Privacy Policy & Notice of Privacy Practices

Effective Date of This Notice: April 25, 2026 Last Reviewed: May 1, 2026

At Discovery Transitions Outpatient (“we,” “our,” “us,” or “the Program”), we are committed to protecting the privacy and confidentiality of your personal and health information. This Privacy Policy and Notice of Privacy Practices (“Notice”) explains how we collect, use, disclose, and safeguard your information when you visit our website, contact us, or receive services from us.

We comply with all applicable federal and state privacy laws, including the Health Insurance Portability and Accountability Act of 1996 (HIPAA), 45 CFR Parts 160 and 164, and the Federal Confidentiality of Substance Use Disorder Patient Records regulations under 42 CFR Part 2.

We are required by law to:

• Maintain the privacy of your Protected Health Information (PHI)
• Provide you with this Notice of our legal duties and privacy practices
• Notify you in the event of a breach of your unsecured PHI
• Abide by the terms of the Notice currently in effect

---

Provider Information

In accordance with California Business and Professions Code § 680.5(e) and LegitScript healthcare merchant certification standards, Discovery Transitions Outpatient discloses the following information about our licensed healthcare providers. All providers listed are actively licensed, in good standing, and authorized to practice in the state where services are rendered.

Dr. Jason Erik Giles, M.D.

You may independently verify this provider’s license at: 🔗 https://www.mbc.ca.gov/Licensing/Physician-Surgeon/License-Verification.aspx

---

Our Commitment to Compliance

Discovery Transitions Outpatient is committed to full compliance with California law and LegitScript healthcare merchant certification standards. As a provider-operated program, we have implemented the following measures:

Provider Credentialing & Primary Source Verification

We maintain a robust credentialing and primary source verification process to confirm that all providers are:

• Actively licensed with no lapse in licensure
• In good standing with their respective licensing boards
• Free of disciplinary actions, sanctions, or restrictions
• Authorized to practice in the state where the patient is located

All provider credentials are verified at the time of hire and monitored on an ongoing basis through direct verification with applicable state licensing boards.

Transparency During Patient Intake

Provider identity, licensure, and credentials are disclosed to all patients during the intake and informed consent process, consistent with California telehealth best practices and applicable state and federal regulations. Patients are informed of:

• The name and credentials of their treating provider
• The provider’s state of licensure and license number
• Their right to verify provider credentials independently
• Their right to refuse treatment or request a different provider

Accurate Representations

We ensure that all representations of our providers and services across our website and marketing materials are:

• Accurate and truthful
• Non-misleading and not deceptive
• Compliant with applicable healthcare advertising laws
• Free of unsubstantiated claims or guarantees of outcomes

Ongoing Regulatory Monitoring

We are committed to ongoing monitoring of state-specific telemedicine regulations, California Business and Professions Code requirements, DHCS licensing standards, and LegitScript certification requirements. We will update our disclosures, policies, and procedures as needed to maintain continuous compliance.

---

Facility Licensing Information

Discovery Transitions Outpatient is licensed and certified by the California Department of Health Care Services (DHCS) to operate an alcohol and/or other drug program.

Complaints regarding services provided in this facility may be directed to:

California Department of Health Care Services Licensing and Certification Division — Complaints Section, MS 2601 P.O. Box 997413, Sacramento, CA 95899-7413 📞 (877) 685-8333 / (916) 322-2911 📠 Fax: (916) 440-5094 ✉️ SUDComplaints@dhcs.ca.gov

---

Special Protections for Substance Use Disorder Records (42 CFR Part 2)

This section contains important federal protections that apply specifically to your substance use disorder treatment records.

Because Discovery Transitions Outpatient is a federally assisted substance use disorder (SUD) treatment program, your records are protected by federal law under 42 CFR Part 2 (Confidentiality of Substance Use Disorder Patient Records). These protections are stricter than general HIPAA rules and apply in addition to HIPAA.

What This Means for You

Federal law and regulations prohibit this Program from making any disclosure of your SUD patient records to any person outside of this Program without your written consent, unless an exception applies.

Your SUD records cannot be shared — even with other treating physicians, hospitals, family members, employers, law enforcement, or other programs — without your written authorization, except in limited circumstances described below.

Permitted Disclosures Without Your Written Consent Under 42 CFR Part 2

We may disclose your SUD records without your written consent only in the following limited situations:

• Medical emergency — To medical personnel to the extent necessary to meet a bona fide medical emergency
• Research, audit, or program evaluation — To qualified personnel for research, audit, or program evaluation purposes, subject to restrictions
• Court order — Pursuant to a court order that meets specific requirements under 42 CFR Part 2
• Crime on program premises or against program personnel — To report a crime committed on program premises or against program staff
• Child abuse or neglect reporting — As required by state law to report suspected child abuse or neglect
• Mandatory reporting — As otherwise required by applicable state or federal law

Your Written Consent for Disclosures

For any disclosure not covered by the above exceptions, we are required to obtain your signed written consent that includes:

• The name of the program making the disclosure
• The name of the person or organization receiving the information
• The name of the patient
• The purpose of the disclosure
• How much and what kind of information will be disclosed
• Your signature and the date
• A statement that you may revoke your consent at any time
• The expiration date or event for the consent

Your Right to Revoke Consent

You may revoke your consent to disclosure at any time, except to the extent that action has already been taken based on that consent.

Federal Prohibition on Re-Disclosure

Any disclosure made with your consent carries with it a prohibition on re-disclosure. The person or organization receiving your information may not re-disclose it to any other party without your separate written authorization unless otherwise permitted by 42 CFR Part 2.

Criminal Penalties

Violations of 42 CFR Part 2 are a federal crime. Any person who violates these regulations may be criminally penalized under federal law.

---

Notice of Privacy Practices (HIPAA)

Effective Date: April 25, 2026

This Notice of Privacy Practices describes how Discovery Transitions Outpatient may use and disclose your Protected Health Information (PHI) and how you can access this information. Please review it carefully.

Protected Health Information (PHI) includes any individually identifiable information that relates to your past, present, or future physical or mental health condition, the provision of healthcare to you, or payment for healthcare services.

---

Uses and Disclosures of PHI Without Your Authorization

We may use and disclose your PHI without your written authorization for the following purposes:

1. Treatment

We may use and disclose your PHI to provide, coordinate, or manage your healthcare and related services. This includes sharing information with physicians, therapists, counselors, psychiatrists, case managers, laboratories, pharmacies, or other healthcare providers who are involved in your care.

Note: For substance use disorder treatment records, the more restrictive rules of 42 CFR Part 2 apply. Please see the section above.

2. Payment

We may use and disclose your PHI to obtain payment for services we provide to you. This includes submitting claims to your insurance company, verifying your eligibility and benefits, and responding to coverage inquiries.

3. Healthcare Operations

We may use and disclose your PHI for our general healthcare operations, including:

• Quality assessment and improvement activities
• Staff training, supervision, and credentialing
• Licensing, accreditation, and certification reviews
• Internal audits and compliance reviews
• Business planning and management
• Customer service activities

4. As Required by Law

We will disclose your PHI when required to do so by applicable federal, state, or local law.

5. Public Health and Safety Activities

We may disclose your PHI to authorized public health authorities for activities such as:

• Preventing or controlling disease, injury, or disability
• Reporting births, deaths, or specific diseases as required by law
• Reporting adverse reactions to medications or products
• Reporting suspected abuse, neglect, or domestic violence to appropriate authorities

6. Health Oversight Activities

We may disclose your PHI to government agencies authorized to conduct audits, investigations, inspections, and licensure or disciplinary actions related to the healthcare system.

7. Law Enforcement and Legal Proceedings

We may disclose your PHI in response to a court order, subpoena, warrant, summons, or other lawful process, and to law enforcement officials as permitted by law.

Note: For substance use disorder records, 42 CFR Part 2 imposes additional restrictions on disclosures to law enforcement. A court order meeting specific federal requirements is required.

8. Serious Threats to Health or Safety

We may use or disclose your PHI when necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public, consistent with applicable law and ethical standards.

9. Workers’ Compensation

We may disclose your PHI as authorized or required by workers’ compensation laws to the extent necessary to comply with those laws.

10. Coroners, Medical Examiners, and Funeral Directors

We may disclose PHI to a coroner or medical examiner to identify a deceased person or determine the cause of death, and to funeral directors as necessary.

11. Organ and Tissue Donation

We may disclose PHI to organizations that handle organ procurement, eye banks, or tissue banks if you are an organ donor.

12. Military and Veterans

If you are a member of the armed forces, we may disclose your PHI as required by military command authorities.

13. National Security and Intelligence Activities

We may disclose your PHI to authorized federal officials for intelligence, counterintelligence, and other national security activities authorized by law.

14. Appointment Reminders and Health-Related Communications

We may contact you to provide appointment reminders, information about treatment alternatives, or other health-related benefits and services that may be of interest to you.

15. Fundraising Activities

We may contact you for fundraising purposes. Any such communication will include instructions on how to opt out of future fundraising communications. You have the right to opt out of receiving fundraising communications at any time by contacting us at the information provided at the end of this Notice.

---

Minimum Necessary Standard

When using or disclosing PHI or requesting PHI from another provider, we make reasonable efforts to limit the information to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request.

---

Uses and Disclosures Requiring Your Written Authorization

We will obtain your written authorization before using or disclosing your PHI for purposes not otherwise permitted by law, including:

• Most uses and disclosures of psychotherapy notes
• Uses and disclosures of PHI for marketing purposes
• Disclosures that constitute a sale of PHI
• Any other use or disclosure not described in this Notice

You may revoke your authorization at any time by submitting a written revocation to us. Your revocation will be effective for future uses and disclosures, except to the extent we have already acted in reliance upon your authorization.

---

Your Rights Regarding Your PHI

You have the following rights with respect to your PHI. To exercise any of these rights, please submit a written request to us using the contact information at the end of this Notice.

Right to Access Your Records

You have the right to inspect and obtain a copy of your PHI that we maintain in a designated record set, which includes your medical records and billing records. We may charge a reasonable cost-based fee for copies. We will respond to your request within 30 days.

Right to Request Amendment

You have the right to request that we amend PHI or a record about you that you believe is incorrect or incomplete. We may deny your request if the information was not created by us, is not part of the records we maintain, or is accurate and complete. If we deny your request, we will provide you with a written explanation.

Right to Request Restrictions on Use or Disclosure

You have the right to request that we restrict how we use or disclose your PHI for treatment, payment, or healthcare operations. We are not required to agree to your request except in one situation: if you pay out of pocket in full for a service and request that we not disclose information about that service to your health plan, we must comply with that request.

Right to Restrict Disclosures to Your Health Plan

If you pay out of pocket in full for any healthcare service, you have the right to request that we not disclose PHI related to that service to your health plan or insurer. We are required by law to honor this request.

Right to Request Confidential Communications

You have the right to request that we communicate with you about your PHI in a certain way or at a certain location. For example, you may ask that we only contact you at a specific phone number or mailing address. We will accommodate reasonable requests.

Right to an Accounting of Disclosures

You have the right to request a list of certain disclosures of your PHI that we have made in the past six (6) years. This does not include disclosures made for treatment, payment, or healthcare operations, or disclosures made with your authorization.

Right to a Paper Copy of This Notice

You have the right to obtain a paper copy of this Notice at any time, even if you have previously agreed to receive it electronically. To request a paper copy, contact us at the information below or ask at our front desk.

Right to Be Notified of a Breach

You have the right to receive notification in the event that we discover a breach of your unsecured PHI. We will notify you without unreasonable delay and no later than 60 days after discovery of the breach, as required by the HIPAA Breach Notification Rule (45 CFR §§ 164.400–414).

Right to Opt Out of Fundraising

You have the right to opt out of receiving fundraising communications from us at any time. To opt out, contact us in writing at the information provided at the end of this Notice.

---

Breach Notification

In the event of a breach of your unsecured PHI, we will:

• Notify you individually in writing (or by phone in urgent situations) within 60 days of discovering the breach
• Notify the U.S. Department of Health and Human Services (HHS)
• If the breach affects 500 or more individuals in a state or jurisdiction, notify prominent media outlets in that area

We will provide you with a description of the breach, the types of information involved, steps you should take to protect yourself, what we are doing to investigate and mitigate the breach, and contact information for questions.

---

Website Privacy — Information We Collect

We may collect personal information that you voluntarily provide to us through our website, including:

• Full name
• Phone number
• Email address
• Mailing address
• Date of birth
• Insurance information
• Medical history or treatment-related information
• Information submitted through contact forms, appointment requests, or assessments
• Any other information you choose to provide

We may also automatically collect certain technical information when you visit our website, including:

• IP address
• Browser type and version
• Device type and operating system
• Pages visited and time spent on our website
• Referring website URLs
• Cookies and analytics data

---

How We Use Your Information

We may use your information to:

• Respond to inquiries or service requests
• Schedule consultations, assessments, or appointments
• Provide treatment-related services and support
• Verify insurance eligibility and benefits
• Process billing and payment
• Improve our website, services, and user experience
• Send service-related communications or updates
• Comply with legal, licensing, or regulatory obligations
• Protect against fraud, unauthorized access, or misuse

---

Sharing of Information

We do not sell, rent, or trade your personal information.

We may share your information only in the following circumstances:

• With healthcare providers directly involved in your care, subject to applicable restrictions under 42 CFR Part 2 and HIPAA
• With insurance providers for billing or eligibility verification, as permitted by law
• With trusted vendors or service providers who assist us in operating our business or website, under confidentiality agreements
• When required by law, court order, or legal process
• To protect the rights, property, or safety of our patients, staff, or the public
• With your written authorization

All authorized third parties are required to maintain the confidentiality and security of your information.

---

Cookies & Tracking Technologies

Our website may use cookies and similar technologies for analytics and performance monitoring. You may disable cookies through your browser settings, though some website features may not function properly as a result.

---

Third-Party Services

Our website may include or use third-party services such as:

• Analytics providers (e.g., Google Analytics)
• Form submission tools
• Hosting providers
• Advertising or remarketing platforms

These third parties may collect information subject to their own privacy policies. We are not responsible for the privacy practices of third-party services.

---

Data Security

We use reasonable and appropriate administrative, technical, and physical safeguards designed to protect your personal information and PHI from unauthorized access, use, alteration, or destruction.

However, no method of electronic transmission or storage can be guaranteed to be 100% secure. If you have reason to believe that your interaction with us is no longer secure, please contact us immediately.

---

California Privacy Rights

If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA) and other applicable California laws, including:

• The right to know what personal information we collect about you
• The right to request deletion of your personal information
• The right to opt out of the sale of your personal information
• The right not to be discriminated against for exercising your privacy rights

To exercise your California privacy rights, please contact us using the information below.

---

Children’s Privacy

Our website and services are not directed to children under the age of 13 without verifiable parental or legal guardian consent. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us immediately so we can delete it.

---

Changes to This Notice

We reserve the right to update or change this Privacy Policy and Notice of Privacy Practices at any time. Any material changes will be posted on this page with an updated Effective Date. We may also provide notice through other means as required by law. We encourage you to review this Notice periodically.

The most current version of this Notice is always available on our website and upon request at our facility.

---

How to File a Complaint

If you believe your privacy rights have been violated, you may file a complaint with us directly or with the following agencies. We will not retaliate against you in any way for filing a complaint.

U.S. Department of Health and Human Services — Office for Civil Rights (HIPAA): https://www.hhs.gov/hipaa/filing-a-complaint/

SAMHSA — Substance Use Disorder Record Violations (42 CFR Part 2): https://www.samhsa.gov/about-us/who-we-are/offices-centers/csat

California DHCS — Facility Service Complaints: Licensing and Certification Division — Complaints Section, MS 2601 P.O. Box 997413, Sacramento, CA 95899-7413 📞 (877) 685-8333

---

Contact Us

If you have questions about this Privacy Policy or Notice of Privacy Practices, wish to exercise any of your rights, need to request a paper copy of this Notice, or wish to opt out of fundraising communications, please contact us:

Discovery Transitions Outpatient 17635 Vanowen Street Van Nuys, CA 91406

📞 (818) 824-5022 ✉️ info@discoverytransitions.com

---

This Notice is effective as of April 25, 2026. Discovery Transitions Outpatient is required to abide by the terms of this Notice while it is in effect.