Privacy Statement

Compliance with Applicable Privacy Laws and Regulations

PSI operates in compliance with all applicable federal and state privacy laws, including but not limited to:

•Health Insurance Portability and Accountability Act (HIPAA) — governing the use and disclosure of Protected Health Information(PHI)

•California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) — governing the rights of California residentsregarding their personal information

•California Confidentiality of Medical Information Act (CMIA)

•Applicable federal and state telehealth privacyregulations

PSI ensures ongoing compliance through the following measures:

•Regular internal privacy audits and staff training on HIPAA and applicable state laws

•Appointment of a designated Privacy Officer responsible for policy oversight and enforcement

•Implementation of administrative, physical, and technical safeguards to protect PHI and personal data

•Business Associate Agreements (BAAs) with all third-party vendors who handle PHI on our behalf

•Policies and procedures for responding to data breaches in accordance with HIPAA Breach Notification Rules

Patients may contact our Privacy Officer with any concerns regarding privacy compliance at the contact information listed at the end of this policy.

Notice of Privacy Practices (HIPAA)

As a HIPAA-covered healthcare provider, PSI maintains a Notice of Privacy Practices (NPP) that describes how we may use and disclose your Protected Health Information (PHI), and your rights regarding that information.

Your PHI is used and disclosed only as permitted or required under HIPAA, including for purposes of treatment, payment, and healthcare operations. PSI does not sell your PHI.

Our Notice of Privacy Practices is available here. A paper copy is available upon request at any of our clinic locations.

Collection of Your Personal Information

Information You Provide

PSI may collect personally identifiable information (PII) that you voluntarily provide, including:

•Full name, email address, mailing address, and phone number

•Date of birth and demographic information

•Health and treatment-related information (when provided in the context of our services)

•Insurance and billing information

•Appointment preferences and communications

Information Collected Automatically

When you visit our website, we automatically collect certain technical data, including:

•IP address and browser type

•Pages visited, access times, and referring URLs

•Device identifiers and operating system information

This data is used to operate and improve our website and is not used to personally identify you unless combined with other information you have provided.

Use of Your Personal Information

PSI uses your personal information to:

•Operate our website and deliver services you have requested

•Schedule and manage appointments

•Communicate with you regarding your care, including appointment reminders via SMS or email

•Send you newsletters and updates if you have opted in

•Conduct internal research and improve our services

•Comply with applicable legal and regulatory obligations

If you consent to receive SMS, emails, and/or other electronic communications from PSI, you agree to receive marketing and informational emails and appointment/clinic reminder SMS. Reply STOP to opt out of SMS; reply HELP for support. Message and data rates may apply. Messaging frequency may vary.

Disclosure of Your Personal Information

PSI does not sell, rent, or lease your personal information to third parties.

We may share your information in the following limited circumstances:

•With trusted service providers who assist us in operating our website or delivering services (e.g., scheduling platforms, email service providers), subject to confidentiality obligations and, where applicable, Business Associate Agreements

•As required by law, regulation, court order, or government authority

•In connection with a merger, acquisition, or sale of assets, with appropriate notice to affected individuals

•With your explicit consent

PSI does not use or disclose sensitive personal information — such as race, religion, or political affiliations — without your explicit consent.

California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the following rights regarding your personal information:

•Right to Know: You may request information about the categories and specific pieces of personal data we have collected about you.

•Right to Delete: You may request that we delete your personal information, subject to certain exceptions.

•Right to Correct: You may request that we correct inaccurate personal information we hold about you.

•Right to Opt Out: You have the right to opt out of the sale or sharing of your personal information. PSI does not sell personal information.

•Right to Non-Discrimination: PSI will not discriminate against you for exercising your privacy rights.

To exercise any of these rights, please contact us using the information provided at the end of this policy. We will respond to verified requests within 45 days as required by law.

Cookies and Tracking Technologies

Our website uses cookies and similar tracking technologies to personalize your online experience and analyze website usage. A cookie is a small text file placed on your device by a web server.

You can control cookie preferences through your browser settings. Please note that disabling certain cookies may affect the functionality of our website. For more information, please see our Cookie Notice available in the website footer.

Security of Your Personal Information

PSI implements administrative, physical, and technical safeguards to protect your personal and health information from unauthorized access, use, or disclosure. These measures include:

•Encryption of data in transit using Secure Socket Layer (SSL/TLS) protocols

•Access controls limiting data access to authorized personnel only

•Regular security assessments and staff training

While we take reasonable precautions to protect your information, no data transmission over the internet is completely secure. We encourage you to take steps to protect your own information as well.

Retention of Your Information

PSI retains personal information and PHI for as long as necessary to fulfill the purposes for which it was collected, to provide services, and to comply with applicable legal and regulatory requirements, including HIPAA medical records retention requirements.

Third-Party Website Links

Our website may contain links to third-party websites. PSI is not responsible for the privacy practices or content of those websites. We encourage you to review the privacy policies of any third-party sites you visit.

Children’s Privacy

Our website is not directed to individuals under the age of 18. PSI does not knowingly collect personal information from minors. If you believe we have inadvertently collected information from a minor, please contact us immediately.

Changes to This Privacy Policy

PSI may update this Privacy Policy periodically to reflect changes in our practices, legal requirements, or operational needs. The “Last Updated” date at the top of this page reflects the most recent revision. We encourage you to review this policy periodically.

For material changes, we will provide notice on our website or by direct communication where required by law.

Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or how PSI handles your personal or health information, please contact us:

TRIP Clinics at Psychedelic Science Institute (PSI)

Privacy Officer

522 N. Larchmont Blvd., Los Angeles, CA 90004

Phone: 310-996-8966

Website: www.psychedelicsci.com