Privacy Policy and Notice of Privacy Practices

1. Scope

This notice applies to information collected through Prime Health websites, forms, checkout, patient portal, staff workflows, and related support channels. Where HIPAA applies, protected health information is handled under applicable privacy and security requirements and this Notice of Privacy Practices.

2. Information We Collect

• Account and contact information, including name, email, phone, address, state, login, and authentication details.
• Health-related information you submit, including intake answers, medical history, lab-related documents, eligibility details, consents, and care preferences.
• Order, payment, and billing information, including internal order IDs, payment status, and payment method tokens. We do not store full card numbers.
• Operational communications, including portal messages, appointment details, support requests, reminders, and care coordination activity.
• Technical information, including device, browser, IP address, cookies, security logs, and site performance information.

3. How We Use Information

• To create and secure your account.
• To support intake, eligibility review, provider review, lab coordination, pharmacy coordination, and patient support.
• To process checkout, final payment authorization, refunds, fraud checks, and billing support.
• To send account, portal, appointment, payment, care coordination, and service messages.
• To operate, secure, debug, audit, improve, and maintain the platform.
• To comply with legal, regulatory, licensing, pharmacy, laboratory, payment, and security obligations.

4. Notice of Privacy Practices

We may use and disclose protected health information for treatment, payment, and health care operations when permitted by law. This includes care coordination with authorized providers, pharmacies, laboratories, support staff, payment processors, technology vendors, and service providers involved in operating the platform.

We may also use or disclose information when required or permitted by law, including public health, safety, fraud prevention, compliance, regulatory, legal, and enforcement purposes. Uses outside these purposes may require your written authorization where required by law.

5. Third-Party Data Boundaries

• Payment processors receive payment and operational identifiers needed to process transactions, not diagnoses, lab values, medication details, or intake answers.
• Advertising and analytics tools must use de-identified site and funnel events only and must not receive portal content, intake answers, treatment eligibility, lab values, diagnoses, medication names, or provider decisions.
• CRM and communication systems are limited to approved contactability, task, and operational workflow data unless a covered workflow has been approved.
• We do not sell protected health information.

6. Your Privacy Rights

Depending on applicable law, you may have rights to request access to records, request corrections, request confidential communications, request certain restrictions, receive an accounting of certain disclosures, receive a copy of this notice, and file a privacy complaint.

We will not retaliate against you for filing a privacy complaint or exercising applicable privacy rights.

7. Security

We use administrative, technical, and physical safeguards designed to protect information, including role-based access, audit logging, secure portal access, private file storage, and vendor data-boundary controls. No system can be guaranteed completely secure, so patients should protect their account credentials and report suspicious activity promptly.

8. Retention

We retain records for as long as needed to provide services, comply with legal and professional obligations, resolve disputes, support audits, and maintain security. Retention periods may vary by record type, jurisdiction, provider relationship, pharmacy workflow, laboratory workflow, and legal requirement.

9. Cookies and Site Technologies

We may use cookies and similar technologies for login sessions, security, site operation, performance measurement, attribution, and user experience. Advertising and analytics configurations must follow our health data boundary and must not include protected health information or clinical details.

10. Privacy Contact

For privacy questions, requests, or complaints, contact: support@primehealthhrt.com

If you believe your privacy rights have been violated, you may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights where applicable.