Introduction

HealFast, Inc., doing business through HealFastRx ("HealFast," "HealFastRx," "we," "us," or "our"), operates the website located at www.healfastrx.com and related websites, software, applications, and services that we own or operate, collectively referred to as the "Platform."

Your access to and use of the Platform, any content made available through the Platform, and any products or services made available through HealFastRx or in connection with the Platform, collectively referred to as the "Service," are subject to this Privacy Policy unless specifically stated otherwise.

We are committed to respecting the privacy of users of the Service. This Privacy Policy explains how HealFastRx collects, uses, discloses, and otherwise processes information in connection with the Service.

Certain healthcare services accessible through the Service may be provided by or through independent medical groups, licensed healthcare providers, licensed pharmacies, technology providers, including Bask Health, payment processors, and other third-party service providers.

By creating, registering, or logging into an account through the Service, or otherwise accessing or using the Service, you acknowledge the practices described in the most recent version of this Privacy Policy.

If we make changes to this Privacy Policy, we will post the revised Privacy Policy and update the effective date.

If you use the Service on behalf of an individual other than yourself, you represent that you are authorized to act on that individual's behalf and that the individual acknowledges the practices described in this Privacy Policy.

Limitations on Use by Minors

The Service is generally intended for individuals who are at least eighteen (18) years of age, or such older age as may be required by applicable state law in the jurisdiction in which an individual uses the Service.

The Service is not designed or intended to attract, and is not directed to, children under eighteen (18) years of age.

If we obtain actual knowledge that we have collected personal information from an individual under eighteen (18) years of age in violation of applicable law, we will use reasonable efforts to discontinue use of that information and delete or otherwise appropriately handle it, except where retention is required by law.

We may not be required to erase or eliminate certain content or information in circumstances where federal, state, or local law requires retention, where information must be maintained by a healthcare provider or pharmacy as part of a medical or pharmacy record, where information has been de-identified, or where another applicable legal exception applies.

Protected Health Information

Certain components of the Service may require you to provide health or medical information.

Some health information may constitute "protected health information," or "PHI," under the Health Insurance Portability and Accountability Act of 1996 and its related regulations and amendments, collectively referred to as "HIPAA."

HIPAA does not necessarily apply to an entity or to information simply because health-related information is involved.

Independent Medical Groups, Providers, Pharmacies, or other parties involved in your care may be "covered entities" or "business associates" under HIPAA.

HealFast itself may or may not be a covered entity under HIPAA depending on the context and the particular services being provided. In certain circumstances, HealFast or a technology provider acting on behalf of HealFast may function as a business associate of a Medical Group, Provider, Pharmacy, or other covered entity.

To the extent HealFast is acting as a business associate, and solely in its role as a business associate, HealFast may be subject to certain provisions of HIPAA with respect to PHI that HealFast maintains or processes on behalf of the applicable covered entity.

Information that does not constitute PHI or other protected medical information under applicable law may be used or disclosed as permitted under this Privacy Policy and applicable law.

Protected Information does not include information that has been properly de-identified in accordance with applicable law.

Information you provide to HealFast for purposes such as establishing a customer relationship, creating an account, processing a payment, arranging shipping, communicating with customer support, or otherwise using non-clinical portions of the Service may not constitute PHI even when related to your use of a healthcare-related Service.

Where a separate Notice of Privacy Practices applies to PHI collected in connection with medical treatment, that Notice of Privacy Practices will govern the applicable PHI to the extent required by law.

Collection of Personal Information

The personal information we collect depends on how you interact with us, the Services you use, and the choices you make.

We may collect information from information you provide directly, information collected automatically, information obtained from third-party sources, and information we infer or generate from other information.

Information You Provide Directly

We may collect personal information you provide to us, including:

• Name and contact information. This may include your name, email address, telephone number, billing address, physical address, and shipping address.
• Demographic information. This may include information such as your age, date of birth, gender, ZIP code, state of residence, or other demographic information.
• Payment information. This may include payment card information, billing information, financial account information, payment status, or other transaction-related information. Payment information may be collected directly by third-party payment processors rather than stored directly by HealFast.
• Content and files. This may include photographs, videos, documents, identification documents, messages, emails, or other files you provide through the Service.
• Government-issued identification. We or our service providers may collect information from a driver's license, passport, or other government-issued identification where required for identity verification or regulatory compliance.
• Account access information. This may include usernames, account numbers, passwords, security codes, authentication information, or other credentials used to access an account or patient portal.
• Communications. We may collect the contents of communications you make through or in connection with the Service.
• Health information. When you use telehealth or healthcare-related components of the Service, information concerning your health may be collected, including your medical history, current medications, treatment goals, symptoms, allergies, health conditions, weight, height, and other information relevant to medical evaluation or treatment.

Information We Collect Automatically

When you use the Service, we and our service providers may automatically collect certain information.

• Identifiers and device information. Our servers or service providers may automatically log your Internet Protocol address and information about your device, including device type, operating system, browser type, browser version, language, settings, configuration, and device or advertising identifiers.
• Usage data. We may automatically collect information about how you use the Service, including the website or page from which you arrived, pages you view, links you click, time spent on pages, access times, interactions with the website, and other activity.

Because HealFastRx is a health-related service, information concerning the pages you visit or actions you take may in some circumstances constitute sensitive personal information or consumer health data under applicable state law.

Information We Create or Generate

We may infer information based on other information we collect.

For example, we may infer your approximate geographic location, such as city, state, or country, based on your IP address.

Information We Obtain From Third Parties

We may receive information from third parties involved in providing, operating, supporting, or marketing the Service, including:

• Bask Health and other technology providers
• Independent Medical Groups
• Licensed healthcare Providers
• Licensed Pharmacies
• Payment processors
• Identity verification providers
• Shipping and fulfillment providers
• Analytics providers
• Advertising and marketing partners
• Customer service providers
• Fraud prevention and security providers
• Social networks or applications with which you choose to interact
• Publicly available sources
• Other service providers acting on our behalf

The information received depends on the services being provided and may include contact information, account information, identity verification information, transaction information, order information, prescription status, shipping information, or other information needed to facilitate the Service.

You may decline to provide certain personal information. However, if information is necessary to provide a particular Service or feature, that Service or feature may not be available if you decline to provide the information.

Cookies, Pixels, Mobile IDs, and Similar Technologies

We use cookies, pixels, web beacons, analytics technologies, advertising identifiers, server-side tracking technologies, and similar technologies to operate and improve the Service and collect information regarding use of the Service.

Cookies

Cookies are small text files placed on your device by a website. Cookies can allow a website to recognize your browser over time and remember certain information or preferences.

Web Beacons and Pixels

Web beacons and pixels are small electronic technologies that may be incorporated into websites, applications, or emails. These technologies can allow us or third parties to determine whether a webpage or email was accessed and to collect information regarding interactions with the Service.

Analytics and Advertising Technologies

HealFastRx may use analytics, advertising, and measurement services and technologies, including:

• Google Analytics 4 (GA4)
• Meta technologies, including the Meta Pixel and related conversion technologies
• TikTok Pixel and related TikTok advertising technologies
• Stape and related server-side tracking infrastructure

These technologies may collect identifiers, IP addresses, device information, browser information, usage information, page-view information, referral information, advertising identifiers, and information concerning interactions with the Service.

Depending on the pages you visit or actions you take, information concerning your browsing activity may reveal an interest in health-related services and therefore may qualify as sensitive personal information or consumer health data under certain state privacy laws.

We use these technologies to:

• Operate and secure the Service
• Analyze website performance
• Understand how users interact with the Platform
• Improve the user experience
• Measure marketing and advertising effectiveness
• Attribute conversions
• Prevent fraud
• Personalize certain experiences
• Deliver and measure advertising where permitted by law
• Maintain preferences and settings
• Perform other legitimate business functions

Our analytics and advertising partners may process information according to their own privacy policies and practices.

Where required by applicable law, we will provide appropriate choices or obtain consent for the use of certain cookies or tracking technologies.

Use of Personal Information

We use personal information for purposes described in this Privacy Policy or otherwise disclosed to you.

Product and Service Delivery

We may use personal information to provide and deliver the Service, including facilitating access to telehealth services, supporting your navigation through the Service, confirming your location, processing requests, and improving or personalizing the Service.

Business Operations

We may use personal information to operate our business, including:

• Processing payments
• Accounting
• Administering accounts
• Confirming orders
• Coordinating shipping
• Improving operations
• Securing systems
• Detecting fraudulent or unlawful activity
• Verifying identity
• Complying with legal obligations
• Protecting HealFast's rights and property

Telehealth and Healthcare Services

Where applicable, information may be used to:

• Facilitate your online medical intake
• Verify identity
• Connect you with licensed healthcare Providers
• Facilitate provider review of your health information
• Support medical communications
• Coordinate prescriptions
• Coordinate pharmacy fulfillment
• Facilitate refills
• Support ongoing care
• Operate patient portal functionality
• Facilitate other healthcare-related services requested by you

Medical treatment and prescribing decisions are made by licensed medical Providers, not HealFast.

Product Improvement, Development, and Research

We may use information to develop, test, analyze, or improve the Service, content, features, products, and services.

We may also analyze traffic, user behavior, and activity through the Service.

Personalization

We may use information to understand preferences and improve or personalize the user experience.

Customer Support

We may use information to provide customer support, respond to questions, fulfill requests, assist with orders, or resolve problems.

Communications

We may communicate with you by email, telephone, text message, mail, or other channels regarding:

• Account information
• Order confirmations
• Payment information
• Shipping notifications
• Service updates
• Technical notices
• Security alerts
• Patient portal notifications
• Support messages
• Administrative communications
• Other Service-related information

We may also facilitate communications on behalf of or between you and a Medical Group, Provider, Pharmacy, or other service provider involved in your care.

Marketing

Where permitted by applicable law, we may communicate with you about HealFastRx services, promotions, offers, products, or other information we believe may be relevant to you.

Advertising

We may use information concerning interactions with the public-facing Service to promote and market HealFastRx and measure advertising effectiveness, subject to applicable privacy, health privacy, advertising, and consumer protection laws.

De-Identified Information

Where permitted by law, we may de-identify or aggregate information so that it can no longer reasonably be used to identify an individual.

We may use and disclose properly de-identified or aggregated information for lawful business purposes.

Where information has been permanently de-identified, we will not attempt to re-identify it except as permitted by applicable law, such as for purposes of testing the effectiveness of the de-identification process.

SMS Communications and Consent

By providing your telephone number and affirmatively opting in to receive text communications, you consent to receive recurring marketing or non-marketing text messages from or on behalf of HealFastRx.

Message frequency may vary.

Messages may include:

• Account notifications
• Order updates
• Shipping updates
• Service reminders
• Patient portal notifications
• Promotional offers
• Other information related to your use of the Service

Message and data rates may apply.

You may opt out of marketing SMS communications at any time by replying STOP.

For assistance, you may reply HELP or contact us at support@healfastproducts.com.

Consent to receive marketing text messages is not a condition of purchasing any product or service.

You may continue to receive certain non-marketing, transactional, or legally required communications where permitted by law.

Disclosure of Information

We may disclose personal information with your consent, where necessary to complete transactions or provide services you request, or as otherwise permitted or required by law.

Service Providers

We may disclose personal information to vendors and service providers that perform services on our behalf, including technology providers, hosting providers, analytics providers, customer service providers, security providers, identity verification providers, communications providers, and other vendors.

Payment Processing and Financial Services

When you provide payment information or complete a transaction, payment and transaction information may be disclosed to third-party payment processors, financial institutions, fraud prevention providers, and other entities as necessary to complete the transaction.

Medical Groups and Providers

We may facilitate information sharing between you and independent Medical Groups and licensed healthcare Providers as necessary to allow Providers to conduct medical evaluations, communicate with you, provide treatment, and perform related healthcare services.

Pharmacies

Information may be disclosed to licensed Pharmacy partners as necessary to process prescriptions, dispense medications, communicate with patients, coordinate fulfillment, and comply with legal and regulatory obligations.

Shipping and Fulfillment Providers

Information such as your name, address, telephone number, and shipment information may be disclosed to carriers, pharmacies, and fulfillment providers as necessary to deliver products or medications to you.

Marketing and Advertising Partners

We may allow marketing, analytics, and advertising partners, including Google, Meta, TikTok, and related technology providers, to collect or receive certain information concerning interactions with the public-facing Platform.

Depending on applicable law, certain disclosures involving advertising identifiers, cookies, browsing activity, or similar information may constitute a "sale," "sharing," or use of information for "targeted advertising," even where no money is exchanged.

Where required by law, we will provide applicable opt-out rights.

Legal and Law Enforcement

We may access, disclose, or preserve personal information where we believe doing so is reasonably necessary to:

• Comply with applicable law
• Respond to lawful legal process
• Respond to requests from law enforcement or government agencies
• Protect users or other individuals
• Prevent fraud
• Prevent serious injury
• Maintain the security of the Service
• Protect the rights or property of HealFast or others
• Enforce our Terms, agreements, or policies

Business Transactions

Personal information may be disclosed or transferred in connection with an actual or proposed merger, acquisition, financing, sale of assets, restructuring, bankruptcy, or similar corporate transaction.

Third-Party Services

The Service may include links, integrations, references, or connections to third-party services whose privacy practices differ from ours.

If you provide information directly to a third party, that information may be governed by the third party's privacy policy.

Choice and Control of Personal Information

We provide various ways for you to control the personal information we maintain about you.

Depending on where you live, some of these choices may constitute legal rights.

Promotional Communications

You may choose whether to receive promotional email or SMS communications from us.

If you receive a promotional email and wish to stop receiving promotional emails, you may use the unsubscribe instructions included in the email.

If you receive marketing SMS messages and wish to stop receiving them, reply STOP.

These choices may not apply to transactional, administrative, legally required, or other non-promotional communications.

Cookie Controls

Most browsers are configured to accept cookies automatically.

You may be able to use your browser settings to delete, block, or reject cookies.

Blocking or deleting cookies may affect the availability or functionality of certain portions of the Service.

Global Privacy Control

Some browsers and browser extensions support Global Privacy Control, or "GPC," signals.

Where required by applicable law, we will make reasonable efforts to recognize valid GPC signals as requests to opt out of certain data processing, including sales, sharing, or targeted advertising.

Because these preferences may be browser or device specific, you may need to enable them separately on each browser or device you use.

Do Not Track

Certain browsers provide "Do Not Track," or "DNT," functionality.

There is currently no uniform industry standard for interpreting DNT signals. As a result, we may not respond to DNT signals unless required by applicable law.

Other privacy controls, including cookie settings and GPC, may be available.

Advertising Controls

You may also be able to control interest-based advertising through browser, operating system, platform, or industry-based advertising settings.

These settings generally apply to a particular device or browser.

Privacy Requests

Where permitted by applicable law, we may decline a privacy request if:

• We cannot reasonably verify your identity
• The request would violate applicable law
• The request would adversely affect another person's privacy or legal rights
• The request would reveal legally protected or confidential information
• The request would interfere with a legal or business obligation requiring retention or use
• The request is unreasonable or excessive
• Another exception permitted by applicable law applies

Data Retention

HealFast may retain personal information for as long as reasonably necessary to provide the Service, fulfill the purposes described in this Privacy Policy, comply with legal obligations, resolve disputes, prevent fraud, maintain business records, or enforce agreements.

Medical Groups, Providers, Pharmacies, Bask Health, payment processors, and other third-party service providers may maintain information according to their own legal, regulatory, contractual, or operational retention requirements.

Different categories of information may therefore be retained for different periods.

We may delete or dispose of information when it is no longer reasonably necessary, except where retention is required by applicable law or another legal obligation.

Transactions

In connection with transactions conducted through or in connection with the Service, you may be required to provide information including:

• Your name
• Payment information
• Billing address
• Shipping address
• Telephone number
• Email address
• Other information reasonably required to facilitate the transaction

Payment transactions may be processed through third-party payment processing technology.

HealFast does not necessarily directly store complete payment card information.

Third-party payment processors are independent service providers and may maintain their own privacy and security policies.

Jurisdictional Issues

The Service is intended for use within the United States and may only be available in states where applicable Services, Providers, Pharmacies, and other parties are legally permitted to operate.

Our collection, use, and disclosure of information is subject to applicable United States federal and state laws.

California Residents

If you are a California resident and the processing of your personal information is subject to the California Consumer Privacy Act, as amended, you may have certain rights regarding your personal information.

Notice at Collection

At or before the collection of personal information, California residents may have the right to receive information regarding:

• Categories of personal information collected
• Categories of sensitive personal information collected
• Purposes for which personal information is collected or used
• Whether personal information is sold or shared
• Retention practices
• Available privacy rights

This Privacy Policy describes these practices.

Right to Know

You may have the right to request information concerning personal information we have collected about you, including information about our collection, use, disclosure, sale, or sharing of personal information.

Right to Correct

You may have the right to request correction of inaccurate personal information.

Right to Delete

You may have the right to request deletion of certain personal information, subject to applicable exceptions.

Right to Opt Out of Sale or Sharing

You may have the right to opt out of the "sale" or "sharing" of personal information as those terms are defined under California law.

California defines "sale," "sharing," and "personal information" broadly.

Certain activities involving advertising and analytics providers may therefore be considered a sale or sharing even where HealFast does not receive monetary compensation.

For example, analytics or advertising providers may collect:

• IP addresses
• Cookie identifiers
• Device identifiers
• Browsing activity
• Page views
• Clicks
• Advertising interactions
• Approximate geolocation information

To exercise an applicable opt-out right, you may contact us at support@healfastproducts.com.

We will also honor valid Global Privacy Control signals where required by applicable law.

Sensitive Personal Information

California residents may have the right to limit certain uses or disclosures of sensitive personal information where applicable.

Minors

We do not knowingly sell or share personal information of individuals under sixteen (16) years of age.

Authorized Agents

You may designate an authorized agent to make certain privacy requests on your behalf where permitted by law.

We may require documentation establishing the agent's authority and may require you to verify your identity directly.

Verification

We may need to verify your identity before providing, correcting, or deleting personal information.

Verification may include confirming information associated with your account or communicating with you through an email address or telephone number associated with your account.

Non-Discrimination

You have the right not to receive unlawful discriminatory treatment for exercising privacy rights provided by applicable law.

Other State Privacy Rights

Residents of certain other U.S. states may have rights regarding their personal information or consumer health data under applicable state privacy laws.

Depending on your state of residence, you may have the right to:

• Access personal information
• Correct inaccurate information
• Delete certain information
• Obtain a portable copy of information
• Opt out of targeted advertising
• Opt out of certain sales of personal information
• Opt out of certain profiling
• Withdraw consent for certain consumer health data processing
• Appeal a denial of a privacy request

To exercise an applicable privacy right, contact support@healfastproducts.com.

Consumer Health Data

Certain information collected through or in connection with the Service may constitute "consumer health data" under applicable state laws.

Consumer health data may include information that identifies or can reasonably be associated with an individual's physical or mental health status, treatment, medications, health conditions, bodily functions, health-related purchases, or information inferred from such data.

Where required by applicable law, we will provide notices and obtain consent before collecting, using, or disclosing consumer health data for purposes that require consent.

Additional privacy rights may apply to consumer health data depending on your state of residence.

Miscellaneous

We use reasonable administrative, technical, and physical safeguards designed to protect information under our control.

However, no system, database, website, network, or electronic transmission method can be guaranteed to be completely secure.

You are responsible for maintaining the confidentiality of your account credentials.

If you believe your account or personal information has been compromised, please contact us promptly.

You may choose not to provide certain information, but doing so may limit your ability to use certain features or Services.

HealFast may supplement, modify, or update this Privacy Policy from time to time.

Any revised Privacy Policy will be posted on this page and will identify the current effective date.

Where required by law, we may provide additional notice or request consent to material changes.

Contacting Us

If you have questions about this Privacy Policy or wish to exercise a privacy right, please contact:

• HealFast, Inc.
• 1209 Orange Street
• Wilmington, DE 19801
• United States
• Email: support@healfastproducts.com
• Website: www.healfastrx.com

Notice of Privacy Practices for Protected Health Information

Applicability of This Notice

The following Notice of Privacy Practices applies to the extent HealFast is required by applicable law to provide such a Notice or maintains PHI on behalf of a covered healthcare Provider, Medical Group, Pharmacy, or other covered entity.

Independent Providers, Medical Groups, and Pharmacies may provide separate Notices of Privacy Practices that govern PHI maintained by them.

Uses and Disclosures of PHI

Where applicable, PHI may be used or disclosed for the following purposes:

Treatment: PHI may be used or disclosed to provide, coordinate, or manage healthcare and related services. This may include communicating with healthcare Providers regarding your treatment and coordinating care among Providers, Medical Groups, Pharmacies, and other healthcare entities.

Payment: PHI may be used or disclosed as necessary to obtain or process payment for healthcare services or medications. This may include billing, payment processing, collection activities, and information sharing necessary to facilitate payment.

Healthcare Operations: PHI may be used or disclosed for healthcare operations where permitted by law. Healthcare operations may include:

• Quality assessment
• Quality improvement
• Case management
• Accreditation
• Licensing
• Credentialing
• Medical review
• Auditing
• Compliance
• Legal services
• Other healthcare operational activities

As Required by Law: PHI may be used or disclosed where required by federal, state, or local law.

Public Health and Safety: PHI may be disclosed for legally authorized public health activities, including certain activities relating to:

• Disease prevention
• Injury prevention
• Public health reporting
• Adverse drug reactions
• Product issues
• Abuse or neglect
• Communicable diseases
• Other legally authorized public health matters

Health Oversight Activities: PHI may be disclosed to authorized health oversight agencies for activities such as audits, investigations, inspections, licensing, or other legally authorized oversight functions.

Judicial and Administrative Proceedings: PHI may be disclosed in response to a valid court order, administrative order, subpoena, discovery request, or other lawful process where permitted or required by law.

Law Enforcement: PHI may be disclosed for legally permitted law enforcement purposes, including in response to lawful warrants, court orders, subpoenas, or other legal processes.

Research: PHI may be used or disclosed for research where legally permitted and where required safeguards, approvals, authorizations, or waivers are in place.

Organ and Tissue Donation: Where applicable, PHI may be disclosed to organizations involved in organ procurement, transplantation, or donation.

Workers' Compensation: PHI may be disclosed where permitted or required for workers' compensation or similar programs.

Military and Veterans: PHI may be disclosed as authorized by applicable law for certain military or veterans-related purposes.

Correctional Institutions: If you are an inmate or otherwise in the custody of a correctional institution, PHI may be disclosed to the institution or applicable law enforcement officials where permitted by law.

Your Rights Regarding PHI

Where HIPAA or another applicable medical privacy law applies, you may have certain rights concerning your PHI.

Right to Inspect and Obtain a Copy: You may have the right to inspect or obtain a copy of PHI maintained about you, subject to applicable exceptions. Reasonable fees may apply where permitted by law.

Right to Request an Amendment: You may have the right to request correction or amendment of PHI you believe is inaccurate or incomplete. A request may be denied where permitted by law, including where the information is determined to be accurate and complete or was not created by the party receiving the request.

Right to an Accounting of Disclosures: You may have the right to request an accounting of certain disclosures of your PHI. Certain disclosures, including disclosures for treatment, payment, healthcare operations, and other legally excluded categories, may not be included.

Right to Request Restrictions: You may have the right to request restrictions on certain uses or disclosures of PHI. Not all requested restrictions are required to be accepted unless applicable law provides otherwise.

Right to Request Confidential Communications: You may have the right to request that communications concerning your PHI be sent to you in a particular manner or at a particular location.

Right to a Paper Copy: You may have the right to request a paper copy of an applicable Notice of Privacy Practices even if you have agreed to receive it electronically.

Right to Breach Notification: Where required by law, you have the right to receive notification following certain breaches of unsecured PHI.

Transmission and Security of PHI

Where HealFast maintains or transmits PHI subject to HIPAA, reasonable and appropriate safeguards will be used consistent with applicable HIPAA Privacy and Security Rule requirements.

Electronic transmission of PHI may use encryption and other technical security safeguards intended to protect information during transmission.

Changes to This Notice

We reserve the right to revise this Notice where permitted by law.

A revised Notice may apply to PHI already maintained as well as information received in the future where permitted by applicable law.

The current version will be made available through the HealFastRx website or other appropriate location.

Complaints

If you believe your privacy rights concerning PHI have been violated, you may submit a complaint to the applicable Medical Group, Provider, Pharmacy, HealFast Privacy Officer, or the U.S. Department of Health and Human Services, as applicable.

You will not be retaliated against for submitting a good-faith privacy complaint.

Privacy Contact Information

To exercise applicable rights or ask questions regarding privacy practices, contact:

• HealFast, Inc.
• 1209 Orange Street
• Wilmington, DE 19801
• United States
• Email: support@healfastproducts.com
• Website: www.healfastrx.com

State-Specific Health Privacy Provisions

Certain states provide additional protections concerning medical information, health information, or PHI.

The following summarizes examples of additional state protections that may apply depending on your residence, the nature of the information, and the entities involved.

California

California residents may have additional protections under California laws governing medical information, consumer privacy, sensitive personal information, and consumer health information. These rights may include additional rights to access, correct, restrict, or control certain disclosures of medical or health-related information.

New York

New York law may provide additional protections for certain categories of health information, including HIV-related information, mental health information, genetic information, and other specially protected records. Additional consent requirements may apply to certain disclosures.

Texas

Texas law may provide privacy protections for medical information in addition to federal HIPAA requirements. Additional requirements may apply to the use, disclosure, safeguarding, or destruction of certain health information.

Florida

Florida law may provide additional protections for certain healthcare information, including certain mental health, HIV/AIDS-related, substance use, and other health records. Additional authorization requirements may apply.

Illinois

Illinois law may provide additional protections concerning mental health records, genetic information, biometric information, HIV/AIDS-related information, and other specially protected information.

Massachusetts

Massachusetts law may provide additional protections regarding certain medical information, mental health records, HIV-related information, genetic information, and security of personal information.

If state law provides privacy protections that are more protective than federal law or this Notice, the applicable state law will control to the extent required.