Telemedicine & Card-Not-Present
(CNP) Compliance Policy

Vita Nova offers telemedicine consultations as an initial step in the clinical evaluation process. Telemedicine visits are conducted under the following protocols:

• Telemedicine consultations are conducted via Tebra's encrypted, HIPAA-compliant telehealth platform. All sessions are conducted over secure, end-to-end encrypted video — no third-party messaging platforms or unencrypted email are used to conduct clinical consultations.
• Licensed providers review each patient's full medical history, prior treatments, current medications, and presenting symptoms to determine whether in-clinic treatments are appropriate. Services evaluated include ketamine infusion therapy, SPRAVATO® nasal spray, IV vitamin therapy, and IM vitamin shots.
• Telemedicine services are offered only to patients physically located in Maryland at the time of the consultation. Patients must be in the State of Maryland at the time the session takes place, regardless of their state of residence.
• All prescription-only treatments — including ketamine infusions and SPRAVATO® — are administered in person only at Vita Nova Ketamine & Wellness Clinic, 513 Bayview Blvd, Canton, Baltimore MD 21224. No controlled substances or prescription medications are prescribed for remote administration or mailed to patients.
• Providers document each virtual visit in the patient's electronic medical record (EMR) in Tebra in accordance with Maryland medical record retention requirements and HIPAA standards.
• Telemedicine consultations are an evaluation step only — not a guarantee of treatment. A provider may determine during or after the telemedicine visit that the patient is not a candidate for any offered service. A separate in-clinic evaluation may be required before any treatment is initiated.

The protection of patient data is a foundational obligation at Vita Nova. The following protocols govern all patient data handling across telemedicine and payment systems:

• All patient data — including medical history, consultation notes, appointment records, and payment information — is stored in HIPAA-compliant systems. Vita Nova's electronic medical record (EMR) system, Tebra, maintains a HIPAA Business Associate Agreement with Vita Nova.
• Vita Nova staff are trained annually on privacy, telehealth, and data protection protocols, including HIPAA Privacy Rule requirements, the HIPAA Security Rule, and secure telehealth best practices.
• No patient information is transmitted via unencrypted email or third-party messaging platforms. Clinical communications are conducted through HIPAA-covered secure channels only.
• Patient rights under HIPAA — including the right to access, amend, and request restrictions on the use of their protected health information — are described in Vita Nova's full HIPAA Notice of Privacy Practices.
• In the event of a data breach affecting patient health information, Vita Nova will comply with HIPAA Breach Notification Rule requirements, including notification to affected individuals and the U.S. Department of Health and Human Services as required by law.

This policy may be updated periodically to reflect changes in applicable law, platform capabilities, or clinic operations. The most current version is always available at vitanovawellnessclinic.com/telemedicine-policy/. Patients are encouraged to review this page before each telemedicine consultation.