HIPAA Notice & Health Data Privacy

A1. Our Commitment to Your Health Information

The Valeo Experience Inc, through its clinician Dr. Jozelle M. Miller, PhD, is required by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) to maintain the privacy of your Protected Health Information (PHI), to provide you with this Notice of Privacy Practices, and to follow the terms of the notice currently in effect.

PHI is information that identifies you and relates to your past, present, or future physical or mental health, the healthcare services we provide you, or the payment for those services.

A2. How We May Use and Disclose Your Health Information

Treatment

We use your PHI to provide, coordinate, or manage your mental health care. This includes sharing information with other providers involved in your care, with your consent, such as when coordinating with your primary care physician.

Payment

We may use your PHI to process payments for services rendered, including billing and payment verification through our payment processor (WiPay).

Healthcare Operations

We may use your PHI for quality assurance, training, and platform improvements. This includes AI-assisted generation of SOAP notes and session summaries, accessible only to your assigned clinician.

Authorised Uses and Disclosures

Other than treatment, payment, and healthcare operations, we will only use or disclose your PHI with your written authorisation, except as follows:

• Serious threat to safety: We may disclose PHI to prevent a serious and imminent threat to your health or safety or that of another person
• Required by law: We may disclose PHI when required by federal, state, or local law
• Public health activities: As required by public health authorities
• Judicial proceedings: In response to a court order, subpoena, or other lawful process
• Law enforcement: As required by applicable law enforcement purposes
• Minors: As required or permitted when a client is a minor

A3. Your Rights Regarding Your Health Information

You have the following rights with respect to your PHI:

Right to Access

You may request access to inspect and receive a copy of your PHI. We will respond within 30 days. A reasonable fee may apply for copying.

Right to Amend

If you believe your PHI is inaccurate or incomplete, you may request an amendment. We may deny the request if we determine the information is accurate.

Right to an Accounting of Disclosures

You may request a list of disclosures we have made of your PHI in the past six years, other than those for treatment, payment, or healthcare operations.

Right to Request Restrictions

You may request restrictions on how we use or disclose your PHI. We are not required to agree to all restrictions, but we will accommodate reasonable requests where possible.

Right to Confidential Communications

You may request that we communicate your PHI in a specific way or at a specific location (e.g., email only, specific phone number).

Right to a Paper Copy of This Notice

You may request a paper copy of this Notice at any time, even if you have agreed to receive it electronically.

A4. Our Duties

We are required to maintain the privacy of your PHI, provide you with this Notice, and follow the terms described herein. We reserve the right to change our privacy practices and to apply those changes to all PHI we maintain. Revised notices will be posted on our website and available upon request.

A5. Complaints

If you believe your privacy rights have been violated, you may file a complaint with us or with the U.S. Department of Health and Human Services. You will not be penalised for filing a complaint.

Contact us: thevaleoexperience@gmail.com
HHS Office for Civil Rights: www.hhs.gov/ocr/privacy/hipaa/complaints or 1-800-368-1019

B1. Governing Framework

The Valeo Experience Inc is incorporated in St. Vincent & the Grenadines and primarily serves clients across the Caribbean region. While the Caribbean does not have a single unified health data privacy statute equivalent to HIPAA or GDPR, we are committed to responsible health information stewardship that meets or exceeds regional best practices and applicable local laws.

We are guided by the following frameworks where applicable:

• The Electronic Transactions Act (St. Vincent & the Grenadines)
• The Computer Misuse Act (SVG) and equivalent legislation across the region
• CARICOM data protection principles
• International standards including ISO 27001 and the OECD Privacy Guidelines
• Professional ethics standards for psychologists as established by the Caribbean Alliance of National Psychological Associations (CANPA)

B2. What Health Information We Collect

As a mental health platform, we collect the following categories of health-related information:

• Mental health history, presenting concerns, and treatment goals from intake questionnaires
• Session notes and SOAP notes generated by or with the assistance of Dr. Miller
• Assessment results and psychological evaluation data
• Correspondence and messages related to your care
• Appointment history and treatment progress

B3. How We Protect Your Health Information

We treat all health information with the highest degree of confidentiality. Our safeguards include:

• Encryption: All health data is encrypted in transit (TLS/HTTPS) and at rest via Google Firebase's security infrastructure
• Access control: Health records are accessible only to your assigned clinician and platform administrators for care coordination — no third parties
• Data minimisation: We collect only the information necessary for your care
• Secure communications: All messaging occurs within the platform's encrypted environment — we do not discuss client health matters via unsecured email or social media
• AI processing: Session summaries and SOAP notes generated using Gemini AI are processed within Google's privacy-compliant infrastructure and stored only within your secure clinical record

B4. Disclosures Without Your Consent

In limited circumstances, health information may be disclosed without your prior consent:

• Risk of harm: If you disclose information indicating imminent risk of serious harm to yourself or others, we are ethically and legally obligated to take protective action, which may include contacting emergency services or third parties
• Court orders: If we receive a valid court order or subpoena requiring disclosure
• Mandatory reporting: Where local law requires reporting of specific information (e.g., abuse of a minor or vulnerable adult)
• Professional consultation: With your implied consent, Dr. Miller may discuss your case with a supervising or consulting clinician, bound by equivalent confidentiality obligations, for the purpose of improving your care

B5. Your Rights

All clients, regardless of location, have the following rights regarding their health information:

• Access: Request a copy of your health records held by our platform
• Correction: Request that inaccurate information be corrected
• Transparency: Know how your information is being used and who has accessed it
• Confidentiality: Have your information kept strictly confidential except as described above
• Withdrawal: Discontinue services at any time; your records will be retained in accordance with applicable retention requirements

To exercise any of these rights, contact us at thevaleoexperience@gmail.com.

B6. Third-Party Data Processors

We engage the following third-party processors who may handle health-adjacent data on our behalf:

• Google LLC (Firebase, Google Meet, Gemini AI) — US-based, HIPAA-eligible Business Associate; governed by Google's Privacy Policy and Data Processing Addendum
• Vercel Inc — platform hosting; does not access health data directly
• WiPay Financial — Caribbean payment gateway; accesses billing and transaction data only, not health information

B7. Contact & Concerns

For any questions about how your health information is handled, or to raise a concern, please contact:

The Valeo Experience Inc
Attn: Privacy Officer
Kingstown, St. Vincent & the Grenadines
Email: thevaleoexperience@gmail.com
Phone: (784) 498-7772