HIPAA Notice of Privacy Practices
Last Updated: August 14, 2026
CARDIO DIAGNOSTICS HOLDINGS, INC.
Notice of Privacy Practices
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
Effective Date: August 14, 2026
Privacy Officer Contact Information
For questions about this Notice or to exercise your rights, please contact our Privacy Officer:
Tim Dogan
(855) 226-9991
Your Rights
When it comes to your health information, you have certain rights. This section explains your rights and some of our responsibilities to help you.
Get an Electronic or Paper Copy of Your Health Information
You can ask to see or receive an electronic or paper copy of your health information and test results that we have about you, including records related to your cardiovascular testing.
We will provide a copy or a summary of your health information, usually within 30 days of your request.
To request access to your records, email a request at [email protected].
Ask Us to Correct Your Health Information
You can ask us to correct health information about you that you think is incorrect or incomplete.
We may say “no” to your request, but we’ll tell you why in writing within 60 days.
Request Confidential Communications
You can ask us to contact you in a specific way (for example, by email, text, or mail to a specific address).
We will say “yes” to all reasonable requests.
Ask Us to Limit What We Use or Share
You can ask us not to use or share certain health information for treatment, payment, or our operations. We are not required to agree, and we may say “no” if it would affect your care.
If you pay for a service or health care item out-of-pocket in full, you can ask us not to share that information with your health insurer for payment or operations purposes. We will say “yes” unless a law requires us to share it.
Get a List of Those With Whom We’ve Shared Your Information
You can request an accounting of the times we’ve shared your health information for the six years prior to the date you ask, who we shared it with, and why.
We will include all disclosures except those about treatment, payment, and health care operations, and certain other disclosures (such as any you asked us to make). We’ll provide one accounting per year for free; a reasonable, cost-based fee may apply for additional requests within 12 months.
Get a Copy of This Notice
You can ask for a paper copy of this Notice at any time, even if you agreed to receive it electronically. We will provide it promptly.
This Notice is also available on our website at https://cdio.ai/hipaa-notice
Choose Someone to Act for You
If someone has authority to act as your personal representative (such as through medical power of attorney or legal guardianship), that person can exercise your rights and make choices about your health information.
We will verify that person’s authority before taking any action on their behalf.
File a Complaint If You Feel Your Rights Are Violated
You can file a complaint with us by contacting the Privacy Officer using the information provided above.
You can also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights:
By mail: 200 Independence Avenue, S.W., Washington, D.C. 20201
By phone: 1-877-696-6775
We will not retaliate against you for filing a complaint.
Your Choices
For certain health information, you can tell us your choices about what we share. If you have a preference for how we share your information in the situations described below, please let us know and we will follow your instructions.
You Have the Right and Choice to Tell Us To:
Share information with your family members, close friends, or others involved in your care or in payment for your care
Share information in a disaster relief situation
If you are not able to tell us your preference — for example, if you are unconscious — we may go ahead and share your information if we believe it is in your best interest. We may also share your information when needed to lessen a serious and imminent threat to health or safety.
We Will Never Share Your Information Without Your Written Permission For:
Marketing purposes
Sale of your information
Research
Disclosure to third parties
Our Uses and Disclosures
How We Typically Use or Share Your Health Information
Cardio Diagnostics provides advanced cardiovascular testing, including epigenetic-genetic based tests. We use and share your health information in the following primary ways:
To Provide and Coordinate Your Testing (Treatment)
We use your health information to perform the cardiovascular tests ordered for you and to share results with your ordering physician or other treating clinicians. Example: Your cardiologist orders an Epi+Gen CHD test. We process your sample, generate your results, and send a clinical report to your physician.
To Run Our Organization (Health Care Operations)
We use and share your health information to operate our laboratory and testing services, improve the quality of care we provide, train personnel, and conduct internal audits and quality assurance. Example: We review test results on a de-identified basis to improve our testing protocols.
To Bill for Your Services (Payment)
We use and share your health information to bill and receive payment from your health insurer, employer health plan, or other third-party payer. Example: We submit a claim to your insurance company that includes information about the tests performed and your diagnosis codes provided by your physician.
For Research, Commercial Studies and/or Clinical Trials (Studies)
We use and share your health information internally or with collaborators and partners for research studies, commercial studies or clinical trials. Example: We may collaborate with a pharma company on a clinical trial that necessitates selecting subjects based on test performed, test results, and your diagnosis codes provided by your physician.
Other Permitted and Required Uses and Disclosures
We are permitted or required by law to share your information in the following ways, generally to contribute to the public good. We must meet specific legal requirements before sharing for these purposes.
Public Health and Safety
Preventing or controlling disease
Reporting adverse reactions to medications or medical devices
Reporting suspected abuse, neglect, or domestic violence to appropriate authorities
Preventing or reducing a serious and imminent threat to the health or safety of a person or the public
Biospecimen and Data Retention
We will retain your biospecimen, laboratory data, patient information, and test results indefinitely. Cardio Diagnostics may use and share such materials with third parties for research and commercial purposes with your written consent. If you do not wish to have your biospecimen and associated data used in the manner described above, you must submit a written request for destruction of your sample to Cardio Diagnostics at [email protected]. Your written request must be received within 60 days of the date your test results are issued.
Compliance With the Law
We will share your information when state or federal law requires it, including with the U.S. Department of Health and Human Services (HHS) if it requests to confirm we are complying with federal privacy law.
Organ and Tissue Donation
We can share relevant health information with organ procurement organizations if applicable.
Medical Examiners and Funeral Directors
We can share health information with a coroner, medical examiner, or funeral director as necessary following an individual’s death.
Workers’ Compensation, Law Enforcement, and Government Requests
For workers’ compensation claims
For law enforcement purposes or with a law enforcement official as required by law
With health oversight agencies for activities authorized by law
For special government functions such as military, national security, and presidential protective services
Lawsuits and Legal Actions
We can share your health information in response to a court or administrative order, or in response to a subpoena, provided we have made reasonable efforts to notify you or obtain an order protecting the information.
Substance Use Disorder Records (42 CFR Part 2)
To the extent we maintain patient records subject to 42 CFR Part 2 (substance use disorder records), we will not use or share that information in civil, criminal, administrative, or legislative investigations or proceedings against you without (1) your written consent or (2) a court order and a subpoena.
Our Responsibilities
We are required by law to maintain the privacy and security of your protected health information (PHI).
We will notify you promptly if a breach occurs that may have compromised the privacy or security of your information.
We must follow the duties and privacy practices described in this Notice and provide you with a copy of it.
We will not use or share your information other than as described in this Notice unless you provide written authorization. If you authorize us, you may change your mind at any time by notifying us in writing.
For more information on your HIPAA rights, see: www.hhs.gov/ocr/privacy/hipaa/understanding/consumers/noticepp.html
State Law Provisions
Some state laws provide greater privacy protections than federal HIPAA standards. To the extent applicable, we comply with those more protective state laws.
Special Protections for Genetic Information
Cardio Diagnostics performs epigenetics and genetics-based cardiovascular testing. Genetic information receives special protections under federal law (GINA — the Genetic Information Nondiscrimination Act) and certain state laws.
We will not use or disclose your genetic information for underwriting purposes.
We will not sell your genetic information to third parties.
Your genetic test results will only be shared with your ordering clinician(s) and others involved in your care, unless you authorize additional sharing in writing.
Changes to the Terms of This Notice
We can change the terms of this Notice at any time. Any changes will apply to all health information we have about you. The updated Notice will be available:
On our website at https://cdio.ai/hipaa-notice
In our offices upon request
By contacting our Privacy Officer
If we make a material change to this Notice, we will post it on our website and update the effective date shown at the top of this document.
Cardio Diagnostics Holdings, Inc. | cdio.ai | Notice of Privacy Practices | Version 1.0