Notice of Privacy Practices

1. Our Duties Regarding PHI

HIPAA requires covered healthcare providers and other covered entities to maintain the privacy and security of PHI, provide a notice of privacy practices, follow the terms of the notice currently in effect, and notify affected individuals after certain breaches of unsecured PHI. WellMensRX may support these covered entities as a service provider or business associate.

PHI is information that identifies you and relates to your past, present, or future health, healthcare, or payment for healthcare. In this telehealth context, PHI may include intake answers, medical history, contraindication screening, clinician notes, prescriptions, pharmacy records, medication instructions, adverse-event communications, portal messages, and payment records tied to care.

2. How PHI May Be Used and Disclosed

PHI may be used and disclosed without your written authorization for the following purposes.

Treatment

• Independent licensed clinicians may review your intake, medical history, current medications, allergies, goals, contraindications, and portal messages to decide whether treatment is medically appropriate.
• Clinicians may follow up with questions, provide instructions, decline treatment, issue a prescription, request additional information, or recommend in-person care.
• When a prescription is issued, necessary information may be sent to Epiq Scripts, Rush Pharmacy, or another licensed pharmacy to compound, dispense, label, counsel on, and ship medication.
• Dosable or similar portal vendors may process PHI to support intake, secure messaging, document handling, patient access, and care coordination.

Payment

• PHI may be used to bill you, process payment, issue refunds, resolve chargebacks, verify transaction details, and maintain required accounting records.
• Payment processors receive only the information needed to complete payment, fraud screening, and refund functions. Full card numbers are handled by the payment processor.

Healthcare Operations

• PHI may be used for quality review, safety monitoring, credentialing support, compliance audits, training, patient support, recordkeeping, technology operations, security, fraud prevention, and service improvement.
• Where possible, information used for reporting, analytics, or improvement is aggregated or de-identified.

3. Other Uses and Disclosures Permitted or Required by Law

PHI may also be used or disclosed without your authorization when permitted or required by law, including:

• Required by law: disclosures required by federal, state, or local law.
• Public health and safety: reporting adverse events, product quality issues, communicable disease concerns, recalls, or threats to health or safety.
• Health oversight: disclosures to medical boards, pharmacy boards, FDA, HHS, or other agencies for audits, investigations, inspections, licensure, or enforcement.
• Judicial and administrative proceedings: responses to court orders, subpoenas, discovery requests, or lawful processes, subject to required safeguards.
• Law enforcement: limited disclosures to law enforcement when permitted by HIPAA and applicable law.
• Serious threats: disclosures needed to prevent or lessen a serious and imminent threat to health or safety.
• Workers' compensation: disclosures authorized by laws relating to workers' compensation or similar programs.
• Coroners, medical examiners, and funeral directors: disclosures needed for legally authorized duties.
• Personal representatives: disclosures to someone legally authorized to act for you, such as a healthcare power of attorney, parent or guardian where applicable, or court-appointed representative.
• Business associates: disclosures to vendors who perform services involving PHI and are required to protect it under a business associate agreement or similar legal obligation.

4. Uses That Require Your Written Authorization

We will obtain your written authorization before using or disclosing PHI for purposes that require authorization under HIPAA, including:

• Most marketing uses of PHI.
• Any sale of PHI.
• Most uses or disclosures of psychotherapy notes, if any exist.
• Uses or disclosures of substance use disorder treatment records protected by 42 CFR Part 2, if such records are ever created or received by a covered participant.
• Any other use or disclosure not described in this Notice and not otherwise permitted by law.

You may revoke an authorization in writing at any time. Revocation will not affect uses or disclosures already made in reliance on the authorization.

5. Your Rights

You have the following rights with respect to PHI, subject to limits and exceptions under HIPAA and state law.

• Right to inspect and copy: You may request access to PHI in a designated record set and receive a copy in paper or electronic form where available.
• Right to amend: You may request that inaccurate or incomplete PHI be amended. A request may be denied for reasons permitted by law, and you may submit a statement of disagreement.
• Right to an accounting of disclosures: You may request a list of certain disclosures of PHI made during the period allowed by law.
• Right to request restrictions: You may request limits on certain uses or disclosures. The request may not always be granted, except where HIPAA requires agreement, such as certain paid-in-full services you ask not to disclose to a health plan.
• Right to confidential communications: You may request that communications be sent to a different address, phone number, or method if reasonable.
• Right to receive a copy of this Notice: You may request a paper or electronic copy at any time.
• Right to be notified after a breach: You have the right to receive notice after certain breaches of unsecured PHI.
• Right to complain: You may file a complaint with us or with the U.S. Department of Health and Human Services, Office for Civil Rights. You will not be retaliated against for filing a complaint.

6. Your Choices

In some situations, you may tell the applicable clinician, pharmacy, or support team whether to share information with family members, caregivers, or others involved in your care or payment. If you cannot tell us your preference, information may be shared if it is in your best interest and permitted by law.

You may also ask that a prescription be sent to a pharmacy of your choice when legally and operationally available. Some compounded medications may be available only through pharmacies capable of preparing the prescribed formulation.

7. De-Identified and Aggregated Information

PHI may be de-identified or aggregated as permitted by law. Once information is de-identified under HIPAA, it is no longer PHI and may be used for analytics, quality improvement, service design, compliance reporting, and business operations.

8. Changes to This Notice

This Notice may be changed at any time. Changes may apply to PHI already maintained and PHI created or received in the future. The current Notice will be posted on the WellMensRX website, and copies will be available upon request.

9. Complaints and Questions

If you believe your privacy rights have been violated, you may contact us or file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, at hhs.gov/hipaa/filing-a-complaint.

We will not retaliate against you for filing a complaint.

10. Contact Information