Notice of Privacy Practices

1. Who This Notice Covers

This Notice applies to the independent professional entity that provides clinical care through the RubyMD platform (the "Practice," "we," "us," or "our") and the healthcare professionals and workforce members who provide or support care through the Practice as permitted by law. The Practice is the healthcare provider or professional entity responsible for the clinical care it provides and for maintaining applicable patient records.

The Practice uses a technology and administrative platform branded as RubyMD. RubyMD provides non-clinical technology, administrative, scheduling, customer-support, payment-administration, education, marketing, and operational services. RubyMD is not the healthcare provider or pharmacy. If RubyMD creates, receives, maintains, or transmits protected health information on the Practice's behalf, RubyMD does so as a business associate or service provider under appropriate written arrangements. This Notice is issued by the Practice; it is not a substitute for RubyMD's public website Privacy Policy.

2. Our Legal Duties

We are required by law to maintain the privacy and security of your protected health information ("PHI"). We are required to provide you with this Notice of our legal duties and privacy practices concerning PHI. We will notify you as required by law if a breach occurs that may have compromised the privacy or security of your PHI. We must follow the duties and privacy practices described in the Notice currently in effect.

We may change the terms of this Notice, and the changes may apply to all PHI we maintain. A current copy will be available on our website, through the patient portal, and upon request.

3. Your Rights

You have the following rights concerning your PHI. To exercise a right, contact our Privacy Official using the information in Section 10. We may ask you to submit a written request and may verify your identity where appropriate.

4. Your Choices

For certain PHI, you may tell us your preferences concerning whether and how we share information with your family, close friends, or other people involved in your care or payment for care, or in a disaster-relief situation. If you cannot tell us your preference, for example because you are unconscious, we may share information if we believe it is in your best interest or necessary to lessen a serious and imminent threat to health or safety, as permitted by law.

We will obtain your written authorization before using or disclosing your PHI for purposes that require authorization, including most uses and disclosures for marketing, sale of PHI, and most uses and disclosures of psychotherapy notes. You may revoke an authorization in writing at any time, except to the extent we have already acted in reliance on it.

5. How We Typically Use or Share Your PHI

We may use or disclose your PHI without your written authorization for the following purposes, subject to applicable law.

Treatment

We may use and disclose PHI to provide, coordinate, or manage your healthcare and related services. For example, a Provider may review your health information, coordinate care with another healthcare professional, discuss a prescription with a pharmacy, or refer you for additional services.

Payment

We may use and disclose PHI to bill for and collect payment for healthcare services. Although the Practice may offer cash-pay services and not bill insurance, this category may apply if payment activities occur. For example, we may use PHI to process a payment, provide a receipt, respond to a payment inquiry, or obtain payment where applicable.

Healthcare Operations

We may use and disclose PHI to operate, improve, and manage our practice, maintain quality and safety, train workforce members, evaluate performance, conduct audits, manage risk, address legal matters, and provide customer or patient support. For example, we may review records to improve the quality of care or use service providers that assist us with secure technology, scheduling, records management, billing, and operations.

We may contact you for appointment reminders, scheduling notices, refill or follow-up reminders, treatment-related information, payment communications, and information about health-related products or services that may be relevant to your care, as permitted by law. You may request confidential communications or reasonable alternative methods of contact.

6. Other Uses and Disclosures Allowed or Required by Law

We may use or disclose PHI in other situations when allowed or required by law, including to:

• help with public-health and safety matters, such as reporting disease, adverse medication reactions, suspected abuse or neglect, product recalls, or a serious threat to health or safety;
• conduct health research when legal requirements are met;
• comply with federal, state, or local law and with lawful government requests;
• respond to organ and tissue donation requests;
• work with a coroner, medical examiner, or funeral director when a person dies;
• respond to workers' compensation, law-enforcement, health-oversight, military, national-security, or other specialized government requests as permitted by law; and
• respond to a court order, administrative order, subpoena, or other legal process when permitted or required by law.

We will make disclosures only as permitted or required by applicable law. State laws may provide stronger protections for certain information, such as mental-health, reproductive-health, genetic, HIV, substance-use-disorder, or other sensitive information. When state or other law provides greater protection than HIPAA, we will follow the more protective law.

7. Substance Use Disorder Records, if Applicable

If the Practice is a federally assisted program subject to 42 CFR Part 2 and maintains records relating to the diagnosis, treatment, or referral for treatment of a substance use disorder, those records may receive additional federal protections. The Practice will use and disclose those records in accordance with applicable Part 2 requirements, HIPAA, and state law.

You may have additional rights and protections regarding these records. If you receive substance-use-disorder services subject to 42 CFR Part 2, we will provide any additional Part 2 notice that applies before or at the time those services are provided.

8. Our Service Providers and Business Associates

We may use service providers, including a RubyMD-branded technology and administrative platform, that create, receive, maintain, or transmit PHI on our behalf to perform functions such as hosting, scheduling, secure communications, patient support, payment administration, records management, quality assurance, analytics permitted by law, or other healthcare operations. When required, we obtain written assurances that those providers will appropriately safeguard PHI and use it only as permitted by law and contract.

We do not permit advertising pixels, behavioral-advertising tags, session-replay tools, or similar marketing trackers to be deployed in the patient portal, intake, scheduling, telehealth visit, payment-for-care, or medical-record environments. Public website marketing activities are governed by RubyMD's public Privacy Policy and should not be used as a channel for clinical information.

9. Uses and Disclosures Requiring Your Authorization

We will obtain your written authorization before using or disclosing PHI when authorization is required. In particular, we will not sell your PHI, use or disclose it for most marketing purposes, or use or disclose psychotherapy notes unless you authorize it or law permits or requires the activity without authorization. You may revoke an authorization in writing, but revocation will not affect actions already taken in reliance on it.

10. Contact Information and Complaints

To exercise a right, request a copy of this Notice, request confidential communications, ask a question, or file a complaint with the Practice, contact:

You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1-877-696-6775, or visiting hhs.gov/ocr/privacy/hipaa/complaints. We will not retaliate against you for filing a complaint.

11. Changes to This Notice

We may change this Notice and make the new Notice applicable to PHI we already have and to PHI we receive in the future. The current Notice will be posted on our website and through the patient portal and made available upon request. The Last Updated date at the top identifies the current version.

12. Acknowledgment of Receipt

The Practice may ask you to acknowledge receipt of this Notice. Your acknowledgment confirms that the Notice was made available to you; it does not limit your rights. If you decline to sign an acknowledgment, the Practice may document that it made the Notice available.

When this Notice is made available through the secure workflow, the Practice records your name, the date and time the Notice was made available, the version of the Notice, and your electronic acknowledgment if one is obtained.