Notice of Privacy Practices

Effective date: to be set at launch. Version: draft 1

Who follows this notice

This notice covers Aponi Health and every practitioner, employee, and volunteer who works here, across chiropractic, acupuncture, and massage therapy services. We are required by law to keep your health information private, to give you this notice of our legal duties and privacy practices, and to follow the notice currently in effect.

How we may use and disclose your health information

For treatment

We use your health information to provide your care and to coordinate it between the practitioners treating you. For example, your chiropractor may review the intake form and visit notes recorded by your massage therapist so your care plan fits together.

For payment

We may use and disclose your information to bill and collect payment for your visits, for example to prepare an invoice or, if you ask us to, a superbill you can submit to your insurer.

For health care operations

We may use your information to run the clinic well: scheduling, quality review, training, audits, and improving our services.

Appointment reminders and communications

We may contact you by email to confirm bookings and remind you about upcoming visits. You can turn reminders off in your patient portal or by asking us.

Service providers (business associates)

Some services are performed on our behalf by companies bound by written contracts (business associate agreements) that require them to protect your information the same way we must. This includes, for example, secure hosting of our records, delivery of transactional email, and technology that transcribes visit audio and drafts clinical notes for your practitioner to review. Visit audio is recorded only with the consent required by California law, is used solely to produce the transcript, and is not kept after transcription. Notes drafted with software assistance are always reviewed and signed by your practitioner.

Other uses and disclosures permitted or required by law

• When required by law, including reporting required by state or federal rules.
• Public health activities, such as disease reporting or product safety issues.
• Reports of abuse, neglect, or domestic violence, as authorized or required by law.
• Health oversight, such as audits, inspections, and licensure reviews.
• Judicial and administrative proceedings, in response to a court order, and in some cases a subpoena with required protections.
• Law enforcement, in the limited situations the privacy rules allow.
• Coroners, medical examiners, and funeral directors, as needed to carry out their duties.
• Organ and tissue donation, if applicable.
• Research, only with required approvals and safeguards.
• To avert a serious threat to your health or safety or someone else's.
• Workers' compensation, as authorized by law for work-related claims.

Uses that require your written authorization

We will not use or disclose your health information for marketing, and we will never sell your health information. Any use or disclosure not described in this notice will happen only with your written authorization, which you may revoke at any time in writing (except to the extent we have already relied on it).

Your rights

• See and get a copy of your records. You can view and export your information any time from your patient portal, or ask us for a copy (electronic or paper).
• Ask us to correct your records if you believe something is wrong or incomplete. We may deny the request in limited cases and will tell you why in writing.
• An accounting of disclosures: a list of certain disclosures we made of your information, other than for treatment, payment, operations, or ones you authorized.
• Ask us to limit what we use or share. We are not required to agree to every request, but if you pay for a service in full out of pocket, you can require us not to share that visit's information with your health plan, and we must agree.
• Confidential communications: you can ask us to contact you in a specific way, for example only by email, or at a specific number.
• Breach notification: we will notify you if a breach compromises the privacy or security of your information.
• A paper copy of this notice, on request, even if you agreed to receive it electronically.

Our duties

We are required by law to maintain the privacy and security of your health information, to give you this notice, and to follow its terms. We may update this notice; the current version will always be posted on this page and available at the front desk, and material changes will apply to information we already hold.

Complaints and questions

If you believe your privacy rights have been violated, you may file a complaint with us and with the U.S. Department of Health and Human Services, Office for Civil Rights, 200 Independence Avenue S.W., Washington, D.C. 20201, or at hhs.gov/ocr/complaints. You will never be penalized or retaliated against for filing a complaint.

Privacy contact: Aponi Health, 548 Willow Lane, San Francisco, hello@aponi.health, (415) 555-0148.