Notice of Privacy Practices

Effective date: October 30, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

This Notice applies to Luisa Gonzalez Ballesteros, M.D., PLLC (the “Practice”). In this Notice, “you” means the patient. If you are a parent or guardian reading this for your child, “you” also includes the person who acts for your child.

A · Who follows this Notice

This Notice applies to the Practice, to Dr. Luisa Gonzalez Ballesteros, and to anyone else whose work is under the Practice’s direct control.

The Practice also works with business associates that may create, receive, maintain, or transmit protected health information (PHI) on our behalf. Those business associates are required by applicable law and by written agreements with the Practice to safeguard PHI and to use or disclose it only as permitted.

This Notice applies only to PHI maintained by the Practice. Records maintained by any hospital or other organization where Dr. Gonzalez Ballesteros works or has worked are separate from the Practice’s records and are governed by that organization’s own privacy practices.

B · Our responsibilities

PHI is health information about you, such as symptoms, diagnoses, test results, treatment, and payment, that can identify you. We are required by law to:

• keep your PHI private and secure;
• give you this Notice of our legal duties and privacy practices and follow it while it is in effect;
• tell you promptly if a breach of your unsecured PHI occurs; and
• use or share your PHI only as described here, or with your written authorization.

C · How we may use and share your PHI without your authorization

The law allows us to use and share PHI in the following ways without asking you first. When HIPAA’s minimum necessary standard applies, we limit the PHI we use, share, or request to the minimum necessary for the intended purpose.

• Treatment. To provide, coordinate, and manage your care. For example, we review records from your prior doctors when you ask for a second opinion, and we communicate with your pediatrician or referring clinician, laboratories, imaging centers, pharmacies, and specialists.
• Payment. To be paid for our services. Patients pay the Practice directly, and the Practice does not bill insurance plans. For example, we use your information to issue invoices and receipts, to process your card payment through our payment processor, and, if you ask, to prepare an itemized receipt (superbill) that you can submit to your own insurance plan. If you pay for a service in full out of pocket, you may ask us not to share information about that service with your health plan (see your rights in Section G).
• Health care operations. To run the Practice: quality review, staff training, licensing and accreditation, legal, accounting, and consulting services, and business planning.
• Appointment coordination and health-related communications. To contact you about appointments and to tell you about treatment options or health-related services that may interest you. We use the least information needed. Voicemails, texts, and reminders will not include details of your health.
• Business associates. To companies that perform services for us and sign an agreement to protect your PHI, such as our electronic health record, secure messaging (Klara), telehealth video (Zoom for Healthcare), and billing, IT, and accounting providers.
• Family, friends, and others involved in your care. If you are an adult, we may share PHI directly relevant to a person’s involvement in your care or payment if you agree or do not object, or, in an emergency or if you cannot decide, when we judge it is in your best interest. For children, see Section F.
• Required by law. When federal, state, or local law requires it.
• Public health. To prevent or control disease, injury, or disability; to report child abuse or neglect; and to report on FDA-regulated products.
• Abuse, neglect, or domestic violence. To government authorities when the law requires or permits it.
• Health oversight. To agencies that audit, inspect, investigate, or license health care providers.
• Court and administrative proceedings. In response to a court order, or a subpoena or discovery request when we receive the assurances the law requires.
• Law enforcement. In limited situations the law allows, such as a court order, warrant, or to report certain injuries or crimes on our premises.
• To prevent a serious threat. To someone able to help prevent a serious and imminent threat to health or safety.
• Research. When an institutional review board or privacy board has approved a waiver of authorization, for a limited data set under a data use agreement, or in de-identified form.
• Other government functions and workers’ compensation. When the law permits or requires, such as for national security or workers’ compensation claims.
• De-identified information. We may use or share information after removing what identifies you, as HIPAA permits.

D · Uses and disclosures that require your written authorization

We need your written authorization for any use or disclosure not described in this Notice, and specifically for:

• psychotherapy notes, if we ever keep them (there are limited exceptions);
• marketing, meaning communications paid for by a third party, and any use of your PHI to market a third party’s products or services (face-to-face conversations and nominal gifts are not restricted); and
• sale of PHI. We do not sell PHI.

We will not use or share your PHI, or your child’s, in social media, videos, our website, teaching materials, publications, or testimonials without your specific written authorization. The Practice does not publish patient testimonials or before-and-after content. If we keep a newsletter list, it is kept separate from medical records.

You may revoke an authorization in writing at any time. Revocation does not affect what we already did in reliance on it.

E · Stricter federal and New York protections

Some information has additional legal protections. When a stricter federal or New York law applies, we follow it, and we may need your specific written consent before sharing information. Examples include HIV-related information, certain mental health information, substance use disorder treatment records, genetic test results, information about care to which a minor lawfully consented, and information related to reproductive health care or gender-affirming care when additional protections apply under New York law.

Substance use disorder treatment records. If we receive records from a program covered by 42 CFR Part 2, they receive additional protection. We may use and share them for treatment, payment, and health care operations if you have given a consent that allows it. Those records, and testimony describing their content, may not be used or disclosed in civil, criminal, administrative, or legislative proceedings against you unless you consent in writing or a court orders it after notice and an opportunity for you to be heard. Records we receive under a consent may be redisclosed by us only as HIPAA permits.

F · Children, adolescents, and personal representatives

• Parents and guardians. For patients under 18, a parent or legal guardian generally acts as the child’s personal representative and may receive the child’s PHI and exercise the rights in Section G. We may ask for documents, such as custody orders, when family arrangements are not clear.
• Adolescents and confidentiality. New York law lets minors consent on their own to certain kinds of care. When a minor lawfully consents to care, or when the parent agrees that a conversation between the adolescent and the clinician stays confidential, we follow the law and may limit what we share with parents about that care. We explain how confidentiality works at adolescent visits, and we encourage open communication between teens and their parents. We will always act to protect a patient’s safety.
• Safety exception. We may decline to treat someone as a personal representative if we reasonably believe the patient has been or may be subjected to abuse, neglect, or endangerment by that person.
• Turning 18. At 18, the patient holds these rights. A parent then receives PHI only with the patient’s agreement or authorization, or as the law permits.
• Adults. You may name a health care agent or another person to act for you, for example through a health care proxy.

G · Your rights

• See and get a copy of your records, including an electronic copy, and ask us to send it to a person you name. Please ask in writing. We respond within the time required by applicable law. New York law may provide additional or faster access rights in some circumstances. We may charge a reasonable, cost-based fee as the law permits. In limited cases we may deny access, and in many of them you may ask for a review of the denial.
• Ask us to correct information you believe is wrong or incomplete. We may deny the request in some cases, and you may then submit a statement of disagreement.
• Receive an accounting of disclosures: a list of certain disclosures of your PHI made in the six years before your request. It does not include disclosures for treatment, payment, and health care operations, disclosures you authorized, and some others.
• Request restrictions on how we use or share your PHI for treatment, payment, or operations, or with family. We are not required to agree, except that if you (or someone else on your behalf) pay for a service in full out of pocket and ask us not to share information about it with your health plan for payment or operations, we must agree, unless the law requires the disclosure.
• Request confidential communications by a different method or at a different place, for example by messaging instead of a phone call. We accommodate reasonable requests and do not require you to explain why.
• Be notified of a breach of your unsecured PHI.
• Get a paper copy of this Notice at any time, even if you agreed to receive it electronically.
• Revoke an authorization you gave us, in writing.
• File a complaint if you believe your privacy rights were violated. You may complain to the Practice using the contact information in Section J, or to the U.S. Department of Health and Human Services, Office for Civil Rights, 200 Independence Avenue S.W., Washington, D.C. 20201, 1-877-696-6775, www.hhs.gov/ocr/privacy/hipaa/complaints/. We will not retaliate against you for filing a complaint.

To use any of these rights, contact the Privacy Officer in Section J.

H · How we communicate with you

• We use secure channels for clinical information whenever possible, including Klara for messaging and for consent forms and agreements, and Zoom for Healthcare for telehealth video, under business associate agreements.
• Standard email, WhatsApp, and social media messages are not intended for PHI. We will send PHI by unencrypted email or text only if you ask us to and understand the risk that it could be read by others.
• We do not make audio or video recordings of telehealth visits. We may transcribe visits using Zoom for Healthcare, under a business associate agreement, to help prepare your medical record. Transcripts are protected like the rest of your PHI. Please do not record visits without our agreement.

I · Website, social media, and marketing

Our website and social media accounts share general education. They do not identify patients. We do not use PHI for marketing without your authorization, and we do not sell PHI. Our Website Privacy Policy, available on our website, explains how we handle information collected online from visitors.

J · Changes to this Notice and how to contact us

We may change this Notice and make the new terms apply to all PHI we keep, including PHI we already have. The current Notice is posted on our website and available at our office, and we will give you a copy on request. The effective date is at the top.

Privacy Officer: Dr. Luisa Gonzalez Ballesteros

Luisa Gonzalez Ballesteros, M.D., PLLC, 4 East 89th Street, Suite 1C, New York, NY 10128

Phone calls and WhatsApp: +1 (917) 573-0248; calls or messages via Klara, our patient messaging platform: +1 (646) 846-4816  |  Email: contact@endo-well.com

This Notice is available in English and Spanish. Ask us if you need it in another format or need language assistance.