This Website Privacy Policy (this “Policy”) governs the Company’s information practices for this public-facing Website. The Company may act as a HIPAA Business Associate in limited circumstances when it creates, receives, maintains, or transmits Protected Health Information (“PHI”) on behalf of a covered entity through specific, clearly designated Website features. To the extent information collected through the Website constitutes PHI, this Policy and applicable HIPAA requirements govern notwithstanding any conflicting provisions in the Terms of Service. By accessing or using the Website you acknowledge that you have read and agree to this Policy.
The Company may collect:
Where the Company Processes PHI as a Business Associate, the applicable covered entity’s notice of privacy practices (and not this Policy) describes permitted uses and disclosures of PHI by the covered entity and individuals’ rights with respect to PHI. This Policy describes the Company’s Website privacy practices and, to the extent the Company Processes PHI through the Website on behalf of a covered entity, the Company will handle such PHI in accordance with HIPAA and the Company’s applicable business associate obligations.
The Company may Process information collected through the Website to operate, maintain, secure, and improve the Website; respond to inquiries; provide support; communicate about Website functionality and security; prevent fraud and misuse; comply with law; and enforce this Policy. To the extent any information collected through the Website constitutes PHI, the Company will make uses, disclosures, and requests for PHI subject to HIPAA’s minimum necessary standard and will make reasonable efforts to ensure that access to PHI in connection with the Company’s services is limited to the minimum necessary to accomplish the intended purpose of the particular use, disclosure, or request. The Company will support and document its minimum necessary determinations consistent with reasonable recordkeeping practices and taking into account relevant privacy and security risks and the Company’s technical capabilities.
The Website uses cookies, pixels, SDKs, tags, scripts, and similar technologies (collectively, Tracking Technologies) to operate the Website, maintain session state, remember preferences, measure performance, detect and prevent fraud and misuse, and understand how users interact with the Website. The Company may collect, through Tracking Technologies, information such as IP address, device identifiers, browser type, operating system, referring/exit pages, pages viewed, links clicked, timestamps, approximate location derived from IP address, and other usage and diagnostic data (collectively, Usage Data). The Company will not intentionally deploy Tracking Technologies on the Website for the purpose of collecting Protected Health Information (PHI) unless the Website feature expressly indicates it is intended for PHI and is secured for that purpose. Users may control cookies through browser settings and, where available on the Website, through cookie preference tools; however, disabling certain cookies may cause portions of the Website to function improperly. Where required by applicable law, the Company will provide notice and obtain consent for non-essential cookies before placing them. The Company may use Analytics providers and other vendors to support Website operations; to the extent any such vendor creates, receives, maintains, or transmits PHI on behalf of the Company in connection with the Website, the Company will require such vendor to be bound by written obligations consistent with the Company’s HIPAA business associate responsibilities. To the extent any information collected through Tracking Technologies constitutes PHI, the Company will make uses, disclosures, and requests for such PHI subject to HIPAA’s minimum necessary standard and will make reasonable efforts to ensure access to PHI in connection with Website-related services is limited to the minimum necessary to accomplish the intended purpose of the particular use, disclosure, or request; the Company will support its minimum necessary determinations with a rational justification reflecting (i) the Company’s technical capabilities and (ii) relevant privacy and security risks, and will record and maintain documentation of such determinations consistent with reasonable recordkeeping practices and HIPAA rules.
Where applicable the Company will implement and maintain administrative, technical, and physical safeguards designed to protect the privacy and security of PHI and ePHI and to prevent uses or disclosures not permitted by HIPAA. The Company acknowledges that, as a Business Associate, it may be directly liable under HIPAA and the HITECH Act and subject to civil (and, in certain cases, criminal) penalties for making uses or disclosures of PHI not authorized by HIPAA or required by law and for failing to safeguard ePHI in accordance with the HIPAA Security Rule.
The Company may disclose information to vendors and service providers that support the Website (including hosting, analytics, security, and communications providers) solely to perform services for the Company. To the extent any such vendor or service provider creates, receives, maintains, or transmits PHI on behalf of the Company, the Company will ensure such subcontractor or agent agrees in writing to the same restrictions, conditions, and obligations that apply to the Company with respect to such PHI, including compliance with applicable HIPAA requirements. The Company remains responsible for such subcontractors to the extent required by law.
The Company may disclose information (including, where applicable, PHI) as required by law or legal process, or as reasonably necessary to protect the rights, safety, and security of the Company, Website users, and others. The Company may transfer information in connection with a merger, acquisition, reorganization, financing, or sale of assets, provided that any recipient is bound to protect such information consistent with this Policy and, for PHI, consistent with HIPAA and applicable business associate obligations.
The Company will retain Personal Information only as long as reasonably necessary for the purposes described in this Policy, unless a longer period is required or permitted by law. To the extent the Company receives or creates PHI through the Website on behalf of a covered entity, upon termination of the applicable relationship or as otherwise required, the Company will
The Company may update this Policy from time to time. Changes are effective when posted on the Website unless a later effective date is stated. Continued use of the Website after posting constitutes acceptance of the updated Policy.
