Anti Spam Policy

This Website Security & Anti-Spam Policy (“Policy”) is effective as of December 5, 2025.

Harmony Mindful Breakthrough Specialists (“Harmony MBS,” “we,” “our,” or “us”) may modify, update, or revise this Policy from time to time to reflect changes in applicable law, technology, security practices, or website operations. Any revisions will be posted on this Website with an updated effective date. Continued use of the Website following publication of an updated Policy constitutes acceptance of the revised Policy to the extent permitted by applicable law.

This Website Security & Anti-Spam Policy should be read together with the Harmony Mindful Breakthrough Specialists:

• Website Privacy Policy
• HIPAA-Compliant Tracking & Analytics Policy
• Cookie & Tracking Technologies Policy
• Terms of Service
• Medical Content Disclaimer
• Telehealth Disclaimer

Each policy addresses a distinct aspect of website governance, privacy, security, communications, healthcare compliance, or acceptable use. These policies are intended to complement one another and should be interpreted together. In the event of any inconsistency, the provision providing the greater protection for personal information, Protected Health Information (“PHI”), website security, or applicable legal compliance shall govern unless otherwise required by law.

Harmony Mindful Breakthrough Specialists is committed to maintaining a secure, reliable, and trustworthy online environment for patients, prospective patients, referring professionals, and other visitors.

This Policy describes:

• the measures Harmony MBS employs to help safeguard the public Website;
• the acceptable use requirements applicable to visitors and users;
• prohibited activities involving the Website or its communication systems;
• our practices regarding unsolicited commercial communications (“spam”);
• the procedures for reporting suspected security concerns; and
• the responsibilities of visitors when interacting with the Website.

This Policy applies solely to the publicly accessible Harmony MBS Website and related communications.

It does not govern the electronic health record (“EHR”), secure patient portal, telehealth platform, payment processing systems, or any environment that stores or processes Protected Health Information. Those systems operate under separate HIPAA-compliant security controls, contractual safeguards, and applicable healthcare privacy laws.

Harmony MBS recognizes that information security is an ongoing responsibility rather than a single technical implementation.

Accordingly, we implement reasonable administrative, technical, and physical safeguards designed to help protect the confidentiality, integrity, and availability of our public Website and associated communications.

Our security practices are intended to:

• reduce the risk of unauthorized access;
• maintain reliable website availability;
• protect visitor information from unauthorized disclosure or alteration;
• preserve the integrity of website content;
• detect and respond to malicious activity; and
• support compliance with applicable federal and California privacy laws.

Because no Internet-connected system can be guaranteed completely secure, Harmony MBS cannot warrant that unauthorized access, cyberattacks, or other security incidents will never occur. However, we regularly evaluate our security practices and implement reasonable improvements as technologies, threats, and industry standards evolve.

To help protect the Website and its visitors, Harmony MBS employs security measures appropriate for a healthcare organization’s public-facing website. Depending upon operational requirements, these measures may include:

• encrypted HTTPS communications;
• secure website hosting;
• administrative access controls;
• multi-factor authentication for privileged accounts where supported;
• routine software updates and security patching;
• firewall protections;
• malware detection and monitoring;
• security logging;
• encrypted system backups;
• least-privilege administrative permissions;
• vulnerability monitoring;
• account authentication controls; and
• periodic review of website configurations.

Security controls may be modified, enhanced, or replaced over time as technology evolves or operational needs change.

Harmony MBS reserves the right to implement additional safeguards without prior notice whenever reasonably necessary to protect the Website or its users.

Harmony MBS intentionally maintains technical and operational separation between its public Website and all systems used to provide healthcare services.

The public Website is designed to provide educational information, practice information, and general communications.

Protected Health Information is not intentionally collected, stored, or processed through the public Website.

Clinical activities—including patient intake, scheduling, secure messaging, telehealth visits, treatment documentation, prescribing, billing, and payment processing—occur exclusively within separate HIPAA-compliant systems operating under appropriate contractual and regulatory safeguards.

This separation helps reduce unnecessary exposure of sensitive information and supports compliance with HIPAA, the California Confidentiality of Medical Information Act (CMIA), and other applicable privacy laws.

Website infrastructure, analytics platforms, and marketing technologies are configured to remain operationally independent from clinical systems wherever reasonably feasible.

That completes the foundation of the policy. It establishes the legal framework, aligns with the tone of your other governance documents, and avoids repeating the Privacy and Tracking Policies.

Harmony MBS welcomes visitors to use this Website for lawful, personal, educational, informational, and non-commercial purposes consistent with this Policy and the Terms of Service.

Visitors agree to use the Website responsibly and in a manner that does not interfere with its operation, compromise its security, infringe upon the rights of others, or violate applicable law.

Users may:

• Browse publicly available content;
• Access educational resources;
• Submit legitimate inquiries through approved communication channels;
• Share publicly available content using customary website functionality where permitted; and
• Access publicly available information regarding Harmony MBS and its services.

Use of this Website for any unlawful, fraudulent, abusive, or disruptive purpose is strictly prohibited.

Harmony MBS reserves the right to investigate suspected misuse of the Website and to take appropriate action, including restricting access, blocking network traffic, preserving relevant records, cooperating with law enforcement, or pursuing other remedies available under applicable law.

To protect the integrity, availability, and security of the Website, visitors shall not engage in activities including, but not limited to:

Unauthorized Access

Attempting to gain unauthorized access to:

• administrative accounts;
• restricted resources;
• databases;
• servers;
• application interfaces;
• website configuration files; or
• any other system not intended for public access.

Security Circumvention

• bypass authentication controls;
• disable or interfere with security measures;
• evade access restrictions;
• exploit software vulnerabilities;
• interfere with logging or monitoring systems; or
• conduct unauthorized penetration testing without prior written authorization.

Malicious Software

• malware;
• ransomware;
• spyware;
• viruses;
• worms;
• Trojan horses;
• malicious scripts; or
• any other software intended to disrupt, damage, monitor, or compromise computer systems.

Automated Abuse

• generate excessive requests;
• overload website resources;
• interfere with website availability;
• perform denial-of-service attacks;
• conduct credential stuffing attacks;
• perform password guessing;
• create automated accounts; or
• otherwise disrupt normal Website operations.

Data Harvesting

• harvest email addresses;
• scrape website content at scale;
• extract databases;
• collect contact information through automated means;
• build marketing lists from Website content; or
• use bots to collect information for commercial purposes.

Nothing in this section prohibits lawful indexing by recognized search engines acting in accordance with applicable robots directives.

Misrepresentation

• impersonate another individual or organization;
• misrepresent their identity;
• submit false information through Website forms;
• falsify email headers;
• conceal the origin of malicious communications; or
• otherwise engage in deceptive practices.

Intellectual Property Abuse

Users shall not reproduce, republish, distribute, modify, or commercially exploit Website content except as permitted by applicable law or with prior written authorization from Harmony MBS.

Harmony MBS is committed to responsible, permission-based communications.

Harmony MBS does not engage in unsolicited commercial email practices and does not knowingly send bulk marketing communications to individuals who have not requested or consented to receive them, where such consent is required by applicable law.

Harmony MBS:

• does not sell or rent email addresses or mailing lists;
• does not purchase third-party marketing lists for unsolicited communications;
• honors commercially reasonable unsubscribe requests for non-clinical communications;
• includes legally required unsubscribe mechanisms where applicable; and
• maintains reasonable procedures intended to comply with the federal CAN-SPAM Act and other applicable laws governing commercial electronic communications.

Clinical communications, appointment reminders, administrative notices, and other healthcare-related communications may be governed by separate legal requirements and patient authorizations and are not considered unsolicited commercial messages.

7.1 Contact Form Use

The Website’s contact forms, telephone numbers, email addresses, and other communication channels are provided solely for legitimate inquiries relating to Harmony MBS, its services, professional relationships, media inquiries, or other appropriate business purposes.

These communication channels may not be used to:

• send advertising;
• promote products or services unrelated to Harmony MBS;
• distribute chain letters;
• transmit phishing attempts;
• conduct fraudulent activity;
• distribute malware;
• recruit participants for unrelated commercial ventures;
• submit repetitive or automated messages; or
• otherwise interfere with normal business operations.

Harmony MBS reserves the right to filter, block, refuse, or disregard communications reasonably believed to violate this Policy.

7.2 Email Security

While Harmony MBS employs reasonable safeguards designed to protect electronic communications, standard email may not always provide the same level of security as encrypted healthcare communication platforms.

Visitors should not submit:

• Protected Health Information;
• detailed medical histories;
• psychiatric information;
• prescription information;
• payment card information; or
• other highly sensitive personal information

through general Website email addresses unless specifically instructed to do so through secure methods.

Harmony MBS may redirect individuals to secure HIPAA-compliant systems whenever healthcare-related information must be exchanged.

Harmony MBS appreciates responsible reporting of potential security concerns affecting the Website.

Individuals who believe they have identified a potential security vulnerability, suspicious activity, phishing attempt, unauthorized use of the Harmony MBS name, or other security concern are encouraged to notify Harmony MBS promptly using the contact information provided below.

Reports should include sufficient information to permit reasonable investigation while avoiding the inclusion of Protected Health Information or other sensitive personal information unless specifically requested through secure communication channels.

Harmony MBS will review reported concerns in good faith and may investigate, remediate, or otherwise respond as appropriate under the circumstances. Submission of a report does not create any contractual relationship, guarantee compensation, authorize continued testing, or grant permission to conduct further security research against Harmony MBS systems.

Harmony MBS requests that individuals refrain from publicly disclosing suspected vulnerabilities until a reasonable opportunity has been provided to investigate and, where appropriate, address the reported issue.

Harmony MBS may engage carefully selected third-party service providers to support the operation, maintenance, security, hosting, communications, or performance of the Website.

Where appropriate, such service providers may include:

• Website hosting providers
• Website security service providers
• Domain name registrars
• Content delivery network (CDN) providers
• Website analytics providers
• Managed technology providers
• Email service providers
• Cloud infrastructure providers

Harmony MBS seeks to engage service providers that maintain commercially reasonable administrative, technical, and physical safeguards appropriate to the services provided.

Where required by applicable law or contract, service providers that may encounter Protected Health Information operate pursuant to Business Associate Agreements (“BAAs”) or other legally required contractual protections.

Service providers are expected to use information solely for authorized business purposes and not for independent marketing, profiling, or unrelated commercial activities except as permitted by applicable law.

For purposes of this Policy:

“Website” means the publicly accessible Harmony Mindful Breakthrough Specialists website and associated public webpages.

“Protected Health Information (PHI)” has the meaning assigned under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its implementing regulations.

“Spam” means unsolicited bulk electronic communications, including commercial email, automated messages, or other electronic communications transmitted without appropriate authorization or consent where required by law.

“Malicious Code” includes viruses, worms, ransomware, spyware, Trojan horses, malicious scripts, and other software designed to compromise, disrupt, damage, or gain unauthorized access to computer systems or information.

Harmony MBS implements reasonable safeguards intended to help protect the Website and associated communications. However, no Internet-connected system can be guaranteed to be completely secure or continuously available.

To the fullest extent permitted by applicable law, Harmony MBS disclaims liability for indirect, incidental, consequential, special, exemplary, or punitive damages arising from or relating to:

• use of the Website;
• inability to access the Website;
• interruption of Website services;
• unauthorized third-party activities;
• malicious software introduced by third parties;
• Internet service disruptions;
• telecommunications failures; or
• other events beyond Harmony MBS’s reasonable control.

Nothing in this Policy shall be interpreted to limit liability where such limitation is prohibited by applicable law.

Harmony MBS reserves the right to modify this Policy from time to time to reflect changes in technology, legal requirements, operational practices, or evolving cybersecurity risks.

Updated versions will be posted on the Website with a revised Effective Date.

Continued use of the Website following publication of an updated Policy constitutes acknowledgment of the revised Policy to the extent permitted by law.

Questions regarding this Policy or reports concerning suspected Website security issues may be directed to:

Harmony Mindful Breakthrough Specialists

9100 Wilshire Blvd., East Tower
Suite 333 #452
Beverly Hills, California 90212

Email: privacy@harmonymbs.net

Telephone: (310) 694-9293

Harmony MBS will review communications in good faith and respond as appropriate under the circumstances. Submission of a report does not create any contractual obligation or guarantee of response.

14.1 Governing Law

This Policy shall be governed by and construed in accordance with the laws of the State of California, without regard to conflict-of-law principles.

14.2 Jurisdiction and Venue

To the extent litigation is permitted, any dispute arising from this Policy shall be brought exclusively in the appropriate state or federal courts located in California.

14.3 Severability

If any provision of this Policy is determined to be invalid or unenforceable, the remaining provisions shall remain in full force and effect.

14.4 No Waiver

Failure by Harmony MBS to enforce any provision of this Policy shall not constitute a waiver of that provision or any other provision.

14.5 Entire Understanding

This Policy, together with the Harmony MBS Privacy Policy, Cookie & Tracking Technologies Policy, HIPAA-Compliant Tracking & Analytics Policy, Terms of Service, Medical Content Disclaimer, and Telehealth Disclaimer, constitutes the complete Website governance framework relating to Website security, acceptable use, privacy, communications, and related matters.