HIPAA Notice of Privacy Practices

1. About this notice

This notice describes the privacy practices of the licensed providers who treat you through Puritas, our partner pharmacy [Partner Pharmacy Name], and Puritas Telehealth, LLC acting as their business associate. Together we refer to ourselves in this notice as "we," "us," and "our."

It applies to protected health information ("PHI") — information that identifies you and relates to your physical or mental health, the health care you receive, or payment for that care. Our general Privacy Policy covers information that is not PHI, such as website usage data.

If any provider or pharmacy who treats you gives you their own notice of privacy practices, that notice governs their handling of your information.

2. Our legal duties

We are required by law to:

• maintain the privacy and security of your protected health information;
• give you this notice of our legal duties and privacy practices;
• follow the terms of the notice currently in effect;
• notify you promptly if a breach occurs that may have compromised the privacy or security of your information;
• obtain your written authorization before using or disclosing your information for any purpose not described in this notice.

3. Uses and disclosures for treatment, payment, and health care operations

Treatment

We use and disclose your information to provide, coordinate, and manage your care. For example, the provider reviewing your intake will use your medical history to decide whether a treatment is appropriate, and will send a prescription and the clinical details necessary to fill it to our partner pharmacy. If you ask us to, we will send records to your primary care clinician or another provider you name.

Payment

We use and disclose your information to bill and collect payment for the care you receive — for example, to process a card transaction, to determine what you owe, or to resolve a billing dispute or chargeback.

Health care operations

We use and disclose your information for activities necessary to run our operations, such as quality assessment and improvement, reviewing the competence and qualifications of providers, conducting training, arranging for legal and audit services, business planning, customer service, and resolving grievances.

4. Other uses and disclosures permitted or required by law

We may use or disclose your information without your authorization in the following circumstances, subject to the conditions the law imposes on each:

• As required by law — where a federal, state, or local law requires the use or disclosure.
• Public health activities — to prevent or control disease, to report births and deaths, to report reactions to medications or problems with products, to notify people of recalls, and to report suspected abuse, neglect, or domestic violence.
• Food and Drug Administration — to report adverse events, product defects, or to enable product recalls, repairs, or replacement.
• Health oversight — to agencies conducting audits, investigations, inspections, licensure actions, and other oversight of the health care system.
• Judicial and administrative proceedings — in response to a court or administrative order, or to a subpoena or discovery request where the required assurances about notice to you or a protective order have been provided.
• Law enforcement — to identify or locate a suspect, fugitive, material witness, or missing person; about a victim of a crime in limited circumstances; about a death we believe may have resulted from criminal conduct; and about criminal conduct on our premises.
• Coroners, medical examiners, and funeral directors — to identify a deceased person, determine cause of death, or carry out their duties.
• Organ and tissue donation — to organizations that handle procurement, banking, or transplantation.
• Research — where an institutional review board or privacy board has approved a waiver of authorization, or for preparatory activities and research on decedents' information.
• To avert a serious threat to the health or safety of you or the public.
• Workers' compensation — as authorized by workers' compensation or similar programs.
• Military, veterans, national security, and correctional institutions — in the specific circumstances the law describes.
• Business associates — to vendors performing functions on our behalf, each under a written agreement requiring them to protect your information.
• Individuals involved in your care — to a family member, friend, or personal representative involved in your care or payment for it, where you agree or do not object, or where in our professional judgment it is in your best interest and you are not present or able to agree.

5. Uses and disclosures that require your written authorization

Your written authorization is required before we may:

• use or disclose psychotherapy notes, except in the narrow cases the law allows;
• use or disclose your information for marketing purposes;
• sell your protected health information;
• use or disclose your information for any other purpose not described in this notice.

You may revoke an authorization in writing at any time. Revocation stops future uses and disclosures but does not undo anything we did while the authorization was in effect. Send revocations to privacy@puritasrx.com.

6. Your rights regarding your health information

Right to inspect and copy

You may inspect and obtain a copy of the health information used to make decisions about your care, including in electronic form where we maintain it electronically. We will respond within 30 days and may charge a reasonable, cost-based fee for copies. We may deny access in limited circumstances, and where we do, you may request a review of that denial.

Right to request an amendment

If you believe information in your record is incorrect or incomplete, you may ask us in writing to amend it, stating the reason. We may deny the request if the information was not created by us, is not part of the records we keep, is not information you would be permitted to inspect, or is accurate and complete. If we deny it, you may file a statement of disagreement that becomes part of your record.

Right to an accounting of disclosures

You may request a list of the disclosures we made of your information, other than those for treatment, payment, and health care operations and certain others the law excludes. The request may cover up to six years. The first accounting in any twelve-month period is free.

Right to request restrictions

You may ask us to restrict how we use or disclose your information for treatment, payment, or operations, or to a person involved in your care. We are not required to agree, except that we must agree to withhold information from a health plan where the disclosure is for payment or operations and you have paid for the item or service in full out of pocket.

Right to confidential communications

You may ask us to communicate with you in a particular way or at a particular location — for example, only by email, or only to a specific address. We will accommodate reasonable requests and will not ask you why.

Right to a paper copy of this notice

You may request a paper copy of this notice at any time, even if you agreed to receive it electronically.

Right to be notified of a breach

You will be notified if a breach occurs that may have compromised the privacy or security of your unsecured protected health information.

Right to choose someone to act for you

If you have given someone medical power of attorney, or if someone is your legal guardian, that person can exercise your rights and make choices about your information. We will verify their authority before acting.

How to exercise these rights

Submit requests in writing to the Privacy Official at the address in Section 9, or by email to privacy@puritasrx.com. We will verify your identity before acting on a request.

7. Changes to this notice

We reserve the right to change this notice and to make the revised notice effective for information we already hold as well as information we receive in the future. The current notice is always posted at puritasrx.com/legal/notice-of-privacy-practices, with its effective date shown at the top. We will provide a revised notice on request.

8. Complaints

If you believe your privacy rights have been violated, you may file a complaint with our Privacy Official using the contact details below, or directly with the Secretary of the U.S. Department of Health and Human Services:

Office for Civil Rights, U.S. Department of Health and Human Services
200 Independence Avenue SW, Washington, D.C. 20201
Telephone: 1-800-368-1019 (TDD: 1-800-537-7697)
hhs.gov/ocr/complaints

You will not be penalized or retaliated against for filing a complaint.

9. Contact

[Privacy Official Name], Privacy Official
Puritas Telehealth, LLC
000 Example Street, Suite 000
City, ST 00000
Email: privacy@puritasrx.com
Telephone: 1-800-000-0000