NOTICE OF PRIVACY PRACTICES

This Notice of Privacy Practices (the “Notice”) describes how Instituto de Infertilidad y Genética México, S.C. (hereinafter referred to as INGENES or “Hybrid Entity”), may use and disclose your protected health information to carry out treatment, payment or business operations and for other purposes that are permitted or required by law. A Hybrid Entity is an entity that entails a venture of different activities or functions, among others, healthcare functions that a covered entity performs, and also develop some business functions that a covered entity is not able to perform or is not inherent to their activities. Business functions that are not functions a covered entity performs, are referred to as “non-covered functions” or “non-healthcare functions”.

INGENES holds a Business Associate relationship with INGENES SAN DIEGO, INC. and INGENES MCALLEN, P.C. (hereinafter referred to as “Covered Entity or collectively as “Covered Entities”), a conform a single unity of business with purposes of compliance to the Health Insurance Portability and Accountability Act (“HIPAA”). As a single business unity, albeit not under the same control or ownership, have elected to voluntarily substantially comply with the standards set forth in HIPAA. Each covered entity shall publish its Notice of Privacy Practices as set forth in HIPAA.

INGENES will share protected health information with each other for the treatment, payment, and health care operations from covered entities and along with them, and as permitted by HIPAA and this Notice of Privacy Practices. The compliance officer for the single business entity can be reached on contacto@ingenes.com.

This Notice of Privacy Practices (the “Notice”) describes how INGENES SAN DIEGO, INC. (hereinafter referred to as INGENES SAN DIEGO or “Covered Entity”), may use and disclose your protected health information to carry out treatment, payment or business operations and for other purposes that are permitted or required by law under compliance to the Health Insurance Portability and Accountability Act (“HIPAA”).

INGENES SAN DIEGO will share protected health information with other covered entities or business associates for the treatment, payment, and health care operations from covered entities and along with them, and as permitted by HIPAA and this Notice of Privacy Practices. The compliance officer can be reached on contacto@ingenes.com.

THE CALIFORNIA CONSUMER PRIVACY ACT (CCPA) PROVIDES SOME CALIFORNIA RESIDENTS WITH THE CERTAIN PRIVACY RIGHTS. TO EXERCISE ANY OF THESE RIGHTS, PLEASE CONTACT US AT THE EMAIL ADDRESS OR TELEPHONE NUMBER LISTED BELOW.

1. Information to which the CCPA Applies

The CCPA and the rights explained in this section apply to certain personal information that we may collect from California residents. However, the CCPA does not apply to personal information that we obtain from patients or prospective patients of our practice or their personal representatives for purposes of providing health care services, or obtaining payment for health care services. This health information is protected by the Health Insurance Portability and Accountability Act (HIPAA) and the California Confidentiality of Medical Information Act (CMIA). Our Notice of Privacy Practices describes how we use and disclose health information. The CCPA also does not apply to certain other kinds of information, such as information that is publicly available from government records, and deidentified or aggregate information.

Aside from this excluded information, we have collected the following categories of personal information that is not covered by HIPAA or the CMIA:

• Identifiers (e.g. name, postal address, online identifier, Internet Protocol address, email address, account name, passport number, or other similar identifiers)
• Personal information categories listed in the California Customer Records statute, Cal. Civ. Code 1798.80(e) (e.g., Social Security number, physical characteristics or description, education, employment, employment history, financial information)
• Protected classification characteristics under California or federal law (e.g. age, race, color, ancestry, national origin, citizenship, religion or creed, marital status, health condition, physical or mental disability, sex, sexual orientation, veteran or military status, genetic information)
• Commercial information (e.g. records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies)
• Biometric information (e.g., genetic, behavioral, and biological characteristics or activity patterns, such as fingerprints or retina scans)
• Internet or other similar network activity (e.g., browsing history, search history)
• Geolocation data (e.g., physical location or movements)
• Sensory data (e.g., audio, electronic, visual, thermal, or similar information)
• Professional or employment-related information (e.g., current or past job history)
• Non-public education information pursuant to FERPA (e.g., educational records maintained by an educational institution)
• Inferences drawn from other personal information (e.g., profile reflecting a person’s preferences, characteristics, trends, behavior)

2. Right to Know

You have the right to know and see what personal information we have collected about you over the past 12 months, including:

• The categories of personal information we have collected about you;
• The categories of sources from which the personal information is collected;
• The business or commercial purpose for collecting your personal information;
• The categories of third parties with whom we have shared your personal information; and
• The specific pieces of personal information we have collected about you.

3. Right to Delete

You have the right to request that we delete the personal information we have collected from you (and direct our service providers to do the same). There are a number of exceptions, however, that include, but are not limited to, when the information is necessary for us or a third party to do any of the following:

• Complete your transaction;
• Provide you with the Services;
• Perform a contract between us and you;
• Detect security incidents, protect against malicious, deceptive, fraudulent or illegal activity, and prosecute those responsible for such activities;
• Fix our system in the case of a bug;
• Protect the free speech rights, including the free speech rights of you or other users, or exercise another right provided by law;
• Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et seq.);
• Engage in public or peer-reviewed scientific, historical, or statistical research in the public interests that adheres to all other applicable ethics and privacy laws;
• Comply with a legal obligation; or
• Make other internal and lawful uses of the information that are compatible with the context in which you provided it.

4. Right to Opt-Out of the Sale of Your Personal Information

We do not sell any of your personal information.

5. Right to Non-Discrimination

We will not discriminate against those who exercise their rights under this section. If you exercise your rights, we will not deny you goods or services, charge you different prices or rates for goods or services, or provide you with a different level or quality of goods or services.

6. Other Rights

California Civil Code § 1798.83 permits users of our Services that are California residents to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes. We do not disclose your personal information to third parties for their direct marketing purposes. However, you are free to make an inquiry with any questions by contacting us in accordance with the “How to Contact Us” section in this Privacy Policy.

7. Exercising These Rights

To request access to or deletion of your personal information, or to exercise any other data rights under California law, please contact us in accordance with the “How to Contact Us” section in this Privacy Policy. Please include your full name, email address, and an explanation of you are emailing us, so that we can verify and process your request in an efficient manner. If we cannot verify your identity from the initial information you provide, we may request additional information from you, which will be used only for the purposes of verifying your identity to assist you with exercising your rights. You may also designate an authorized agent to make a request under this section on your behalf. We may request additional information from you to confirm that the authorized agent has in fact been authorized by you to act on your behalf.

8. Accessing in Alternative Formats

For individuals with disabilities, please contact us in accordance with the “How to Contact Us” section regarding how to access the information in this Privacy Policy in an alternative format.

9. Response Time

We aim to respond to a consumer request for access or deletion within 45 days of receiving a verifiable request. If we require more time, we will inform you of the reason and extension period in writing.

You agree to indemnify and hold harmless INGENES SAN DIEGO and its officers, directors, shareholders, employees, agents, and affiliates against all actual and direct losses, liabilities, claims, costs, or expenses (including reasonable attorneys’ fees) they may suffer as the result of third-party claims, demands, actions, investigations, settlements, or judgments against them arising from or in connection with any breach of these Terms of Use, or from any breaches of confidentiality or negligence or wrongful acts or omissions, by you or your dependents or agents. The limitation of liability and indemnification obligations of these Terms of Use stated above will survive termination of these Terms of Use.

10. Do Not Track Symbols

We do not have the capability to respond to “Do Not Track” signals received from various web browsers at this time.

11. How to Contact Us

If you have any questions, comments or concerns about this policy, or if you wish to exercise any rights regarding your personal information, please feel free to contact us by mail at contacto@ingenes.com.

The following is a statement of your rights with respect to your projected health information.    Such requests should be in writing and addressed to: INGENES MCALLEN, contacto@ingenes.com. You have the right to inspect and copy your protected health information. You have the right to inspect a copy of your medical record, in paper or electronic form.    By Texas Medical Privacy Act (HB  300), you may request an electronic or paper copy, and we must provide that within 15 days.    Under federal law, however, you may not inspect or copy the following records:  psychotherapy notes, information compiled in reasonable anticipation of or use in a civil, criminal or administrative action or proceedings, and protected health information that is subject to law that prohibits access to protected health information.

You have the right to request a restriction of your protected health information This means that you may ask us not to use or disclose any part of your protected health information for the purposes of treatment, payment, or healthcare operations.   You may also request that any part of your protected health information not be disclosed to family members or friends who may be involved in your care or for notification purposes as described in the Notice of Privacy Practices.

Your request must state the specific restriction requested and to whom you want the restriction to apply.    Your physician is not required to agree to a restriction that you may request.    If the physician believes it is in your best interest to permit use and disclosure of your protected health information, your protected health information will not be restricted.    You then have the right to use another Healthcare Professional.

You have the right to request to receive confidential communications from us by alternative means or at an alternative location.    You have the right to obtain a paper copy of this notice from us, upon request, even if you have agreed to accept this notice alternatively, i.e., electronically. You have the right to have your physician amend your protected health information.    If we deny your request for amendment, you have the right to file a statement of disagreement with us and we may prepare a rebuttal to your statement and will provide you with a copy of any such rebuttal.

You have the right to receive an accounting of certain disclosures we have made, if any, of your protected health information.

Complaints You may complain to us or to the Secretary of Health and Human Services if you believe your privacy rights have been violated by us.    You may file a complaint with us by notifying our privacy contact of your complaint.    We will not retaliate against you for filing a complaint.

Changes to this notice We may change this notice and make it effective for medical information we already have about you, as well as new information.    The current notice will be posted and available at all times.   You have a right to request a paper copy of the current notice at any visit or by written request.