Privacy Policy

This Privacy Policy (“Privacy Policy”) describes the data protection practices of Contour Consultants LLC and its affiliates, including, but not limited to, Skinic Health (collectively, “Skinic Health ”, “we”, “our”, or “us”), including when you visit any Skinic Health website that links to this Privacy Policy (including https://skinichealth.com/ and [INSERT ALTERNATE DOMAIN]) (collectively, our “Websites”), use any affiliated mobile applications (the “Apps”), or otherwise provide data to Skinic Health . We refer to the Websites, Apps, and other services provided by Skinic Health together in this Privacy Policy as the “Services.” This Privacy Policy is incorporated into our Terms of Use. All capitalized terms used in this Privacy Policy but not defined herein have the meanings assigned to them in the Terms of Use.

PLEASE READ THIS PRIVACY POLICY CAREFULLY TO UNDERSTAND HOW WE HANDLE YOUR INFORMATION. IF YOU DO NOT AGREE TO THIS PRIVACY POLICY, PLEASE DO NOT USE THE SERVICES.

This Privacy Policy contains the following sections:
The Information We Collect and the Sources of Such Information
Purposes for How We Use Your Information
Online Analytics and Advertising
How We Share and Disclose Your Information
Your Marketing Choices
Third Party Services and Notice About Health Information
How We Protect Your Information
Privacy Information for California Residents
Privacy Information for Nevada Residents
Retention of Your Information
Revisions to Our Privacy Policy

Contacting Us

THE INFORMATION WE COLLECT AND THE SOURCES OF SUCH INFORMATION
We obtain information about you through the means discussed below when you use the Services. Please note that we need certain types of information so that we can provide the Services to you. If you do not provide us with such information, or ask us to delete it, you may no longer be able to access or use part or all of our Services.

1. Information You Provide to Us

We collect a variety of information that you provide directly to us.
For example, we collect information from you through:
Account and product registration and administration of your account
Processing your orders and requests for treatment
Questions, communications, or feedback you submit to us via forms or email
Your participation in research and surveys
Requests for customer support and technical assistance, including through online chat
functionalities
Uploads or posts to the Services
Employment applications you submit
The specific types of information we collect will depend upon the Services you use, how you use
them, and the information you choose to provide. The types of data we collect directly from you
includes:
Name, address, telephone number, date of birth, and email address
Information about your medical conditions, treatment options, physician referrals, prescriptions,
and lab results or other related health information, such as your physical and emotional
characteristics
Log-in credentials, if you create an account
Billing information, such as shipping address, credit or debit card number, verification number,
expiration date, and identity verification information, collected by our payment processors on our
behalf
Information about purchases or other transactions with us
Information about your customer service and maintenance interactions with us
Demographic information such as your gender and age
User-generated content you post in public online forums on our Services
Any other information you choose to directly provide to us in connection with your use of the
Services.

2. Information We Collect Through Automated Means

We collect certain information about your use of the Services and the devices you use to access
the Services, as described in this Section. As discussed further below, we and our service
providers (which are third party companies that work on our behalf), may use a variety of
technologies, including cookies and similar tools, to assist in collecting this information.
Our Websites. When you use our Websites, we collect and analyze information such as your IP
address, browser types, browser language, operating system, the state or country from which
you accessed the Services, software and hardware attributes (including device IDs) referring
and exit pages and URLs, platform type, the number of clicks, files you download, domain
names, landing pages, pages viewed and the order of those pages, the amount of time spent on
particular pages, the terms you use in searches on our sites, the date and time you used the
Services, error logs, and other similar information.
Our Apps. When you use our Apps, we automatically receive certain information about the
mobile phone, tablet, or computer used to access the Apps, including a mobile device identifier,
IP address, operating system, version, Internet service provider, browser type, domain name
and other similar information, whether and when you update the Apps, date and time of use,
and how you use the Apps, including time spent in different portions of the Apps.
Location Information. When you use the Services, we and our service providers may
automatically collect general location information (e.g., IP address, city/state and or postal code
associated with an IP address) from your computer or mobile device. This information allows us
to enable access to content that varies based on a user’s general location (e.g., to provide you
with accurate sales tax information and to deliver content customized to your location).
We will ask your permission before collecting your precise GPS location information. In such
instances, we will use your precise geo-location information to provide customized services,
content, promotional offers and other information that may be of interest to you. If you no longer
wish for us and our service providers to collect and use GPS location information, you may
disable the location features on your device. Please see your device manufacturer settings.
Our Use of Cookies and Similar Online Tools. To collect the information discussed in this
Section, we and our service providers use web server logs, cookies, tags, SDKs, tracking pixels,
and other similar tracking technologies. We use these technologies to offer you a more tailored
experience.
A web server log is a file where website activity is stored.
An SDK is a set of tools and/or code that we embed in our Apps and software to allow third
parties to collect information about how users interact with the Services.
A cookie is a small text file that is placed on your computer or mobile device when you visit a
site, that enables us to: (i) recognize your computer/device; (ii) store your preferences and
settings; (iii) understand the parts of the Services you have visited and used; (iv), enhance your
user experience by delivering and measuring the effectiveness of content and advertising
tailored to your interests; (v) perform searches and analytics; and (vi) assist with security and
administrative functions.
Tracking pixels (sometimes referred to as web beacons or clear GIFs) are tiny electronic tags
with a unique identifier embedded in websites, online ads and/or email that are designed to: (1)
collect usage information like ad impressions or clicks and email open rates; (2) measure
popularity of the Services and associated advertising; and (3) access user cookies.
As we adopt additional technologies, we may also gather information through other methods.
Please note that you can change your settings to notify you when a cookie is being set or
updated, or to block cookies altogether. Please consult the “Help” section of your browser for
more information (e.g., Internet Explorer; Google Chrome; Mozilla Firefox; or Apple Safari).
Please note that by blocking, disabling, or managing any or all cookies, you may not have
access to certain features or offerings of the Services.

3. Information We Collect From Social Media and Other Content Platforms

When you “like” or “follow” us on Facebook, Instagram, Twitter, or other social media sites, we
may collect some information from you including your name, email address, and any comments
or content you post relevant to us. We also collect your information if you sign up for one of our
promotions or submit information to us through social media sites.

4. Information We Receive From Other Sources

We work closely with third parties (including, for example, third party intermediaries, such as the
physicians, medical professionals, and pharmacies with whom we partner to provide you with
the Services and their health care services, sub-contractors in technical, advertising networks,
analytics providers, and search information providers). Such third parties will sometimes provide
us with additional information about you.
PURPOSES FOR HOW WE USE YOUR INFORMATION
In connection with providing you with the Services, we may use your information for our
business purposes to:
Carry out, improve, and manage the Services and, as applicable, facilitate the provision of
health care services to you by physicians or other health care providers and ensure that the
physicians or health care providers have the services and support necessary for health care
operations.
Engage in internal research to understand the effectiveness of our Services, improve our
Services, and better understand our user base. If we publish or provide the results of this
research to others, such research will be presented in a de-identified and aggregate form such
that individual users cannot be identified.
Communicate with you about the Services, your use of the Services, or your inquiries related to
the Services and send you communications on behalf of physicians or other health care
providers utilizing the Services to meet your needs.
Communicate with you by email, postal mail, or phone about surveys, promotions, special
events or our products and Services and those of our subsidiaries, affiliates, and parent
companies and any of their related businesses and those of our third-party partners.
Provide you with technical support and customer service.
Verify your identity and administer your account, including processing your payments and
fulfilling your orders.
Ensure that content from our Services is presented in the most effective manner for you and for
your computer or device, allow you to participate in interactive features of our Services (when
you choose to do so), and as part of our efforts to keep our Services safe and secure.
Measure or understand the effectiveness of advertising and content we serve to you and others,
and to deliver and customize relevant advertising and content to you.
Help us better understand your interests and needs, such as by engaging in analysis and
research regarding use of the Services.
Comply in good faith with any procedures, laws, and regulations which apply to us where it is
necessary for our legitimate interests or the legitimate interests of others.
Establish, exercise, or defend our legal rights where it is necessary for our legitimate interests or
the legitimate interests of others.
Combined Information. For the purposes discussed in this Privacy Policy, we may combine the
information that we collect through the Services with information that we receive from other
sources, both online and offline, and use and share such combined information in accordance
with this Privacy Policy.
Aggregate/De-Identified Data. We may aggregate and/or de-identify any information collected
through the Services so that such information can no longer be linked to you or your device
(“Aggregate/De-Identified Information”). We may use Aggregate/De-Identified Information for
any purpose, including for research and marketing purposes, and may also share such data
with any third parties, including advertisers, promotional partners, and sponsors.

ONLINE ANALYTICS AND ADVERTISING

1. Online Analytics

We may use third-party web analytics services (such as those of Google Analytics (including
Google Signals, Google User-ID, and other Google Analytics features) and MixPanel) on our
Services to collect and analyze usage information through cookies and similar tools; engage in
auditing, research, or reporting; assist with fraud prevention; try to locate the same unique users
across multiple browsers or devices to better tailor services and features; and provide certain
features to you. If you have a Google account with personalized advertising enabled, through
Google Signals, Google will also be able to gather for us analytics and engagement information
from across the various devices you use to access the Services. To prevent Google from using
your information for analytics (including cross-device tracking for personalization purposes), you
may install the Google Analytics Opt-out Browser Add-on by clicking here. And to opt out of
Google Signals, please open your “Settings” app, locate and tap “Google,” select “Ads,” and
turn ON “Opt out of Ads Personalization.” You may also be able to disable cross-device tracking
through your Android or Apple device-based settings.
If you receive email from us, we may use certain analytics tools, such as clear GIFs to capture
data such as when you open our message or click on any links or banners our email contains.
This data allows us to gauge the effectiveness of our communications and marketing
campaigns.

2. Online Advertising

The Services may integrate third-party advertising technologies (e.g., ad networks and ad
servers such as Facebook, Google Ad Words, Criteo and others) that use cookies and other
technologies to deliver relevant content and advertising for Skinic Health products on the
Services, as well as on other websites you visit and other applications you use. The ads may be
based on various factors such as the content of the page you are visiting, information you enter
such as your searches, demographic data, and other information we collect from you. These
ads may be based on your current activity or your activity over time and across other websites
and online services.
We sometimes provide our customer information (such as email addresses) to service
providers, who may “match” this information in de-identified form to cookies (or mobile ad
identifiers) and other proprietary IDs, in order to provide you with more relevant ads when you
visit other websites and mobile applications.
We neither have access to, nor does this Privacy Policy govern, the use of cookies or other
tracking technologies that may be placed on your device you use to access the Services by
non-affiliated third party advertising network services. If you are interested in more information
about tailored browser advertising and how you can generally control cookies from being put on
your computer to deliver tailored advertising, you may visit the Network Advertising Initiative’s
Consumer Opt-Out link, the Digital Advertising Alliance’s Consumer Opt-Out link, or Your Online
Choices to opt-out of receiving tailored advertising from companies that participate in those
programs. If you are interested in more information about Criteo’s privacy practices or opting-out
of Criteo’s advertising services, you may view their Privacy Policy. To opt out of Google
Analytics for display advertising or customize Google display network ads, visit the Google Ads
Settings page. We do not control these opt-out links or whether any particular company chooses
to participate in these opt-out programs. We are not responsible for any choices you make using
these mechanisms or the continued availability or accuracy of these mechanisms.
Please note that if you exercise the opt out choices above, you will still see advertising when
you use the Services, but it will not be tailored to you based on your online behavior over time.

3. Mobile Advertising

When using mobile applications from us or others, you may also receive tailored in-application
advertisements. We may use third-party service providers to deliver advertisements on mobile
applications or for mobile application analytics. Each operating system, iOS for Apple phones,
Android for Android devices, and Windows for Microsoft devices provides its own instructions on
how to prevent the delivery of tailored in-application advertisements. We do not control how the
applicable platform operator allows you to control receiving personalized in-application
advertisements; thus, you should contact the platform provider for further details on opting out of
tailored in-application advertisements. You may review the support materials and/or the device
settings for the respective operating systems to opt-out of tailored in-app advertisements.

4. Notice Concerning Do Not Track

Do Not Track (“DNT”) is a privacy preference that users can set in certain web browsers. We are
committed to providing you with meaningful choices about the information collected on our
website for third party purposes, and that is why we provide the variety of opt-out mechanisms
listed above. However, we do not currently recognize or respond to browser-initiated DNT
signals. To learn more about Do Not Track, you can do so here.
HOW WE SHARE AND DISCLOSE YOUR INFORMATION
We may share your information for our business purposes in the following ways:
Affiliates and Subsidiaries. We may share information we collect within any Skinic Health
member or group (i.e., our subsidiaries and affiliates, including our ultimate holding company
and its subsidiaries) to deliver products and services to you, ensure a consistent level of service
across our products and services, and enhance our products, services, and your customer
experience.
Health Care Providers and Services. We share your information with health care providers: (i) to
schedule and fulfill appointments and provide health care services as part of the Services, (ii) to
whom you send messages through our Services, and (iii) for other treatment, payment or health
care operations purposes, including pharmacy services, upon your request.
Service Providers. We provide access to or share your information with select third parties who
use the information to perform services on our behalf. They provide a variety of services to us,
including billing, sales, marketing, advertising, analytics, research, customer service, shipping
and fulfillment, data storage, IT and security, fraud prevention, payment processing, and
auditing and legal services. These entities may also include health care organizations,
pharmacies, and other third parties we use to support our business or in connection with the
administration and support of the Services.
Protection of Skinic Health and Others. By using the Services, you acknowledge and agree that
we may access, retain and disclose the information we collect and maintain about you if
required to do so by law or in a good faith belief that such access, retention or disclosure is
reasonably necessary to: (a) comply with legal process (e.g. a subpoena or court order); (b)
enforce our Terms of Use, this Privacy Policy, or other contracts with you, including investigation
of potential violations thereof; (c) respond to claims that any content violates the rights of third
parties; (d) respond to your requests for customer service; and/or (e) protect the rights, property
or personal safety of Skinic Health , its agents and affiliates, its users and/or the public. This
includes exchanging information with other companies and organizations for fraud protection,
and spam/malware prevention, and similar purposes.
Business Transfers. As we continue to develop our business, we may buy, merge, or partner
with other companies. In such transactions, (including in contemplation of such transactions)
user information may be among the transferred assets. If a portion or all of our assets are sold
or transferred to a third-party, customer information (including your email address) would likely
be one of the transferred business assets. If such transfer is subject to additional mandatory
restrictions under applicable laws, we will comply with such restrictions.
Public Forums. Certain features of our Services make it possible for you to share comments
publicly with other users. Any information that you submit through such features is not
confidential, and we may use it for any purpose (including in testimonials or other marketing
materials). For example, if you submit a product review on one of our sites, we may display your
review (along with the name provided, if any) on other Skinic Health websites and on third-party
websites. Any information you post openly in these ways will be available to the public at large
and potentially accessible through third-party search engines. Accordingly, please take care
when using these features.
Consent. We may also disclose your information in other ways you direct us to and when we
have your consent.
Aggregate/De-Identified Information. We reserve the right to create Aggregate/De-Identified
Data from the information we collect through the Services and our sharing of such
Aggregate/De-Identified Data is in our discretion.
YOUR MARKETING CHOICES
You may instruct us not to use your contact information to contact you by email, postal mail, or
phone regarding products, services, promotions and special events that might appeal to your
interests by contacting us using the information below. In commercial email messages, you can
also opt out by following the instructions located at the bottom of such emails. Please note that,
regardless of your request, we may still use and share certain information as permitted by this
Privacy Policy or as required by applicable law. For example, you may not opt out of certain
operational emails, such as those reflecting our relationship or transactions with you.
THIRD PARTY SERVICES AND NOTICE ABOUT HEALTH INFORMATION
This Privacy Policy does not address, and we are not responsible for, the privacy, information, or
other practices, including data privacy and security process and standards of any third parties,
including physicians and other health care providers using the Services, the manufacturer of
your mobile device and other IT hardware and software, and any other third party mobile
application, website, or service to which our Services may contain a link. These third parties
may at times gather information from or about you. We have no control over the privacy
practices of these third parties. The collection, use, and disclosure of your information will be
subject to the privacy policies of the third-party websites or services, and not this Privacy Policy.
We urge you to read the privacy and security policies of these third parties.
HOW WE PROTECT YOUR INFORMATION
Skinic Health takes a variety of technical and organizational security measures to protect your
information against accidental or unlawful destruction or accidental loss, alteration, unauthorized
disclosure or access. However, no method of transmission over the Internet, and no means of
electronic or physical storage, is absolutely secure. As such, you acknowledge and accept that
we cannot guarantee the security of your information transmitted to, through, or on our Services
or via the Internet and that any such transmission is at your own risk.
Where we have given you (or where you have chosen) a password that enables you to access
the Services, you are responsible for keeping this password confidential. We ask you not to
share your password with anyone. The information you share in public areas may be viewed by
any user of the Services.
PRIVACY INFORMATION FOR CALIFORNIA RESIDENTS
If you are a California resident, California law requires us to provide you with some additional
information regarding how we collect, use, and share your “personal information” (as defined in
the California Consumer Privacy Act (“CCPA”)).
Categories of personal information we collect and disclose. Throughout this Policy, we discuss
in detail the specific pieces of personal information we collect from and about our users. Under
the CCPA, we are also required to provide you with the “categories” of personal information we
collect and the categories of third parties to which we disclose personal information. Please note
that some of the information we collect through the Services (e.g., medical information), is
subject to various health data privacy laws, and is therefore not subject to the CCPA. See the
following chart to understand more about the categories of personal information we collect that
are subject to the CCPA and the third parties to which we disclose it:
Category of Personal Information
Categories of Third Parties to Which we Disclose
Identifiers and contact information (e.g., name, address, email address, account names)
Service providers; our affiliates; health care providers and services; entities for legal and fraud
prevention
Commercial and transactional information (e.g., information about your purchases)
Service providers; our affiliates; health care providers and services; entities for legal and fraud
prevention
Financial information (e.g., credit card info collected by our payment processors)
Payment processors; service providers; our affiliates; entities for legal and fraud prevention
Internet or other network or device activity (e.g., IP address, browsing history, app usage)
Service providers; our affiliates; entities for legal and fraud prevention
Geolocation information (e.g., general location and precise location, with your permission)
Service providers; our affiliates; entities for legal and fraud prevention
Demographic and statistical data (e.g., your gender, interests based on products and services
you use)
Service providers; our affiliates; entities for legal and fraud prevention
Physical characteristics (e.g., photos of you)
Service providers; our affiliates
User-generated content (e.g., information you choose to post in our online forums)
Service providers; our affiliates; entities for legal and fraud prevention
Customer service data (e.g., information you provide through a chat or call with Skinic Health ’s
Care Team)
Service providers; our affiliates; health care providers and services; entities for legal and fraud
prevention
The business purposes for which we use the personal information we collect are: manage,
facilitate, and improve the Services; research, marketing, and analytics; communicate with
users; technical support and customer service; security and fraud prevention; and legal
compliance and defense. For more detailed information about how we use and share your
personal information, please see the “Purposes for How We Use Your Information” and “How
We Share and Disclose Your Information” sections of this Policy above.
Your California Privacy Rights
CCPA Rights Disclosure. If you are a California resident, the CCPA allows you to make certain
requests about your personal information. Specifically, the CCPA allows you to request us to:
Inform you about the categories of personal information we collect or disclose about you; the
categories of sources of such information; the business or commercial purpose for collecting
your personal information; and the categories of third parties with whom we share/disclose
personal information.
Provide access to and/or a copy of certain information we hold about you.
Delete certain information we have about you.
The CCPA further provides you with the right to not be discriminated against (as provided for in
applicable law) for exercising your rights.
Please note that certain information may be exempt from such requests under California law.
For example, we need certain information in order to provide the Services to you. We also will
take reasonable steps to verify your identity before responding to a request.

If you are a California resident and you would like to exercise any of your data rights under
California law, please click here to submit your request through our webform. Alternatively, you
can email us at hello@skinichealth.com.

Please include your full name, email address and residential address associated with your use
of our Services, along with the rights you would like to exercise, so that we can process your
request in an efficient manner. If you would like to receive a copy of your medical record in
connection with your request, please indicate that in your email message. By requesting your
medical record in this way, you are agreeing to receive your medical record in an unencrypted
email message.

Sale of Personal Information.

Skinic Health does not, and will not, sell information that identifies you such as your name, email
address, phone number, or postal address. Like many companies with an internet presence, we
do work with third parties that provide marketing and advertising services to us, including
interest-based advertising services, and these third parties may place tags, pixels, cookies,
beacons, and other similar tracking mechanisms on our Website and App and collect your
online identifiers. Because of the CCPA’s broad definitions of “sale” and “personal information,”
making certain online identifiers available to these companies so that they can provide
marketing and advertising services to Skinic Health may be considered a “sale” under the CCPA
. To opt out of sharing your information with participating third parties for interest-based
advertising, please visit the Network Advertising Initiative’s Consumer Opt-Out link, the Digital
Advertising Alliance’s Consumer Opt-Out link, and Your Online Choices. Please note that these
opt-outs are device and browser based, so you will need to opt out on each of your devices and
browsers. For more information, see the Online Analytics and Advertising Section above.
Shine the Light Disclosure. The California “Shine the Light” law gives residents of California the
right under certain circumstances to request information from us regarding the manner in which
we share certain categories of personal information (as defined in the Shine the Light law) with
third parties for their direct marketing purposes. We do not share your personal information with
third parties for their own direct marketing purposes.

PRIVACY INFORMATION FOR NEVADA RESIDENTS
Under Nevada law, certain Nevada consumers may opt out of the sale of “personally identifiable
information” for monetary consideration (as such terms are defined under Nevada law) to a
person for that person to license or sell such information to additional persons. We do not
engage in such activity; however, if you are a Nevada resident who has purchased services
from us, you may submit a request to opt out of any potential future sales under Nevada law by
hello@skinichealth.com. Please note we will take reasonable steps to verify your identity and
the authenticity of the request. Once verified, we will maintain your request in the event our
practices change.

RETENTION OF YOUR INFORMATION
We keep your information for no longer than necessary for the purposes for which it is

processed. The length of time for which we retain information depends on the purposes for
which we collected and use it and/or as required to comply with applicable laws.

REVISIONS TO OUR PRIVACY POLICY

We reserve the right to change this Privacy Policy at any time to reflect changes in the law, our
data collection and use practices, the features of our Services, or advances in technology. We
will make the revised Privacy Policy accessible through the Services, so you should review it
periodically. The date this Privacy Policy was last revised is identified at the top of the
document. You are responsible for periodically monitoring and reviewing any updates to the
Privacy Policy. If we make a material change to the Privacy Policy, we will provide you with
appropriate notice in accordance with legal requirements. Your continued use of our Websites or
Apps after such amendments (and notice, where applicable) will be deemed your
acknowledgment of these changes to this Privacy Policy.

CONTACTING US

If you have any questions about this Privacy Policy or Skinic Health ’s privacy practices, please contact us at:

Contour Consultants LLC
8430 Santa Monica Blvd, West Hollywood, CA, 90069
hello@skinichealth.com

HIPAA Compliance – Privacy Policy Template

{ legalBusinessName } HIPPA Privacy Statement:

Notice of Privacy Practices for Protected Health Information (PHI)

Effective Date: {date}

This Notice of Privacy Practices (“Notice”) describes how { legalBusinessName } (“we”, “us”, or “our”) may use and disclose your Protected Health Information (PHI) to carry out treatment, payment, or healthcare operations and for other purposes that are permitted or required by law. This Notice also describes your rights regarding your PHI. We are required by law to maintain the privacy of your PHI, provide you with this Notice of our legal duties and privacy practices, and to abide by the terms of this Notice.

Uses and Disclosures of PHI

We may use and disclose your PHI for the following purposes:

Treatment: We may use and disclose your PHI to provide, coordinate, or manage your healthcare and related services. This may include communication with other healthcare providers about your treatment and coordinating your care with other providers.
Payment: We may use and disclose your PHI to obtain payment for healthcare services provided to you. This may include contacting your insurance company to verify your coverage, billing and collection activities, and sharing PHI with other healthcare providers, insurance companies, or collection agencies.
Healthcare Operations: We may use and disclose your PHI for healthcare operations, including quality assessment, improvement activities, case management, accreditation, licensing, credentialing, and conducting or arranging for medical reviews, audits, or legal services.
As Required by Law: We may use and disclose your PHI when required to do so by federal, state, or local law.
Public Health and Safety: We may use and disclose your PHI to prevent or control disease, injury, or disability, to report child abuse or neglect, to report reactions to medications or problems with products, and to notify persons who may have been exposed to a communicable disease or may be at risk of spreading a disease or condition.
Health Oversight Activities: We may disclose your PHI to health oversight agencies for activities authorized by law, such as audits, investigations, inspections, and licensure.
Judicial and Administrative Proceedings: We may disclose your PHI in response to a court or administrative order, subpoena, discovery request, or other lawful process.
Law Enforcement: We may disclose your PHI for law enforcement purposes, such as to report certain types of wounds or injuries, or to comply with a court order, warrant, or other legal process.
Research: We may use and disclose your PHI for research purposes when the research has been approved by an institutional review board and privacy protections are in place.
Organ and Tissue Donation: If you are an organ donor, we may disclose your PHI to organizations that handle organ procurement, transplantation, or donation.
Workers’ Compensation: We may disclose your PHI for workers’ compensation or similar programs that provide benefits for work-related injuries or illnesses.
Military and Veterans: If you are a member of the armed forces, we may disclose your PHI as required by military authorities.
Inmates: If you are an inmate, we may disclose your PHI to the correctional institution or law enforcement official having custody of you.

Your Rights Regarding PHI

You have the following rights with respect to your PHI:

Right to Inspect and Copy: You have the right to inspect and copy your PHI that we maintain, with certain exceptions. To request access, submit a written request to our Privacy Officer. We may charge a reasonable fee for the costs of copying, mailing, or other supplies associated with your request.
Right to Amend: You have the right to request an amendment to your PHI if you believe it is incorrect or incomplete. To request an amendment, submit a written request to our Privacy Officer, specifying the information you believe is incorrect and why. We may deny your request if we believe the information is accurate and complete, or if we did not create the information.
Right to an Accounting of Disclosures: You have the right to request an accounting of disclosures of your PHI made by us in the past six years, except for disclosures made for treatment, payment, or healthcare operations, and certain other disclosures. To request an accounting, submit a written request to our Privacy Officer.
Right to Request Restrictions: You have the right to request a restriction on our use or disclosure of your PHI for treatment, payment, or healthcare operations. We are not required to agree to your request but will consider it. To request a restriction, submit a written request to our Privacy Officer, specifying the restriction you are requesting and to whom it applies.
Right to Request Confidential Communications: You have the right to request that we communicate with you about your PHI in a certain way or at a certain location. To request confidential communications, submit a written request to our Privacy Officer, specifying how or where you wish to be contacted.
Right to a Paper Copy of This Notice: You have the right to receive a paper copy of this Notice, even if you have agreed to receive it electronically. To obtain a paper copy of this Notice, contact our Privacy Officer.
Right to be Notified of a Breach: You have the right to be notified in the event that we discover a breach of your PHI.

Transmission of PHI

We are committed to protecting the privacy of your PHI and will ensure that any electronic transmission of PHI complies with the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule (45 CFR 164). This includes the use of Secure-Socket Layer (SSL) or equivalent technology for the transmission of PHI, as well as adherence to all applicable security standards for online transmissions of PHI.

Changes to This Notice

We reserve the right to change this Notice and the revised Notice will be effective for PHI we already have about you, as well as any information we receive in the future. We will post a copy of the current Notice in our office and on our website. The Notice will contain the effective date on the first page.

Complaints

If you believe your privacy rights have been violated, you may file a complaint with our Privacy Officer or with the Secretary of the Department of Health and Human Services. You will not be retaliated against for filing a complaint.

Contact Information

To exercise any of your rights, or if you have any questions about this Notice or our privacy practices, please contact our Privacy Officer at:

{legalBusinessName} {customerServiceAddress} {domain} {customerServiceEmail}

This Notice is provided in accordance with the Notice of Privacy Practices for Protected Health Information from the Department of Health and Human Services’ Model and is applicable across all US states. Rights of Specific Jurisdictions within the US Certain states may have additional privacy protections that apply to your PHI. The following is an example of specific rights in the state of California. If you reside in a state with additional privacy protections, you may have additional rights related to your PHI.

California Residents:

Right to Access: In addition to the rights described above, California residents have the right to request access to their PHI in a readily usable electronic format, as well as any additional information required by California law. To request access, submit a written request to our Privacy Officer.
Right to Restrict Certain Disclosures: California residents have the right to request restrictions on certain disclosures of their PHI to health plans if they paid out-of-pocket for a specific healthcare item or service in full. To request such a restriction, submit a written request to our Privacy Officer.
Confidentiality of Medical Information Act (CMIA): California residents are protected by the Confidentiality of Medical Information Act (CMIA), which provides additional privacy protections for medical information. We are required to comply with CMIA in addition to HIPAA.
Marketing and Sale of PHI: California residents have the right to request that their PHI not be used for marketing purposes or sold to third parties without their authorization. To request a restriction on the use of your PHI for marketing or the sale of your PHI, submit a written request to our Privacy Officer.
Minor’s Rights: If you are a minor (under the age of 18), you have the right to request that certain information related to certain sensitive services, such as reproductive health, mental health, or substance use disorder treatment, not be disclosed to your parent or guardian without your consent. To request a restriction on the disclosure of such information, submit a written request to our Privacy Officer.

If you reside in a state other than California, please consult your state’s specific privacy laws for information about any additional rights you may have regarding your PHI. You may also contact our Privacy Officer for more information about your rights under specific state laws.

{legalBusinessName} Privacy Policy: Notice of Privacy Practices for Protected Health Information (PHI) – State-Specific Provisions

In addition to the privacy practices described in our Notice of Privacy Practices for Protected Health Information, we comply with applicable state-specific privacy laws related to PHI.

The following are examples of a few states with additional privacy protections:

New York:

For residents of New York, we comply with the New York State Confidentiality of Information Law, which provides additional privacy protections for HIV-related information, mental health records, and genetic testing results. We will obtain written consent before disclosing such information, even for treatment, payment, or healthcare operations.

Texas:

For residents of Texas, we comply with the Texas Medical Privacy Act, which offers privacy protections beyond HIPAA, including requiring consent for certain disclosures of PHI, additional safeguards for electronic PHI, and specific requirements for the destruction of PHI. We also adhere to Texas’s specific privacy protections for mental health records and substance use treatment records.

Florida:

For residents of Florida, we comply with Florida’s privacy laws, which offer additional protections for mental health records, HIV/AIDS-related information, and substance abuse treatment records. We will obtain written consent before disclosing such information, even for treatment, payment, or healthcare operations. We also implement specific security measures to protect electronic PHI, as required by Florida law.

Illinois:

For residents of Illinois, we comply with Illinois’s specific privacy laws related to mental health records, HIV/AIDS-related information, and genetic testing results. We will obtain written consent before disclosing such information, even for treatment, payment, or healthcare operations. In addition, we will notify patients of any unauthorized access to their electronic PHI, as required by Illinois law.

Massachusetts:

For residents of Massachusetts, we comply with Massachusetts’s specific privacy laws related to mental health records, HIV/AIDS-related information, and genetic testing results. We will obtain written consent before disclosing such information, even for treatment, payment, or healthcare operations. We also implement specific security measures to protect electronic PHI, as required by Massachusetts law.

California:

For residents of California, we comply with the Confidentiality of Medical Information Act (CMIA), as well as California’s specific privacy laws related to marketing, sale of PHI, and minors’ rights. We will obtain written consent before disclosing certain information and adhere to additional privacy protections, as required by California law.