Notice of Privacy Practices

This page is a focused HIPAA Notice of Privacy Practices. For the complete combined notice (HIPAA NPP plus our Website Privacy Policy, cookies, analytics, and state consumer-privacy disclosures), see our full Privacy Policy.

Effective date: May 15, 2026

Who follows this Notice

This Notice describes the privacy practices of ZARAS Wellness LLC, doing business as BrightLife Physical Therapy & Wellness (“we,” “us,” or the “Practice”). It applies to all of the Practice’s employees, contractors, students, volunteers, and business associates who handle your protected health information (“PHI”), and to all care provided at our clinic at 3100 Five Forks Trickum Rd SW, Suite 603, Lilburn, GA 30047.

Our pledge regarding your health information

We understand that information about you and your health is personal. We are committed to protecting the privacy of that information. We are required by the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (collectively, “HIPAA”), and by applicable Georgia law, to:

• Maintain the privacy and security of your protected health information.
• Provide you with this Notice describing our legal duties and privacy practices with respect to your PHI.
• Follow the terms of the Notice currently in effect.
• Notify you following a breach of unsecured PHI, as required by law.

How we may use and disclose your health information without your authorization

The following categories describe the ways we may use and disclose your PHI without your written authorization. Not every use or disclosure within a category is listed; however, all of the permitted uses and disclosures fall within one of the categories below.

For Treatment

We may use and disclose your PHI to provide, coordinate, or manage your physical therapy care. For example, your physical therapist may share information with the referring physician, an orthopedic surgeon, your primary care provider, or another clinician involved in your care, so that everyone treating you has the information needed to do so safely and effectively.

For Payment

We may use and disclose your PHI so that the treatment and services you receive may be billed to and payment may be collected from you, your insurance company, or a third party. For example, we may need to give your insurance plan information about your diagnoses and the services we provided so the plan will pay us or reimburse you. We may also share information with a billing service or clearing house acting on our behalf under a Business Associate Agreement.

For Health Care Operations

We may use and disclose your PHI for activities necessary to operate the Practice and ensure that our patients receive quality care. Examples include quality assessment and improvement activities, reviewing the competence or qualifications of clinicians, training students and staff, accreditation, licensing, credentialing, medical review, legal services, and general administrative activities.

Appointment Reminders, Treatment Alternatives, and Health-Related Benefits

We may contact you to remind you of an upcoming appointment, to tell you about or recommend possible treatment options or alternatives, or to inform you of health-related benefits and services that may be of interest to you. Reminders may be sent by phone, voicemail, text message, or email — let us know if you have a preferred method of contact or a number/address that should not be used.

Individuals Involved in Your Care or Payment for Your Care

With your agreement (which may be inferred from the circumstances, for example a family member accompanying you to an appointment), we may disclose to a family member, friend, or other person you identify the PHI directly relevant to that person’s involvement in your care or payment for your care. In an emergency or when you are not present or able to agree, we will use our professional judgment to determine whether the disclosure is in your best interest.

As Required by Law

We will disclose your PHI when required to do so by federal, state, or local law.

Public Health and Safety Activities

We may disclose your PHI for public health activities including: preventing or controlling disease, injury, or disability; reporting births or deaths; reporting child abuse or neglect; reporting reactions to medications or problems with products; notifying people of recalls of products they may be using; notifying a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition; and notifying the appropriate government authority if we believe a patient has been the victim of abuse, neglect, or domestic violence, in accordance with applicable law.

Health Oversight Activities

We may disclose your PHI to a health oversight agency for activities authorized by law, including audits, investigations, inspections, licensure actions, and government civil rights and compliance reviews.

Lawsuits and Disputes

If you are involved in a lawsuit or a dispute, we may disclose your PHI in response to a court or administrative order, subpoena, discovery request, or other lawful process, subject to all applicable legal requirements.

Law Enforcement

We may release your PHI if asked to do so by a law enforcement official in response to a court order, subpoena, warrant, summons, or similar process; to identify or locate a suspect, fugitive, material witness, or missing person; about a victim of a crime under certain limited circumstances; about a death we believe may be the result of criminal conduct; and in emergency circumstances to report a crime, its location, victims, or the identity, description, or location of the person who committed it.

Coroners, Medical Examiners, Funeral Directors, and Organ Donation

We may release PHI to a coroner or medical examiner to identify a deceased person or determine cause of death, and to funeral directors as necessary to carry out their duties. Where applicable, PHI may be released to organizations that handle organ, eye, or tissue procurement, transplantation, or donation.

Research

Under certain circumstances, we may use and disclose your PHI for research purposes, provided that the research has been approved through a process that evaluates the proposed use or disclosure and its impact on your privacy.

To Avert a Serious Threat to Health or Safety

We may use and disclose your PHI when necessary to prevent or lessen a serious and imminent threat to your health and safety or the health and safety of the public or another person. Any disclosure would be only to someone able to help prevent the threat.

Military, Veterans, National Security, and Protective Services

If you are a member of the armed forces, we may release your PHI as required by military command authorities. We may also disclose PHI to authorized federal officials for intelligence, counterintelligence, and other national security activities authorized by law, and for the provision of protective services to the President or other authorized persons.

Workers’ Compensation

We may release PHI for workers’ compensation or similar programs that provide benefits for work-related injuries or illness, in accordance with Georgia law.

Inmates

If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may release your PHI to the institution or officer as permitted by law.

Business Associates

We may share your PHI with third-party “business associates” that perform services on our behalf — for example, our electronic health record vendor, online booking provider, billing service, or IT support. Each business associate is required by a signed Business Associate Agreement to protect your PHI in a manner consistent with HIPAA.

Uses and disclosures that require your written authorization

The following uses and disclosures will be made only with your written authorization, and you may revoke that authorization at any time in writing (except to the extent we have already acted in reliance on it):

• Marketing communications, other than face-to-face communications or a promotional gift of nominal value.
• Sale of your PHI.
• Psychotherapy notes, in the rare circumstance that we maintain any.
• Most other uses and disclosures not described in this Notice.

Your rights regarding your health information

Right to Inspect and Copy

You have the right to inspect and obtain a copy of the PHI we maintain about you in our designated record set, including in an electronic format if we maintain it electronically and you request it that way. To request access, submit a written request to the Privacy Officer. We may charge a reasonable, cost-based fee as permitted by law. We may deny your request in limited circumstances; if so, you may request that the denial be reviewed.

Right to Amend

If you believe PHI we have about you is incorrect or incomplete, you have the right to request an amendment. Submit your request in writing to the Privacy Officer and include a reason that supports the request. We may deny the request if the information was not created by us, is not part of the PHI kept by us, is not part of the information you would be permitted to inspect and copy, or is already accurate and complete.

Right to an Accounting of Disclosures

You have the right to request an accounting of certain disclosures we have made of your PHI, other than disclosures for treatment, payment, health care operations, or disclosures made directly to you or with your authorization. Submit your request in writing to the Privacy Officer. The first accounting in any 12-month period is free; we may charge a reasonable, cost-based fee for additional accountings.

Right to Request Restrictions

You have the right to request a restriction on the PHI we use or disclose for treatment, payment, or health care operations, or to family members or others involved in your care. We are not generally required to agree to your request. However, if you pay for a service or item in full out-of-pocket and ask us not to share information about that service with your health plan for the purpose of payment or health care operations, we will honor that request, unless we are required by law to disclose it.

Right to Request Confidential Communications

You have the right to ask that we communicate with you about medical matters in a certain way or at a certain location — for example, only by mail to a specific address, or only by phone to a specific number. We will accommodate all reasonable requests.

Right to a Paper Copy of This Notice

You have the right to receive a paper copy of this Notice at any time, even if you have agreed to receive it electronically. Ask the front desk or the Privacy Officer and we will provide one promptly.

Right to Be Notified of a Breach

You have the right to be notified following a breach of your unsecured PHI, as required by federal law.

Right to File a Complaint

You have the right to file a complaint if you believe your privacy rights have been violated. See “Complaints” below. You will not be retaliated against in any way for filing a complaint.

Our duties

We are required by law to maintain the privacy of your PHI, to provide you with this Notice of our legal duties and privacy practices, to follow the terms of the Notice currently in effect, and to notify you in the event of a breach of unsecured PHI.

Changes to this Notice

We reserve the right to change this Notice and to make the revised Notice effective for PHI we already have about you as well as for any PHI we receive in the future. We will post a copy of the current Notice in our clinic and on our website at brightlifept.com/hipaa-notice. The effective date of the Notice currently in effect is shown at the top of the first page.

Complaints

If you believe your privacy rights have been violated, you may file a complaint with us by contacting our Privacy Officer at the information below, or with the Secretary of the U.S. Department of Health and Human Services, Office for Civil Rights:

We will not retaliate against you for filing a complaint.

Contact — Privacy Officer

For questions about this Notice, to exercise any of your rights, or to make a complaint to the Practice, contact our Privacy Officer:

Effective date: May 15, 2026