Notice of Privacy Practices

1. Our Legal Duties

We are required by law to:

• Maintain the privacy of your PHI.
• Provide you with this Notice of our legal duties and privacy practices.
• Follow the terms of this Notice.
• Notify you in the event of a breach of unsecured PHI.

2. How We May Use and Disclose Your Health Information

The following categories describe ways in which we may use and disclose your PHI:

3. Other Uses and Disclosures Permitted or Required by Law

• Required by Law: We may disclose PHI when required by federal, state, or local law.
• Public Health Activities: For disease control, reporting adverse events, and product recalls.
• Health Oversight Activities: For audits, inspections, or investigations by regulatory agencies.
• Judicial and Administrative Proceedings: In response to court orders or subpoenas.
• Law Enforcement Purposes: As required by law to report certain types of wounds or injuries.
• Threats to Health or Safety: To prevent serious threats to health or safety of a person or the public.
• Organ and Tissue Donation: If applicable.
• Military and Veterans: As required for military personnel.
• Workers' Compensation: For work-related injuries or illness.
• National Security and Intelligence: As authorized by law.

4. Uses and Disclosures Requiring Your Written Authorization

In any situation not described above, we will obtain your written authorization before using or disclosing your PHI. This includes:

• Marketing purposes not otherwise permitted by HIPAA.
• Sale of your health information.
• Most uses and disclosures of psychotherapy notes (if applicable).

You may revoke your authorization at any time, in writing.

5. Your Rights Regarding Your PHI

You have the following rights regarding your health information:

• Right to Inspect and Copy: You may request access to or copies of your PHI.
• Right to Request Amendments: You may request corrections if you believe your PHI is incorrect.
• Right to an Accounting of Disclosures: You may request a list of certain disclosures we have made.
• Right to Request Restrictions: You may request limits on the use or disclosure of your PHI.
• Right to Request Confidential Communications: You may request communication through alternative means or locations.
• Right to a Paper Copy of This Notice: You may request a paper copy even if you have agreed to receive this Notice electronically.

6. Breach Notification

In the event of a breach of your unsecured PHI, we will notify you promptly in accordance with applicable federal and state laws.

7. Our Responsibilities for Telehealth and Electronic Records

Because Joinasher.com operates via telehealth and technology platforms, we apply industry-standard safeguards to protect your PHI, including:

• Encrypted data transmission.
• Secure servers and HIPAA-compliant data storage.
• Role-based access control for authorized personnel.
• Ongoing staff training on HIPAA privacy and security obligations.

We work with third-party providers, a pharmacy partner, labs, and independent medical groups who are all bound by HIPAA or other privacy laws where applicable.

7.1 Data Retention

We retain user data for as long as the account is active or as needed to provide our services. Specifically:

• Account data is retained until the user requests deletion or the account is closed.
• Health/lab order data is retained for a minimum of 7 years in compliance with HIPAA regulations.
• Usage & analytics data is retained for up to 12 months.

After the applicable retention period, data is securely deleted or anonymized.

8. Complaints

If you believe your privacy rights have been violated, you may file a complaint with us or with the U.S. Department of Health and Human Services.

You will not be penalized for filing a complaint.

9. Changes to This Notice

We reserve the right to change this Notice at any time. Any changes will apply to all PHI that we maintain at that time. A current copy will be posted on our website at Joinasher.com.

Acknowledgement of Receipt

By using Joinasher.com services, you acknowledge receipt of this Notice of Privacy Practices.