Notice of Privacy Practices

Effective date: none. This is a draft. It has not been reviewed by counsel, it has not been given to any patient, and it is not the notice currently in effect — there is no notice currently in effect.

The app's onboarding asks you to acknowledge that the clinic's Notice of Privacy Practices was provided to you, and it records the date you did. Until a reviewed notice is adopted, that acknowledgment does not correspond to a notice that is in force. The clinic has been told this and it is on the list to fix before real patients are admitted.

The clinic is required by law to keep your protected health information private, to give you this notice of its legal duties and privacy practices, to notify you if a breach affects your unsecured health information, and to follow the terms of the notice currently in effect.

The record the clinic keeps about you includes your identity and contact details, your intake (date of birth, gender, reason for visit, goals, conditions, medications, allergies, lifestyle answers and emergency contact), your appointments, body composition and lab values recorded by your clinician, provider and staff notes, your care plan and goals, your messages with the clinic, records of calls and texts including transcripts and recordings, and your rewards activity.

The most sensitive free text in that record is encrypted in the database, and every read and write of it is written to a tamper-evident audit log. The Privacy Policy describes those safeguards in detail.

• Treatment — so your clinician and the people helping with your care can plan and deliver it.
• Payment — to bill and be paid for the care you receive.
• Health care operations — quality review, training, and running the practice.
• Appointment reminders and health-related communications, including text messages and calls sent through the clinic's communications provider. You can turn reminder texts off at any time.
• Business associates — the outside services listed in the Privacy Policy that host, store, deliver or process information for the clinic. Each must be under a written agreement to protect it; those agreements are not all signed yet, which is why this pilot holds no real patient information.
• As required or permitted by law — including public health activities, reports of abuse or neglect, health oversight, judicial and administrative proceedings, law enforcement requests, coroners and funeral directors, organ donation, research under approved conditions, a serious threat to health or safety, specialized government functions, and workers' compensation.

Marketing that the clinic is paid for, any sale of your health information, and psychotherapy notes require your written authorization. So does any other use not described in this notice. You may revoke an authorization in writing at any time, except where the clinic has already acted on it.

Sending what you type to an AI provider for a personalized Medbits conversation is treated as a disclosure to a business associate. It stays switched off until the clinic completes that approval.

• Inspect and get a copy. You can see much of your record in the app already — your intake, appointments, care plan, messages and rewards. For a complete copy of the designated record set, including in an electronic format, ask the clinic.
• Request an amendment. The app lets you correct much of your own intake, and a change that matters clinically flags your chart for review. A formal amendment request goes to the clinic; if it is denied you will get the reason in writing and you may file a statement of disagreement.
• Get an accounting of disclosures. The clinic keeps a tamper-evident log of every access to your record, which is the source an accounting would be produced from.
• Request a restriction on how your information is used or shared, including the right to restrict disclosure to a health plan for a service you paid for in full out of pocket. The app has no self-pay flag today, so such a restriction would have to be handled by the clinic outside the app.
• Request confidential communications — for example only by text, or to a specific phone or email address. In the app you can already turn reminder texts off, and verifying a different mobile number changes the number the clinic texts.
• Get a paper copy of this notice, even if you agreed to receive it electronically.
• Be notified if a breach affects your unsecured health information.
• Choose someone to act for you. A personal representative with legal authority can exercise these rights on your behalf.

Requests and complaints go to the clinic. The named privacy contact, mailing address and email address have not been filled in yet — that is one of the open items at the top of this page. Until they are, ask at the front desk.

You may also complain to the U.S. Department of Health and Human Services, Office for Civil Rights, 200 Independence Avenue SW, Washington, D.C. 20201, or at hhs.gov/ocr/privacy/hipaa/complaints. You will not be retaliated against for filing a complaint.

The clinic may change this notice, and a changed notice would apply to information the clinic already holds as well as to information it receives later. The notice in effect will be posted in the office and in the app. Nothing is in effect today.