HIPAA Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

This Notice of Privacy Practices (the “Notice”) applies to Lucid Diagnostics Inc. and all of its subsidiaries (“Lucid”, “we”, “us”, and “our”), where applicable. 

Under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), Lucid is required by law to maintain the privacy of identifying health information, called protected health information (“PHI”), and to provide you with notice of our legal duties and privacy practices regarding PHI. Lucid is committed to the protection of your PHI and will make reasonable efforts to maintain the confidentiality of your PHI, as required by statute and regulation. We take this commitment seriously and will work with you to comply with your right to receive certain information under HIPAA.

What PHI We Collect

We attempt to collect the minimal amounts of information necessary for Lucid to provide our services to you and to obtain payment for those services, as well as for the other uses and disclosures outlined below. This may include your name, address, telephone number, date of birth, medical history, diagnosis, treatment, provider identification, financial responsibility, health insurance coverage (including group numbers and member identification numbers), and payment information.

Security of Your PHI

Lucid is committed to protecting the privacy and security of your PHI. Access to your PHI is limited to Lucid employees, workforce members, business associates, contractors, and other authorized individuals who need the information to provide healthcare services, support our operations, process payment, or perform other functions permitted by law.

Please note that email communications you initiate with Lucid regarding your PHI may not be secure. As a general practice, Lucid will not communicate PHI by email unless the communication is appropriately secured or you have requested or authorized communication by email and acknowledge the associated risks.

Your Rights Regarding Your PHI

You have certain rights pertaining to your PHI. This section explains your rights and some of our responsibilities. You have the right to:

Receive an electronic or paper copy of your PHI

  • You can ask to see or get an electronic or paper copy of your medical record and other PHI. 
  • With certain exceptions, we will provide a copy or a summary of your PHI, usually within 30 days of your request.  We may charge a reasonable, cost-based fee.
  • You can request a copy of your PHI by contacting us using the contact information at the end of this Notice.
  • If we deny your request, in whole or in part, as permitted by HIPAA and applicable law, you will receive a timely written notice explaining the reason for the denial, whether you have the right to have the denial reviewed, and how to file a complaint. 

Request an Amendment to Your PHI

  • You may request changes to your PHI by making a written request. To request an amendment, you must send a written request to Lucid at the contact information listed below. You must include a reason that supports your request. We may process your request in accordance with our policy, but original information will not be removed.
  • We may deny your request in some cases for various reasons, including if we determine the PHI is accurate and complete or if we did not create the information.
  • If we approve your request, we will amend the applicable record, notify you of the amendment, and make reasonable efforts to inform other persons or entities who have the information and may rely on it, as appropriate.  
  • If we deny your request to change your PHI, we will provide you with a timely written explanation of the reason for the denial. You have the right to submit a written statement of disagreement, which will become part of your record. We will also include your amendment request, our denial, and any statement of disagreement, as applicable, with future disclosures of the relevant PHI, as required by law.

Request confidential communication by alternative means or at alternative locations

  • You can ask us to contact you in a specific way (for example, home, office, or cell phone) or to send mail to a different address, and we will comply with all reasonable requests.

Ask to limit the PHI Lucid uses or discloses

  • You can ask us not to use or share certain health information for treatment, payment, or our operations. We are not required to agree to your request, and we may say “no,” for example, if it could affect your care. 
  • If we agree to your request, we may still share this information in the event that you need emergency treatment.
  • If you pay for a service or health care item out-of-pocket in full, you can ask us not to share that information for the purpose of payment or operations with your health insurer. We will comply unless a law requires us to share that information.
  • All requests for restrictions on the use or disclosure of your PHI must be submitted in writing to Lucid at the contact information listed below. We retain the right to terminate an agreed-to restriction if we believe such termination is appropriate. In the event we have terminated an agreed-to restriction, we will notify you of such termination.
  • All documentation related to your request, including any written or electronic records, will be retained for at least six (6) years, as required by applicable law.  

Get a list of those with whom we’ve shared your information

  • You can ask for a list (accounting) of the times we’ve shared your PHI for six (6) years prior to the date you ask, who we shared it with, and why.
  • We will include all the disclosures except for those about treatment, payment, and health care operations, and certain other disclosures (such as any you asked Lucid to make).  
  • We’ll provide one accounting a year for free but will charge a reasonable, cost-based fee if you ask for another one within 12 months.
  • To request an accounting, you must submit your request in writing using the contact information provided below. Your request must specify the time period for which you are requesting the accounting, which may not exceed six (6) years before the date of your request.

‍

Choose someone to act on your behalf as it relates to your PHI

  • If you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your PHI.
  • We will verify that the person has this authority and can act for you before we take any action.

File a complaint if you believe your privacy rights have been violated

  • If you believe your privacy rights have been violated, you have the right to file a complaint with us by contacting us using the information at the end of this Notice.
  • You also have the right to file a complaint with the Secretary of the U.S. Department of Health and Human Services, Office for Civil Rights.
  • We will not retaliate against you for filing a complaint.

Receive a paper copy of this Notice

  • You may request a paper copy of this Notice at any time, even if you have agreed to receive it electronically. Requests may be submitted in writing or electronically using the contact information provided below. We will provide you with a paper copy promptly.

Your Choices

If you have a clear preference for how we disclose your information in the situations described below, please let us know by contacting us using the information at the end of this Notice.

You have both the right and choice to tell Lucid how to disclose your PHI in the following ways:

  • With your friends, family, or others involved in your care
  • Response to a disaster relief situation

Use and Disclosure of PHI With Your Consent

Lucid will obtain your written authorization before using or disclosing your PHI for purposes other than those provided for in this Notice (or as otherwise permitted or required by law). Examples include any uses and disclosures of your PHI for marketing purposes, and disclosures that constitute a sale of PHI require your written authorization. You may revoke this authorization in writing at any time. Upon receipt of the written revocation, we will stop using or disclosing your PHI, except to the extent that we have already taken action in reliance on the authorization.

Use and Disclosure of Your PHI Without Your Consent

We may use or disclose your PHI in the following ways. When the HIPAA minimum necessary standard applies, we will limit uses and disclosures to the minimum necessary PHI. Other uses and disclosures not described in this Notice will be made only with your written authorization.

Treatment

We may use and disclose your health information with other healthcare professionals involved in your treatment. For example, we may disclose your PHI to authorized healthcare providers who order laboratory tests or need access to your test results for treatment purposes.

Payment

We may use and disclose your PHI to others for purposes of receiving payment for treatment and services that you receive. For example, we will submit a claim to you, your health care provider, or your health plan/insurer that includes information that identifies you and the type of services we performed for you.

Healthcare Operations

We may use and share your health information to run our business, improve your care, and contact you when necessary. For example, we may use health information about you in connection with internal operations as they relate to your test results. We may also disclose your PHI to your healthcare provider for a quality-related health care operation activity or for the purpose of health care fraud and abuse detection or compliance. We may also use your biological samples that remain after we perform testing for quality assurance, test validation, training and similar purposes.

De-identified Information

We may use your PHI to create “de-identified” information, which means that we remove information that can be used to identify you. There are specific rules under the law about what type of information needs to be removed before information is considered de-identified. Once information has been de-identified as required by law, it is no longer PHI, and we may use it for any lawful purpose.

Business Associates

Lucid may contract with business associates to perform certain services on our behalf. We may disclose your PHI to these business associates as necessary for them to provide those services. Our business associates are required by law and by contract to protect the privacy and security of your PHI. For example, our business associates may use your PHI to process billing services on our behalf.

Communication about Products and Services

We may use and disclose your PHI to contact you about other Lucid products and services that we believe may be of interest to you. We do not disclose your PHI to third parties for marketing purposes without your written authorization.

To Communicate with Individuals Involved in Your Care or for Payment of Your Care

We may disclose relevant PHI to a family member, friend, caregiver or other person you identify who is involved in your healthcare or payment for your healthcare if you agree or do not object. We may also make such disclosures if, based on our professional judgment, we believe they are in your best interest when you are unable to agree or object.

Research

We may use and disclose your PHI, including from leftover tissue, cells, and/or DNA or RNA extracted from your cells during cell collection, for research purposes as follows:

  • Research with authorization. In many cases, we will obtain your written authorization before using or disclosing your PHI with others to conduct research.
  • Research without authorization. HIPAA permits us, in certain circumstances, to use or disclose your PHI for research without your written authorization, including when:
    • an Institutional Review Board or Privacy Board has approved the research or granted a waiver of authorization;
    • the research involves a Limited Data Set pursuant to an appropriate Data Use Agreement, where required; or
    • the use or disclosure is solely for purposes of preparing a research protocol or for other activities preparatory to research. In such cases, Lucid will ensure the PHI is not used outside the company, that the PHI is necessary for the research purpose, and that the use or disclosure otherwise complies with applicable HIPAA requirements.
  • Research databases. Lucid may maintain databases containing PHI, including information associated with cell collection samples, for purposes of facilitating future research and scientific discoveries.
  • Cell collection samples. In connection with our laboratory testing services, we may retain leftover tissue, cells, and/or DNA or RNA extracted from your cells. We may use these samples for internal purposes, including quality assurance and test validation, and may use such samples in de-identified form for research purposes, both internally and in collaboration with external research partners. 
  • Deceased patients. We may use or disclose PHI about deceased patients to researchers if certain requirements are met

Law Enforcement Activities, Legal Proceedings, and As Permitted by Law

We may disclose your PHI when required by federal, state, or local law or for law enforcement purposes as permitted by law. For example, we may disclose your PHI in response to a valid court, administrative order, subpoena, or other legal process.

Other Uses and Disclosures

As permitted by HIPAA, we may disclose your PHI to regulatory bodies.

We may also disclose PHI to those assisting in disaster relief efforts so that family or friends can be notified about your condition, status and location.

Incidental Uses and Disclosures

Sometimes, your PHI may be used or disclosed incidentally in the course of our permitted uses and disclosures, such as during discussions with your treating physician or in the course of our billing operations. We are permitted to make such incidental uses and disclosures as long as we take reasonable steps to minimize them, and have in place appropriate safeguards to protect the privacy of your information.

Note Regarding State Law

For all of the above purposes, when state law is more restrictive than federal law, we are required to follow the more restrictive state law.

Our Responsibilities

  • We are required by law to maintain the privacy and security of your PHI. 
  • We will let you know if a breach occurs that has compromised the privacy or security of your PHI promptly, but in no event later than sixty (60) calendar days after Lucid’s discovery of the breach, unless a law enforcement official requires us to delay the breach notification.
  • We are required to comply with this Notice and make this Notice available to you.
  • We will never market or sell your PHI without your express written authorization.
  • We will not use or share your information other than as described here unless you approve these disclosures in writing. If you approve, you may change your mind at any time by notifying us in writing.

For more information see: www.hhs.gov/ocr/privacy/hipaa/understanding/consumers/noticepp.html

Changes to the Terms of this Notice

We can change the terms of this Notice, and the changes will apply to all information we have about you. The new Notice will be available upon request and on our web site.

Effective Date of Notice: September 2, 2026

Contact Information

Compliance@luciddx.com 

Lucid Diagnostics
360 Madison Ave, Floor 25
New York, New York 10017

‍