Effective Date: August 1, 2025

This Legal & Privacy Policy (“Policy”) governs the legal obligations, rights, and privacy protections applicable to services provided by Low T Medical Clinic (“Clinic,” “we,” “our,” or “us”). This Policy constitutes a binding agreement between the Clinic and all individuals (“Patient,” “you,” “your”) who access our website, utilize our telehealth platform, or receive care at in-person clinics.

By accessing our website, submitting medical information, or receiving services, you acknowledge and agree to this Policy. If you do not agree, you must immediately discontinue use of our services.

This Policy consolidates and governs the following:

• Terms & Conditions of Service

• HIPAA Notice of Privacy Practices

• State and Federal Privacy Disclosures

• Consumer Health Data Privacy Policy

1. Collection & Use of Information

We collect and process information, including Protected Health Information (PHI) and Consumer Health Data (CHD), from:

• Patient-submitted forms, telehealth consultations, and in-person visits

• Medical devices, diagnostic testing, and laboratory reporting

• Electronic communications and interactions with our website

We use this information solely to:

• Deliver medical treatment and pharmacy services

• Coordinate with healthcare providers, laboratories, and pharmacies

• Bill for services and comply with insurance and regulatory requirements

• Maintain quality, safety, and compliance

• Conduct internal audits, legal defense, and fraud prevention

We do not sell PHI or CHD. Information may be shared only as permitted by HIPAA, federal/state law, or pursuant to your written authorization.

2. HIPAA Notice of Privacy Practices

Your PHI is protected under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its implementing regulations.

Permitted Uses and Disclosures

• Treatment: Coordination of care with providers, pharmacies, and labs.

• Payment: Submission of claims to insurers and third-party payors.

• Healthcare Operations: Auditing, compliance, peer review, and training.

• Public Health & Legal: Required reporting to FDA, CDC, law enforcement, or pursuant to a valid subpoena or court order.

• Health & Safety: To prevent or mitigate imminent threats.

Patient Rights

You have the right to: request access to your PHI, receive copies, request amendments, request restrictions, request confidential communications, and obtain an accounting of disclosures, consistent with HIPAA standards.

3. State Privacy Rights & Consumer Health Data Laws

We comply with all applicable state privacy and consumer health data laws. To the extent a state law grants rights beyond HIPAA, the stricter standard applies.

• California (CCPA/CPRA): Patients may request disclosure, correction, or deletion of personal information and may opt out of its sale or sharing. If required, a “Do Not Sell or Share My Personal Information” link will be provided.

• New York (SHIELD Act): Reasonable administrative, physical, and technical safeguards are maintained to protect PHI and CHD.

• Florida (FIPA): Notice of a data breach will be provided within 30 days as required by law.

• Texas (TMRPA): PHI disclosures are logged, and access is limited to authorized healthcare personnel.

• Washington (My Health My Data Act): Restricts collection, sharing, and sale of consumer health data, including reproductive and biometric data.

• Nevada (NRS 603A): Grants opt-out rights for the sale of personal health data.

• Connecticut (CTDPA): Extends protections to consumer health data, including reproductive health information.

• Colorado Privacy Act (CPA): Provides the right to access, delete, and opt out of certain data uses.

• Other States: Where state law imposes stricter standards (e.g., Massachusetts Data Security Law, Illinois Biometric Information Privacy Act, Virginia CDPA), the Clinic adheres fully to such requirements.

4. Consumer Health Data

We may collect and process Consumer Health Data, including:

• Medical conditions, diagnoses, and treatment history

• Prescription and laboratory information

• Reproductive, gender, and biometric information

• Genetic and diagnostic testing data

Such data will never be sold. Disclosure occurs only as permitted by law, to fulfill treatment obligations, or pursuant to your explicit authorization.

5. Consent to Treatment

By receiving care, you expressly acknowledge and agree that:

• All treatments are elective and are not substitutes for primary or emergency care.

• Risks, alternatives, and potential side effects will be disclosed in advance.

• No medical outcomes are guaranteed.

• Fees for services and medications are non-refundable once provided.

• You will provide accurate medical history and update your provider of changes.

• You waive liability for disclosed risks inherent to your chosen treatment.

6. Prescribing of Controlled Substances via Telemedicine

Certain Clinic services may involve prescription of controlled substances, including testosterone (Schedule III).

6.1 Federal Compliance – Ryan Haight Act

• The Clinic complies with the Ryan Haight Online Pharmacy Consumer Protection Act (21 U.S.C. § 829(e)).

• Controlled substances may only be prescribed following a valid in-person evaluation, unless a federal telemedicine exception applies.

• Pursuant to DEA-issued COVID-era flexibilities, the Clinic currently provides controlled substance prescriptions via telemedicine where permitted.

• Living Policy Commitment: This Policy will automatically adjust to DEA requirements. Upon expiration of telemedicine flexibilities, the Clinic will transition to (a) in-person evaluations or (b) the DEA Special Registration framework (expected in 2026).

6.2 State Law Compliance

• California: A prior examination is required; telemedicine encounters must meet the standard of care equivalent to an in-person visit.

• New York: Prescribing must be in good faith and consistent with a legitimate medical purpose.

• Florida: Telehealth providers must be registered with the Florida DOH. Controlled substances are permitted only under strict statutory and medical board requirements.

• Texas: Telemedicine encounters must establish a valid physician-patient relationship, with controlled substances prescribed only in compliance with state law and DEA requirements.

• Other States: The Clinic complies with additional state restrictions and applies the stricter standard where applicable.

6.3 Documentation & Safeguards

• Prescriptions are issued only by DEA-registered providers licensed in the state of service.

• All prescriptions are transmitted via Electronic Prescribing of Controlled Substances (EPCS).

• Detailed medical records are maintained, including history, labs, treatment rationale, and informed consent.

6.4 Transition to DEA Special Registration (2026)

The Clinic will apply for DEA Special Registration immediately upon availability and will transition its prescribing model accordingly.

6.5 Patient Consent & Acknowledgment

By accepting treatment that may involve controlled substances, you agree that:

• Prescriptions will be provided only when medically necessary.

• Prescribing policies may change immediately upon regulatory updates.

• Misuse, diversion, or noncompliance may result in termination of care and referral to appropriate authorities.

7. Limitation of Liability

To the maximum extent permitted by law:

• The Clinic is not liable for indirect, incidental, consequential, punitive, or exemplary damages.

• Aggregate liability shall not exceed the total amount paid by you for services rendered.

• Services are provided “AS IS” and “AS AVAILABLE” without warranties, express or implied.

8. Indemnification

You agree to indemnify, defend, and hold harmless the Clinic, its physicians, employees, affiliates, and contractors from any claims, liabilities, damages, or expenses (including reasonable attorneys’ fees) arising out of:

• Your violation of this Policy

• Your misuse of services or medications

• False, misleading, or omitted medical disclosures

9. Dispute Resolution & Governing Law

This Policy shall be governed by HIPAA and the laws of the state in which services are rendered.

• Arbitration: Disputes shall be resolved by binding arbitration administered by the American Arbitration Association (AAA).

• Class Action Waiver: You waive the right to participate in any class or representative action.

• Severability: If any provision is found invalid, the remainder remains enforceable.

10. Disclosures & Disclaimers

• Report side effects to your provider, pharmacy, or the FDA at 1-800-FDA-1088.

• In case of emergency, call 911 immediately.

• Advertising may include paid actors or testimonials; results vary.

• Trademarks: Ozempic® and Wegovy® are registered marks of Novo Nordisk A/S. The Clinic makes no claim of ownership of third-party pharmaceutical trademarks.

11. Contact Information

Low T Medical Clinic
1370 Colorado Mills Parkway
Lakewood, CO 80401

📧 Email: orders@lowtmedicalclinic.com
📞 Phone: (800) 719-4409

Privacy Officer: Corey Counts – corey@lowtmedicalclinic.com