Notice of Privacy Practices

1. Who We Are

CalyHealth ("we," "us," or "our") operates a telehealth platform in partnership with OpenLoop Health and its affiliated licensed healthcare practitioners. This Notice of Privacy Practices describes how we and our partners handle your Protected Health Information (PHI) in compliance with the Health Insurance Portability and Accountability Act (HIPAA) and applicable state privacy laws.

Medical services are provided by independent licensed clinicians through OpenLoop Health. This notice applies to CalyHealth and its business associates involved in delivering care to you.

2. Our Privacy Obligations

We are required by law to:

• Maintain the privacy and security of your Protected Health Information (PHI)
• Notify you in the event of a breach involving your unsecured PHI
• Follow the duties and privacy practices described in this notice
• Provide you with a copy of this notice upon request

3. How We May Use and Disclose Your Health Information

Treatment

We may use and share your PHI to provide, coordinate, or manage your healthcare and related services. For example, your information may be shared with the licensed clinician conducting your telehealth visit, or with our partner pharmacies (RedRock Pharmacy, Health Warehouse, Precision Medicine, or Triad Rx) to fulfill your prescription.

Payment

We may use and disclose your PHI for billing and payment purposes, including verifying insurance eligibility (where applicable) and processing payments for services rendered.

Healthcare Operations

We may use your PHI for internal operations including quality assessment, training, audits, and compliance activities necessary to operate our platform effectively and lawfully.

Other Permitted Uses Without Your Authorization

• Disclosures required by law (e.g., court orders, law enforcement)
• Public health activities (e.g., reporting communicable diseases)
• Health oversight activities by government agencies
• Research approved by an Institutional Review Board (IRB)
• Prevention of serious threats to health or safety
• Disclosures to family members or caregivers involved in your care, unless you object

4. Uses and Disclosures That Require Your Authorization

We will not use or disclose your PHI for purposes other than those described above without your written authorization, except as required by law. This includes:

• Marketing purposes
• Sale of your PHI
• Most uses of psychotherapy notes

You may revoke your authorization at any time in writing, except where we have already acted in reliance on it.

5. Highly Confidential Information

Certain categories of health information are subject to additional protections under federal and state law. We will only use or disclose the following types of information with your explicit written authorization or as strictly required by law:

• Mental health and psychiatric records
• Substance use disorder treatment information
• HIV/AIDS status and test results
• Genetic testing information
• Sexual assault records
• Reproductive health information

6. Your Rights Regarding Your Health Information

Right to Access Your Records

You have the right to inspect and obtain a copy of your medical records. Requests should be submitted in writing to support@calyhealth.com. We may charge a reasonable fee for copies.

Right to Amend Your Records

If you believe your health information is inaccurate or incomplete, you may request an amendment. We will respond within 60 days of your request.

Right to Request Restrictions

You may request that we limit how we use or disclose your PHI. We are not required to agree to your request unless the restriction is for a disclosure to a health plan for payment or healthcare operations and the information pertains solely to services you paid for out-of-pocket.

Right to Confidential Communications

You may request that we communicate with you in a specific way or at a specific location (e.g., contact you only by email at a certain address). We will honor reasonable requests.

Right to an Accounting of Disclosures

You may request a list of disclosures we have made of your PHI (other than those for treatment, payment, and healthcare operations) during the past six years.

Right to a Paper Copy of This Notice

You have the right to receive a paper copy of this notice at any time by contacting us at support@calyhealth.com.

7. Medical Records Retention

Medical records for adult patients are retained for a minimum of 10 years from the last date of service. This complies with the longest state-required retention periods as well as CMS requirements.

8. Data Security

CalyHealth implements administrative, technical, and physical safeguards to protect your PHI from unauthorized access, use, or disclosure. All data transmissions between you and our platform are encrypted. Prescription documentation is transmitted securely to our partner pharmacies through HIPAA-compliant electronic systems.

9. Breach Notification

In the event of a breach of your unsecured PHI, we will notify you as required by the HIPAA Breach Notification Rule, typically within 60 days of discovering the breach.

10. How to File a Complaint

If you believe your privacy rights have been violated, you may file a complaint with CalyHealth or with the U.S. Department of Health and Human Services Office for Civil Rights. You will not be retaliated against for filing a complaint.

To file a complaint with CalyHealth, contact us at:
CalyHealth Privacy Officer
Email: support@calyhealth.com

To file a complaint with HHS OCR, visit: www.hhs.gov/hipaa/filing-a-complaint

11. Changes to This Notice

CalyHealth reserves the right to change this notice and to make any revised notice effective for PHI we already hold as well as any we receive in the future. The current notice will always be available on our website at calyhealth.com/privacy.

12. Contact Us

For questions about this Privacy Policy or your health information rights:
CalyHealth Support
Email: support@calyhealth.com