Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Who This Notice Applies To

This Notice of Privacy Practices applies to Corva Medical, operated by Gbogbo Integrative Medicine PLLC, and to the healthcare providers and workforce members who provide services on behalf of our practice. We are required by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its implementing regulations to maintain the privacy of your protected health information (PHI), to provide you with this Notice of our legal duties and privacy practices with respect to your PHI, and to follow the terms of the Notice currently in effect.

Your Protected Health Information

Protected health information (PHI) includes information that identifies you or could reasonably be used to identify you, and that relates to your past, present, or future physical or mental health or condition; the provision of healthcare to you; or the past, present, or future payment for that care.

How We May Use and Disclose Your Health Information

The following categories describe the ways we may use and disclose your PHI. Not every use or disclosure is listed, but all permitted uses and disclosures fall within one of the categories below.

Treatment

We may use your PHI to provide, coordinate, or manage your healthcare and any related services. For example, we may share your health information with other providers involved in your treatment (such as specialists, labs, or pharmacies), or use it to develop and communicate a treatment plan with you. We use CharmHealth as our electronic health records system to document and coordinate your care.

Payment

Corva Medical is a cash-pay practice and does not bill insurance carriers on your behalf. We may use your PHI to process your payment for services rendered, provide receipts, or respond to questions about your account.

Healthcare Operations

We may use and disclose your PHI to carry out the administrative, financial, legal, and quality-improvement activities necessary to run our practice. This includes reviewing and improving care quality, training staff and students, conducting audits, managing business operations, and complying with applicable laws and regulations.

Communication With You

We may contact you to provide appointment reminders, follow up on your care, share information about treatment alternatives, or communicate about services that may be of interest to you. We will use the contact method you provide unless you request a specific alternative. Secure clinical messaging is facilitated through Spruce Health.

Business Associates

We may disclose your PHI to third-party service providers (“Business Associates”) who perform services on our behalf, such as electronic health records management (CharmHealth), secure messaging (Spruce Health), and other operational functions. We require Business Associates to safeguard your PHI under a Business Associate Agreement in accordance with HIPAA requirements.

Required by Law

We may use or disclose your PHI when required to do so by federal, state, or local law, including disclosures to public health authorities, law enforcement officials, or oversight agencies as legally mandated.

Public Health Activities

We may disclose your PHI for public health activities authorized by law, including reporting communicable diseases, adverse reactions to medications or products, or child or adult abuse or neglect as required under Iowa or Nebraska law.

Health Oversight Activities

We may disclose your PHI to health oversight agencies conducting audits, investigations, inspections, licensure, or other oversight activities authorized by law.

Judicial and Administrative Proceedings

We may disclose your PHI in response to a court or administrative order, subpoena, or discovery request, provided appropriate protections are in place or required by law.

Law Enforcement

We may disclose PHI to law enforcement officials in limited circumstances permitted by law, including to comply with a court order, warrant, or subpoena, or to report certain crimes.

Coroners, Medical Examiners, and Funeral Directors

We may disclose PHI to coroners, medical examiners, or funeral directors as necessary to carry out their duties.

Organ and Tissue Donation

We may disclose PHI to organizations involved in procurement, banking, or transplantation of organs, eyes, or tissue for donation and transplant purposes.

Research

We may use or disclose your PHI for research purposes subject to privacy-board oversight or when an individual authorization waiver has been granted, consistent with applicable law.

Serious Threat to Health or Safety

We may use or disclose PHI if we believe in good faith that doing so is necessary to prevent or lessen a serious and imminent threat to the health or safety of you or another person, or to the public.

Specialized Government Functions

We may disclose PHI to authorized federal officials for national security or intelligence activities, or to protect the President, other authorized persons, or foreign heads of state.

Workers’ Compensation

We may disclose PHI as authorized by and to the extent necessary to comply with workers’ compensation laws and other similar programs.

Uses and Disclosures Requiring Your Authorization

Most uses and disclosures of your PHI beyond those described above require your written authorization. This includes, but is not limited to, most uses and disclosures of psychotherapy notes; uses and disclosures of PHI for marketing purposes; and sale of PHI. You may revoke a previously given authorization at any time in writing, except to the extent that we have already acted in reliance on that authorization.

Your Rights Regarding Your Health Information

Right to Access Your Records

You have the right to inspect and obtain a copy of your PHI that we maintain in a designated record set, including your medical records and billing records. We may charge a reasonable, cost-based fee for copies. We will respond to your request within the timeframes required by law. To request access to your records, contact us using the information below or submit a request through the patient portal.

Right to Request an Amendment

If you believe that information in your record is inaccurate or incomplete, you have the right to request an amendment. We may deny the request under certain circumstances permitted by law, and we will provide a written explanation if we deny it. If we accept the amendment, we will make reasonable efforts to inform relevant parties of the change.

Right to an Accounting of Disclosures

You have the right to receive an accounting of certain disclosures of your PHI made by us during the six years prior to your request. This right does not apply to disclosures made for treatment, payment, or healthcare operations, or to disclosures you authorized.

Right to Request Restrictions

You have the right to request restrictions on how we use or disclose your PHI for treatment, payment, or healthcare operations, or to certain individuals involved in your care. We are not required to agree to a requested restriction except in one circumstance: if you pay out-of-pocket in full for a specific service and request that we not share information about that service with a health insurer, we must comply with that restriction.

Right to Request Confidential Communications

You may request that we communicate with you about your health information using an alternative means or at an alternative location. For example, you may ask that we contact you only by phone at a specific number or only by written mail at an address other than your home. We will accommodate reasonable requests.

Right to a Paper Copy of This Notice

You have the right to a paper copy of this Notice at any time, even if you have agreed to receive it electronically. To request a paper copy, contact us at the address below.

Our Duties

We are required by law to:

• Maintain the privacy of your PHI.
• Provide you with notice of our legal duties and privacy practices with respect to PHI.
• Notify you following a breach of your unsecured PHI as required by law.
• Abide by the terms of the Notice currently in effect.

Changes to This Notice

We reserve the right to change this Notice and to make the revised Notice effective for PHI we already hold as well as any PHI we receive in the future. We will post the current version of this Notice at https://corvamedical.com/hipaa-notice and make it available at our office. The revised Notice will include the date it was last updated.

Complaints

If you believe your privacy rights have been violated, you have the right to file a complaint with us or with the U.S. Department of Health and Human Services Office for Civil Rights. To file a complaint with us, contact us using the information below. To file a complaint with the federal government, visit hhs.gov/hipaa. We will not retaliate against you for filing a complaint.

Privacy Contact

For questions about this Notice, to exercise any of your rights described above, or to file a privacy complaint, please contact us:

Corva Medical
Privacy Contact: Yaovi Tony Gbogbo, DNP
10530 New York Ave, Suite 2
Urbandale, IA 50322
Phone / Text: (515) 474-7912
Email: info@corvamedical.com

Effective Date

This Notice of Privacy Practices is effective as of April 23, 2026.