in a court case or a hearing before a government agency. We may share it in response to a court order. We may also share it in response to a subpoena or other legal demand, but only after steps are taken to tell you about the request or to protect the information.

I. Research. We may share your PHI for research studies. A review board must approve the study first. If it does not, we will ask for your written permission.

J. Organ donation, medical examiners, and funeral directors. We may share your PHI with organ donation groups. If you die, we may share it with a coroner, medical examiner, or funeral director so they can do their work.

K. Workers' compensation, military, national security, and inmate care. We may share your PHI as allowed for workers' compensation, military service, national security, or care in a correctional facility.

L. Business partners. We may share your PHI with companies that help us run our practice — such as our health record vendor or billing service. Each company must agree in writing to protect your PHI.

M. Appointment reminders and health information. We may contact you with reminders about your appointments or information about your care options and health services.

When we share your PHI with someone outside our practice, the person or company that receives it may be allowed to share it again. Once that happens, the information may no longer be protected by this notice or by the federal privacy rules. The special rules in section 4 are an exception.

N. Artficial Intelligence. We may use artificial intelligence software to help write your visit notes. This software listens to or reads your visit and creates a draft note for your provider. Your provider checks the draft and makes any changes before it becomes part of your record. Companies that provide this software have agreed to protect your PHI.

3. USES AND DISCLOSURES THAT REQUIRE YOUR WRITTEN PERMISSION

We will use or share your PHI for any reason not described in this notice only with your written permission. We will also ask for your written permission before: • Using or disclosing your mental health treatment notes, except as the law allows; • Using or disclosing your PHI for marketing, except for face-to-face talks or a small promotional gift; • Selling your PHI.

You may take back your permission in writing at any time. Your revocation will not apply to disclosures we have already made.

4. SPECIAL RULES FOR SUBSTANCE USE DISORDER (ADDICTION) TREATMENT RECORDS

Some records about substance use disorder (addiction) treatment have extra protection under federal law. This can apply even if we never treated you for addiction. For example, we may get these records from another program that treated you.

If we receive or keep records like these, these extra rules apply: • We will not share them unless you agree in writing or the law requires it. • These records — and testimony about what they say — cannot be used against you in a civil, criminal, administrative, or legislative proceeding. There are only two exceptions. The first is that you agree in writing. The second is a court order, and the court may only issue one after you, or whoever holds the record, have been told about the request and given a chance to be heard. Even then, the order must come with a subpoena or other legal demand before anyone may use or share the record. • If we share them with your written permission, we will tell the person who gets them that they may not share them again.

These rules are on top of the protections in this notice. To learn more, contact our Privacy Officer using the contact information in Contact the Privacy Officer below.

5. YOUR RIGHTS

You have the following rights about your health information:

A. Right to see and get a copy of your records — You may ask to review or get a copy of your PHI that we keep. We will respond within 30 days. We may charge a reasonable fee for the copy.

B. Right to correct your records — You may ask us to correct PHI you believe is wrong or incomplete. We may deny your request in certain cases and will explain why in writing.

C. Right to a list of certain disclosures — You may ask for a list of certain times we shared your PHI in the past six years.

D. Right to ask us to limit how we use or share your PHI — You may ask us to limit certain uses or disclosures. We do not have to agree in most cases. If we do agree, we will follow that limit except in an emergency. We must agree to limit disclosures to your health plan for services you paid for fully out of pocket.

E. Right to ask us to contact you in a certain way — You may ask us to reach you in a specific way, such as only by mail at a certain address. We will honor reasonable requests.

F. Right to a paper copy of this notice — You may ask for a paper copy of this notice at any time, even if you agreed to receive it electronically.

G. Right to be notified of a breach — We will notify you if your health information is involved in a breach.

H. Right to file a complaint — You may file a complaint with our Privacy Officer or with the U.S. Department of Health and Human Services if you believe your privacy rights were violated. We will not retaliate against you for filing a complaint.

To use any of these rights, contact our Privacy Officer using the contact information below.

6. CHANGES TO THIS NOTICE

We may change the terms of this notice at any time. Changes apply to all PHI we maintain. When we make a material change, we will post the new notice in our office and on our website if we have one. We will make it available at your next visit. Each notice shows its effective date.

7. CONTACT THE PRIVACY OFFICER

To learn more about this notice, to use your rights, or to file a complaint, contact:

Privacy Officer: James G. Brewer James Gerard Brewer, M.D., Inc. 2421 Bath Street A Santa Barbara, CA, 93105 Phone: (805) 563-0167

—

Practice: James Gerard Brewer, M.D., Inc. Effective date: July 27, 2026 Privacy Officer: James G. Brewer