HIPAA Notice

1. Who holds your protected health information

Therisse is a brand operated by Ironoak Holdings LLC, a Texas limited liability company. Therisse handles marketing, billing, and customer support. Therisse is not a HIPAA-covered entity and does not store or process protected health information ("PHI") on its own systems.

Your medical care, medical records, and PHI are held by MDI Medical Group PC, the covered entity that provides physician services through this platform, and its network of independently licensed, board-certified physicians. When you complete the medical intake form, you interact with MDI's HIPAA-compliant platform, not with Therisse. No PHI is stored on therisse.com.

2. MDI's Notice of Privacy Practices

The Health Insurance Portability and Accountability Act (HIPAA) requires the covered entity that holds your PHI to give you a Notice of Privacy Practices describing how your medical information is used and disclosed and how you can access it. MDI Medical Group PC maintains its own Notice of Privacy Practices for the medical records it holds. You can request a copy from MDI directly, using the contact information below or through the patient portal accessible from any clinician message you receive. That notice, not this page, governs the handling of your medical records.

3. Your rights under HIPAA

As a patient of MDI Medical Group PC, you generally have the right to:

• Access and obtain a copy of your medical records
• Request corrections or amendments to your medical records
• Receive an accounting of certain disclosures of your PHI
• Request restrictions on how your PHI is used or disclosed
• Request that communications reach you by a specific method or at a specific location
• Receive a paper copy of the Notice of Privacy Practices on request
• Be notified in the event of a breach of your unsecured PHI

4. How to exercise your rights

Because MDI Medical Group PC holds your PHI, requests to access, amend, or restrict your medical records are directed to MDI, using the contact information in MDI's Notice of Privacy Practices or through the patient portal.

For personal information held by Therisse (such as your name, email, billing records, and account history, none of which is PHI), email support@therisse.com. See our Privacy Policy for how Therisse handles that information.

5. Filing a complaint

You have the right to file a complaint if you believe your privacy rights have been violated, without fear of retaliation. Complaints about the handling of your medical records may be filed with MDI Medical Group PC and with the U.S. Department of Health and Human Services, Office for Civil Rights, at hhs.gov/ocr/complaints. Questions about the Therisse service can be sent to support@therisse.com.