Privacy Policy

Suraiya Rahman Medical Corporation dba Pala Medicine

Effective date: August 1^st 2026

Contents

1. Scope of This Policy
2. Notice of Privacy Practices (HIPAA)
3. California Medical Privacy Rights (CMIA)
4. California Consumer Privacy Rights (CCPA/CPRA) — Website & Non-Patient Data
5. Newsletter and Marketing Communications
6. Telehealth Privacy and Security
7. Minors and Adolescent Clients (AYAKAP)
8. Service Providers
9. Data Security
10. Data Retention
11. Your Rights and How to Exercise Them
12. Changes to This Policy
13. Contact Us and How to File a Complaint

1. Scope of This Policy

This Privacy Policy describes how Suraiya Rahman Medical Corporation dba Pala Medicine (“Pala Medicine,” “we,” “us,” or “our”) collects, uses, discloses, and protects information about the people who visit our website, contact us, or receive care from us. It applies to:

• Protected health information (PHI) created or received in connection with clinical care, including ketamine therapy, ketamine-assisted psychotherapy, psychedelic medical evaluations, and related services;
• Personal information collected through our website, including through our contact forms and newsletter; and
• Information collected in connection with scheduling, billing, and communication about your care.

What this policy does not cover

Momence class and individual appointment offerings shown on our website are provided through Spirit Circle LLC, a separate, non-clinical business — not by Pala Medicine.

Momence is a scheduling platform operated by Spirit Circle LLC. Any information you provide when booking or attending a class or event through Momence is collected by Spirit Circle LLC, not Pala Medicine, and is governed by Spirit Circle LLC’s own privacy policy rather than this one. Pala Medicine does not collect, access, or maintain client data submitted through Momence.

2. Notice of Privacy Practices (HIPAA)

This section serves as our Notice of Privacy Practices required by the Health Insurance Portability and Accountability Act (HIPAA). It describes how medical information about you may be used and disclosed, and how you can access this information.

Please review it carefully.

How we may use and disclose your health information

We use and disclose your protected health information (PHI) for the following purposes without requiring your separate written authorization:

• To provide, coordinate, or manage your care and related services — for example, sharing information among clinicians involved in your care, or with a KAP-trained therapist you are working with alongside your Pala Medicine physician.
• Because Pala Medicine is currently self-pay, this generally means processing your payment through our payment processor and providing you with documentation (such as a superbill) you may choose to submit to your insurer for reimbursement. We do not bill insurance directly on your behalf.
• Health care operations. For activities that support the practice, such as quality assessment, staff training, and administrative operations. This includes the presence of interns during in-person sessions. Interns who observe or participate in care are treated as members of our workforce for HIPAA purposes and are bound by the same confidentiality obligations as our clinical staff. We do not audio- or video-record sessions.

Uses that require your written authorization

Other than as described above, we will not use or disclose your health information without your written authorization, including for purposes such as:

• Marketing communications that use your health information;
• Sale of your health information (we do not and will not sell health information); or
• Disclosure of psychotherapy notes, where applicable.

You may revoke a written authorization at any time, except to the extent we have already acted in reliance on it.

Situations where we may be required to disclose information without authorization

In limited circumstances required or permitted by law, we may disclose health information without your authorization, including:

• Where required by law, such as in response to a court order;
• To avert a serious and imminent threat to health or safety;
• To public health authorities as required by law; or
• In connection with a health oversight or regulatory board inquiry, such as the Medical Board of California.

The Colorado Natural Medicine Program and your records

We do not send your evaluation, records, or any health information to any Colorado healing center or any other third party on your behalf unless you specifically request this (as a medical records release).

If you choose to pursue Colorado’s regulated Natural Medicine Program, you will receive your own evaluation and any related documentation directly. Whether and with whom you share that documentation — including any Colorado healing center — is entirely your decision.

Your rights regarding your health information

• Right to access. You may request a copy of your health record, in paper or electronic form.
• Right to amend. You may request that we correct information you believe is incorrect or incomplete.
• Right to an accounting of disclosures. You may request a list of certain disclosures we have made of your health information.
• Right to request restrictions. You may ask us to limit how we use or disclose your information for treatment, payment, or operations. We are not required to agree, except where you have paid out of pocket in full for a service and ask that we not disclose that service to your health plan — in that case we must honor your request.
• Right to confidential communications. You may request that we communicate with you in a particular way or at a particular location.
• Right to a paper copy of this notice. You may request a paper copy of this notice at any time, even if you agreed to receive it electronically.
• Right to be notified of a breach. We will notify you if a breach of your unsecured health information occurs.

Our duties

We are required by law to maintain the privacy of your health information, provide you with this notice of our legal duties and privacy practices, and abide by the terms of the notice currently in effect.

3. California Medical Privacy Rights (CMIA)

California’s Confidentiality of Medical Information Act (CMIA) provides protections for your medical information that are, in some respects, stronger than HIPAA. Where CMIA and HIPAA differ, we follow whichever standard provides you greater protection.

• Authorization requirements. CMIA generally requires our authorization forms to meet specific formatting and content requirements beyond what HIPAA requires.
• Sensitive information. CMIA includes specific protections for mental health and substance use information. Given the nature of our services, we treat all clinical records with this heightened standard of care.
• Right to sue for violations. Unlike HIPAA, which does not give individuals a private right to sue, CMIA allows patients to bring a civil action for unauthorized disclosure of medical information.

4. California Consumer Privacy Rights (CCPA/CPRA)

This section applies to personal information we collect that is not protected health information governed by HIPAA/CMIA above — principally, information collected through our website from visitors and newsletter subscribers who are not yet patients, or in a non-clinical capacity.

Categories of information we collect

How we use this information

• To send the newsletter and communications you have signed up to receive;
• To respond to inquiries submitted through our contact form;
• To understand website usage and improve our content; and
• To tailor newsletter content to the interests you have indicated.

Sale or sharing of information

We do not currently use advertising pixels (such as a Meta/Facebook Pixel or Google Ads remarketing tag), and we do not currently sell or share personal information as defined under the CCPA.

If we begin using advertising pixels or similar technology in the future, this may constitute a “sale” or “sharing” of personal information under California law, even where no money changes hands. Before implementing any such technology, this policy will be updated and a “Do Not Sell or Share My Personal Information” mechanism will be added to the website.

Your California privacy rights

As a California resident, you have the right to:

• Know what personal information we have collected, used, and disclosed about you;
• Delete personal information we have collected from you, subject to certain exceptions;
• Correct inaccurate personal information;
• Opt-out of the sale or sharing of personal information (not currently applicable, as described above); and
• Non-discrimination for exercising any of these rights.

To exercise any of these rights, contact us using the information in Section 13. We will not discriminate against you for exercising your privacy rights.

5. Newsletter and Marketing Communications

Our newsletter signup collects your name, email address, phone number, and stated interests, and is processed through Mailchimp. Every email includes an unsubscribe link, and you may unsubscribe at any time.

6. Telehealth Privacy and Security

We offer both in-person and telehealth (video) visits. When you participate in a telehealth visit:

• We use a platform designed to support HIPAA-compliant video communication.
• Sessions are not recorded.
• You are responsible for participating from a private location and for the security of your own internet connection and device.
• As with in-person visits, a clinical intern may be present during a telehealth session as part of their training; sessions are never recorded regardless of whether an intern is present.

7. Minors and Adolescent Clients (AYAKAP)

Pala Medicine’s adolescent program (AYAKAP) serves clients under 18. As a matter of practice, we require a parent or legal guardian’s signature and involvement for all interactions with a minor client, including for treatment itself.

Health information about a minor client is treated with the same confidentiality protections described throughout this policy. Consistent with our practice above, a parent or legal guardian who has signed consent for their child’s treatment generally has access to that child’s records as their personal representative under HIPAA.

8. Service Providers

We work with the following categories of service providers to operate our practice and website. Providers who may handle protected health information on our behalf sign a Business Associate Agreement (BAA) as required by HIPAA.

9. Data Security

We use administrative, technical, and physical safeguards designed to protect your information, including:

• Encrypted transmission and storage of health records through our EHR platform;
• Access to health records limited to workforce members and trainees involved in your care;
• Business Associate Agreements with vendors who handle protected health information; and
• Secure, locked storage of any physical records maintained at our office.

No system can guarantee absolute security. If a breach affecting your information occurs, we will notify you as required by HIPAA and California law.

10. Data Retention

California law requires physicians to retain adult patient records for a minimum of seven years from the last date of service (California Business and Professions Code §2266). Records of minor patients must be retained until the minor reaches 19 years of age, or for seven years from the last date of service, whichever period is longer (California Health and Safety Code §123145).

We retain health records in accordance with these requirements. Website and marketing data (such as newsletter subscriber information) is retained until you unsubscribe or request deletion, or as needed to comply with legal obligations.

11. Your Rights and How to Exercise Them

To exercise any right described in this policy — to access, amend, or request restrictions on your health information; to know, delete, or correct personal information; or to ask a question about our privacy practices — contact our Privacy Officer using the information in Section 13.

We will respond to verifiable requests within the time periods required by applicable law. We may need to verify your identity before fulfilling certain requests involving health information.

12. Changes to This Policy

We may update this Privacy Policy from time to time, including as our services, vendors, or legal obligations change — for example, if we begin using advertising pixels, add new service offerings, or update our vendor relationships. The effective date at the top of this policy will reflect the most recent revision. Material changes will be posted on this page.

13. Contact Us and How to File a Complaint

Privacy Officer

Rob Matthews
Pala Medicine
959 E Walnut Street, Suite 214
Pasadena, CA 91106
rob@palamedicine.com

You also have the right to file a complaint

If you believe your privacy rights have been violated, you may file a complaint with us using the contact information above, or directly with:

Department of Health and Human Services, Office for Civil Rights — ocrportal.hhs.gov/ocr/smartscreen/main.jsf, or by phone at 1-800-368-1019.

We will not retaliate against you for filing a complaint.

Effective date: August 1^st 2026