HIPAA Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

1. Our Commitment to Your Privacy

The Project Rx, together with the licensed healthcare providers and pharmacies who deliver care through our platform (collectively, the "Practice"), is required by the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and its implementing regulations to maintain the privacy of your Protected Health Information ("PHI"), provide you with this Notice of our legal duties and privacy practices with respect to PHI, abide by the terms of the Notice currently in effect, and notify you in the event of a breach of unsecured PHI.

2. How We May Use and Disclose Your PHI

We may use and disclose your PHI without your written authorization for the following purposes:

• Treatment. We use and disclose your PHI to provide, coordinate, or manage your healthcare. For example, your provider may share your medical history, lab results, and prescription records with consulting providers, compounding pharmacies, and laboratories involved in your care.
• Payment. We use and disclose your PHI to bill and collect payment for services rendered, including verifying coverage, processing payment instruments, and resolving disputes.
• Health Care Operations. We use and disclose your PHI for activities necessary to operate the Practice, such as quality assessment, provider credentialing, training, audits, legal services, and business planning.
• Appointment, Refill, and Care Reminders. We may contact you by phone, text, email, or in-app message to remind you of upcoming consultations, refills, or follow-up tasks.
• As Required by Law. We will disclose PHI when required by federal, state, or local law, including for public health activities, reporting suspected abuse or neglect, judicial and administrative proceedings, law enforcement requests, and to coroners or medical examiners.
• To Avert a Serious Threat to Health or Safety. We may disclose PHI to prevent or lessen a serious and imminent threat to the health or safety of you or another person.
• Health Oversight, Workers' Compensation, and Specialized Government Functions. We may disclose PHI to government agencies authorized to conduct audits, investigations, and inspections, and as required by workers' compensation laws.

3. Uses and Disclosures Requiring Your Written Authorization

Other uses and disclosures of your PHI will be made only with your written authorization. This includes most uses and disclosures of psychotherapy notes, uses or disclosures for marketing purposes, and disclosures that constitute a sale of PHI. You may revoke any authorization, in writing, at any time, except to the extent that we have already acted in reliance on it.

4. Your Rights Regarding Your PHI

• Right to Inspect and Copy. You have the right to inspect and obtain a copy of your PHI maintained in a designated record set, including in electronic format where readily producible. We may charge a reasonable, cost-based fee.
• Right to Amend. You may request that we amend PHI you believe is inaccurate or incomplete. We may deny the request in certain circumstances and will provide a written explanation.
• Right to an Accounting of Disclosures. You may request a list of certain disclosures we have made of your PHI in the six years prior to your request.
• Right to Request Restrictions. You may request that we restrict certain uses or disclosures of your PHI. We are not required to agree, except that we must agree to a request to restrict disclosure to a health plan if the disclosure is for payment or operations and the PHI pertains to a service paid for in full out of pocket.
• Right to Confidential Communications. You may request that we communicate with you about your PHI by alternative means or at an alternative location, and we will accommodate reasonable requests.
• Right to a Paper Copy of This Notice. You have the right to a paper copy of this Notice at any time, even if you previously agreed to receive it electronically.
• Right to Be Notified of a Breach. You have the right to be notified of any breach of your unsecured PHI.

5. Our Safeguards

We maintain administrative, physical, and technical safeguards designed to protect your PHI. These include role-based access controls, encryption of PHI in transit and at rest, audit logging, workforce training, and business associate agreements with vendors who handle PHI on our behalf.

6. Changes to This Notice

We reserve the right to change this Notice and to make the revised Notice effective for PHI we already have about you as well as PHI we receive in the future. The current Notice will be posted on our website with the effective date noted above and will be available at our place of service.

7. How to File a Complaint

If you believe your privacy rights have been violated, you may file a complaint with us by contacting our Privacy Officer through our Contact page. You may also file a complaint with the Secretary of the U.S. Department of Health and Human Services, Office for Civil Rights, at 200 Independence Avenue SW, Washington, D.C. 20201, by calling 1-877-696-6775, or by visiting hhs.gov/ocr/privacy/hipaa/complaints. We will not retaliate against you for filing a complaint.

8. Contact

To exercise any of the rights described above or to ask questions about this Notice, please contact our Privacy Officer through our Contact page.