Privacy Policy and HIPAA Notice of Privacy Practices

Part I

Website Privacy Policy

Invictus Longevity ("Invictus Longevity," "we," "us," or "our") respects your privacy. This Website Privacy Policy explains how we collect, use, disclose, retain, and protect information when you visit www.invictuslongevity.com, submit a general inquiry, communicate with us, or interact with our online services.

Information we collect

We may collect information you voluntarily provide, including:

• Your name, email address, and telephone number;
• Communication preferences and permission to contact you;
• Information submitted through the website inquiry form; and
• Information included in emails, telephone calls, or other communications.

When you use the website, we and our website service providers may automatically collect limited technical information such as Internet Protocol address, browser and device type, operating system, referring pages, pages viewed, approximate interaction times, access dates, and security, diagnostic, or server-log information. Cookies, server logs, and similar technologies may be used to operate, secure, and improve the website. Restricting cookies through your browser may affect website functionality.

How we use website information

We may use website information to:

• Respond to requests and provide information about the practice;
• Contact you by telephone or email when you have given permission;
• Determine appropriate administrative next steps for an inquiry;
• Operate, maintain, secure, troubleshoot, and improve the website;
• Prevent misuse, fraud, or security incidents;
• Maintain appropriate business and compliance records;
• Comply with legal, regulatory, licensing, or professional obligations; and
• Protect the rights, safety, and property of patients, visitors, the practice, and others.

Submitting a general inquiry does not establish a clinician-patient relationship. A clinician-patient relationship is established only after the practice accepts the individual for care and required clinical and administrative steps are completed.

Website inquiry form and Formspree

Invictus Longevity currently uses Formspree to receive and route website inquiry submissions. Information submitted through the form is transmitted to and processed by Formspree and delivered privately to Invictus Longevity. Formspree's handling of information is also governed by its own Privacy Policy.

The Formspree inquiry form is not presented as a HIPAA-secure patient portal and is not intended to receive protected health information. Current patients should use the communication method designated by the practice for clinical matters.

Communications

If you request information and authorize us to contact you, we may respond using the telephone number or email address provided. Email and ordinary telephone communications can carry privacy risks. Permission to respond to an inquiry does not automatically enroll you in recurring promotional communications. Where required, separate permission will be obtained for marketing, automated calls, or text messages.

When we disclose website information

We may disclose website information:

• To service providers supporting the website, inquiry forms, communications, technology, or professional services;
• When required by law, regulation, lawful process, licensing authority, or governmental request;
• To investigate or prevent fraud, security incidents, misuse, or threats to safety;
• To protect our rights, property, patients, personnel, or others;
• In connection with a practice reorganization or transfer, subject to applicable confidentiality requirements; or
• With your direction or consent.

We do not sell information submitted through the website inquiry form for monetary consideration.

Website retention and security

Website inquiries and related communications are retained for as long as reasonably necessary to respond, maintain appropriate records, protect legal interests, and meet legal or regulatory requirements. When no longer required or reasonably necessary, information may be deleted, anonymized, or securely destroyed in accordance with applicable policies and law.

We use reasonable administrative, technical, and physical safeguards designed to protect information. No website, transmission, or storage system can be guaranteed to be completely secure.

Your website privacy choices

Depending on applicable law and the nature of the information, you may request access, correction, deletion, or information about how certain personal information is used or disclosed. You may also withdraw permission for nonessential communications. Rights may be limited by legal, clinical, retention, security, identity-verification, or other permitted exceptions. We may verify your identity and authority before acting.

Third-party services and children's privacy

The website may link to third-party websites or services that we do not control. Review their privacy policies before providing information. This website is not directed to individuals under 18, and the general inquiry form is not intended for use by individuals under 18 without a parent or legal guardian.

Part II

HIPAA Notice of Privacy Practices

This Notice applies to Invictus Longevity and its workforce. It also describes how qualified service providers and business associates may handle protected health information on our behalf under applicable agreements and law. Acknowledgment of receipt confirms that a patient received this Notice; it does not authorize uses or disclosures beyond those permitted by law.

Your rights

Obtain an electronic or paper copy of your medical record

You may ask to obtain an electronic or paper copy of your medical record and other health information we maintain about you. We will provide access, a copy, or a summary as required by law, generally within 30 days. A reasonable, cost-based fee may apply as permitted by law.

Additional HIPAA rights

Contact the Privacy Contact below to exercise any of these rights:

• Corrections: Request an amendment of health information you believe is incorrect or incomplete. We may deny a request as permitted by law and will explain a denial in writing.
• Confidential communications: Request that we contact you in a particular way or at a particular location. We will accommodate reasonable requests.
• Restrictions: Request limits on certain uses or disclosures. We generally do not have to agree, except when you pay in full and request that information about that service or item not be disclosed to your health plan, unless disclosure is required by law.
• Accounting of disclosures: Request a list of certain disclosures of your health information.
• Paper copy: Print this Notice, save it as a PDF, or request a paper copy at any time, including if you agreed to receive it electronically.

Choose someone to act for you

A legally authorized personal representative may exercise your rights. We will verify the person's authority before acting.

Raise a privacy concern or file a complaint

Contact the Invictus Longevity Privacy Contact below if you believe your privacy rights have been violated. You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights. Invictus Longevity will not retaliate against you for filing a complaint.

Your choices

You may tell us your preferences about sharing information with family, close friends, or others involved in your care or payment, and for disaster relief. If you cannot state a preference, we may disclose information when we determine it is in your best interest or necessary to lessen a serious and imminent threat.

Unless otherwise permitted or required by law, we obtain written authorization before:

• Using or disclosing health information for marketing;
• Selling health information;
• Making most uses or disclosures of psychotherapy notes; or
• Using or disclosing information for a purpose not described in this Notice.

You may revoke an authorization in writing except to the extent we already acted in reliance on it. Invictus Longevity does not maintain a hospital directory. If the practice conducts fundraising in the future, you may opt out of future fundraising communications.

How we typically use or disclose health information

Treatment

We may use your information and disclose it to healthcare professionals involved in your care. For example, we may send relevant information to a laboratory, pharmacy, imaging facility, consulting clinician, or other treating professional.

Healthcare operations

We may use and disclose information to operate the practice, improve care, conduct quality assessment, train personnel, perform compliance activities, communicate with you, maintain records, and manage clinical and administrative services. This includes using qualified technology providers to support clinical documentation.

Payment

We may use and disclose information to bill and obtain payment from you, a health plan, or another responsible party, as applicable.

Other uses and disclosures

Under conditions established by law, information may be used or disclosed for:

• Public-health and safety activities, disease prevention, recalls, and adverse-event reporting;
• Reporting suspected abuse, neglect, or domestic violence;
• Preventing or reducing a serious and imminent threat;
• Health oversight, workers' compensation, and certain law-enforcement requests;
• Military, national-security, or other special government functions;
• Research when applicable legal requirements are satisfied;
• Organ and tissue donation;
• Coroners, medical examiners, or funeral directors following a death;
• Judicial or administrative proceedings and lawful process; and
• Compliance with federal, state, or local law.

We may require an attestation or other documentation before responding to certain requests. We will not use or disclose protected health information for a purpose prohibited by applicable law, including a prohibited investigation or proceeding concerning lawful reproductive healthcare or identifying a person for such a prohibited purpose. Information disclosed as permitted by law may be redisclosed by the recipient and may no longer be protected by HIPAA, although other laws may continue to apply.

Substance use disorder records

To the extent we receive or maintain substance use disorder patient records protected by 42 CFR Part 2, those records receive additional protections. We will not use or disclose those records, or testimony describing them, in a civil, criminal, administrative, or legislative investigation or proceeding against the patient unless permitted by the patient's written consent or authorized by an appropriate court order accompanied by a subpoena or other legal requirement compelling disclosure.

Part 2 records disclosed with written consent for treatment, payment, or healthcare operations may be redisclosed as permitted by HIPAA unless the consent or applicable law imposes additional restrictions. Other disclosures remain subject to applicable limits.

Business associates and technology providers

We may disclose protected health information to qualified service providers supporting medical transcription, AI-assisted documentation, electronic records, communications, hosting, billing, professional, or technology services. When a provider creates, receives, maintains, or transmits protected health information on our behalf, we require appropriate written assurances and a Business Associate Agreement when required by HIPAA. Business associates may use or disclose information only as permitted by their agreements or law and must maintain applicable safeguards.

Our responsibilities

• We are required by law to maintain the privacy and security of protected health information.
• We must provide notice of our legal duties and privacy practices.
• We will notify affected individuals following a breach of unsecured protected health information when required.
• We must follow the terms of the Notice currently in effect.
• We will provide a paper or electronic copy upon request.

We will not use or disclose health information other than as described in this Notice unless you authorize us in writing or another use or disclosure is permitted or required by law.

Changes to this Notice

We reserve the right to change this Notice and make a revised Notice effective for all protected health information we maintain, including information created or received before the revision. The updated version will be available on this website, upon request, and at a physical service location as applicable. The revised Notice will state its effective date.

Part III

AI-Assisted Clinical Documentation Disclosure and Consent

Invictus Longevity uses artificial intelligence-assisted technologies during both in-person and telemedicine appointments to support clinical transcription, preparation of medical records, continuity of care, and related practice-management functions. The practice currently uses Heidi Health and may use other qualified AI-assisted documentation providers that perform substantially similar functions.

Before receiving services, patients must affirmatively acknowledge and consent to the use of AI-assisted clinical documentation through the practice's onboarding documents. This Part III is incorporated by reference into that consent.

During a clinical encounter, audio or audio-derived transcription of the clinical conversation may be captured, generated, processed, stored, and used to create a written transcript, draft clinical note, summary, letter, or related clinical documentation.

The collection, processing, storage, use, and retention of audio and related information are governed by applicable law, Invictus Longevity's policies, the applicable Business Associate Agreement, and the technology provider's privacy and security practices.

Written transcripts, AI-generated drafts, clinician-approved notes, and related documentation may be retained for treatment, continuity of care, documentation, quality assurance, practice operations, compliance, legal, and regulatory purposes. These materials are maintained for the period required or permitted by applicable law and Invictus Longevity's medical-record retention policy.

AI-generated transcripts and drafts may contain errors, omissions, or inaccuracies. The treating clinician reviews and, when necessary, corrects the generated documentation. The clinician-approved clinical note constitutes the official clinical record and controls if there is a material difference between the finalized note and an uncorrected transcript or draft.

AI-assisted technology does not independently diagnose patients, determine treatment, or replace the clinician's professional judgment. The treating clinician remains responsible for reviewing and approving documentation and for all clinical decisions.

Current and future providers

Invictus Longevity currently uses Heidi Health under a Business Associate Agreement. Information about Heidi Health's data practices is available in its Privacy Policy and HIPAA compliance information.

Invictus Longevity may replace Heidi Health or use another qualified AI-assisted documentation provider performing substantially similar functions, provided that the provider is subject to appropriate privacy, security, and contractual safeguards.

Patient acknowledgment and consent

Through the signed or electronically accepted onboarding consent, the patient:

1. Acknowledges having received, reviewed, or been given the opportunity to review this Part III;
2. Consents to the capture, generation, processing, storage, and use of clinical conversations and audio-derived transcription for documentation;
3. Consents to the creation, use, and retention of transcripts, AI-generated drafts, clinician-approved notes, and related documentation for the purposes described above;
4. Consents to Heidi Health or another qualified provider performing substantially similar functions; and
5. Understands that affirmative consent is required as part of the practice's documentation workflow before receiving services.

Contact

Privacy questions, requests, and complaints

Privacy Contact — Invictus Longevity
Email: invictuslongevity@gmail.com
Telephone: 908-340-2746
Fax: 908-498-5045

Please do not include medical information in an ordinary email or website inquiry. Current patients should use the communication method designated by the practice for clinical matters.