Notice of Privacy Practices

Effective Date: June 3, 2016

THIS NOTICE DESCRIBES HOW HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

THIS NOTICE APPLIES ONLY WHEN ARIVALE INC. IS ACTING AS A COVERED ENTITY.  ARIVALE INC. IS A COVERED ENTITY IN ALL OF ITS SERVICE OFFERINGS, EXCEPT WHEN IT IS PROVIDING SERVICES AS A BUSINESS ASSOCIATE TO A HEALTH PLAN (INCLUDING, BUT NOT LIMITED TO, A SELF-INSURED EMPLOYER HEALTH PLAN).  WHEN ARIVALE INC. IS PROVIDING SERVICES AS A BUSINESS ASSOCIATE TO A HEALTH PLAN, THE HEALTH PLAN’S NOTICE OF PRIVACY PRACTICES APPLIES. YOU SHOULD REVIEW THAT NOTICE OF PRIVACY PRACTICES AS THE NOTICE BELOW MAY NOT BE APPLICABLE.

Our Commitment to Your Privacy

Arivale Inc. (“Arivale,” “we” or “us”) is dedicated to maintaining the privacy of your Protected Health Information (“PHI”) in its provision of wellness coaching services (the “Services”). PHI is information about you that may be used to identify you (such as your name, social security number or address) (“Identifying Information”), and that relates to (a) your past, present or future physical or mental health or condition, (b) the provision of Services under Arivale’s wellness program (a) and (b) together, “Medical Information”), or (c) your past, present, or future payment for the provision of Services (“Payment Information”). In conducting our business, we will receive and create secure records containing your PHI. We are required by law to maintain the privacy of your PHI and to provide you with notice of our legal duties and privacy practices with respect to your PHI.

We must abide by the terms of this Notice while it is in effect.  This current Notice takes effect on the date above, and will remain in effect until we replace it. We reserve the right to change the terms of this Notice at any time, as long as the changes are in compliance with applicable law.  If we change the terms of this Notice, the new terms will apply to all PHI that we maintain, including PHI that was created or received before such changes were made.  If we change this Notice, we will post the new Notice on our website and will make the new Notice available upon request.

Uses and Disclosures of PHI

We may use and disclose your PHI in the following ways:

1. Provision of our Services. We may use your PHI to provide you with the Services. For example, a coach who is providing Services to you and an advising member of our clinical team may discuss your personalized wellness plan roadmap so the coach can best support your success.  We may share your PHI with lab or assay services, sample collection services, contracted physicians or other contractors in order to provide you with the Services.  For example, we may share family health history that you provide to us with our contracted physicians who order and provide initial review of your lab results.

2. Payment. We may use your PHI, or share it with others, so that we can obtain payment for the Services we provide to you. For example, your first name, last name, and email address with may be shared with the vendor that processes payments for the Services for the purpose of collecting payments as they come due.

3. Health Care Operations. We may use your PHI, or share it with others, in order to conduct our operations. For example, the Coaching Management team may use your PHI to review the Services that we provide to you to evaluate the performance of our Coaches that provide you with our Services, and educate our staff on how to improve the Services.

4. Health-Related Benefits and Services. We may use and disclose your PHI, such as your email address, to tell you about health-related benefits or services that may be of interest to you.

5. Reminders. We may use and disclose your PHI, such as a mobile number or text message, to contact you in an effort to provide appointment reminders regarding your use of the Services.

6. Business Associates. We contract with third parties known as “business associates” to provide certain services on our behalf. For example, we contract with a vendor to process and collect payments for the Services.  To protect your PHI, we require our business associates to appropriately safeguard your information.

7. As Required by Law. We may disclose your PHI when required to do so by federal, state or local law.

8. To Avert a Serious Threat to Health or Safety. We may use and disclose your PHI when necessary to prevent a serious threat to your health or safety or the health or safety of the public or another person.

9. Friends, Family Members or Employers Involved in Your Services or Payment for Your Services. Unless you ask us not to do so, we may share your PHI, such as your name, with a friend or family member who is involved in your receipt of the Services or payment for the Services. AS A REMINDER, IF YOU ARE RECEIVING OUR SERVICES THROUGH AN EMPLOYER OFFERING, THERE MAY BE DIFFERENT POLICIES AS THEY RELATE TO SHARING DATA WITH THE EMPLOYER HEALTH PLAN.

10. Special Situations. We may also use and disclose your PHI:

  1. For public health activities, such as required disclosures to governmental public health agencies regarding instances of reportable disease or injury;
  2. To notify the appropriate government authority if we believe that you have been the victim of abuse, neglect or domestic violence.
  3. For health oversight activities, including, for example, audits, investigations, inspections and licensure.
  4. In response to a valid court or administrative order, subpoena or other lawful process.
  5. For law enforcement purposes when asked to do so by a law enforcement official under certain circumstances (e.g., following a crime) and subject to certain requirements (e.g., warrant, subpoena, administrative request).

11. Authorization. Except as described above or as permitted by law, we will disclose your PHI only with your prior written authorization. Certain uses and disclosures of PHI for marketing purposes and any sale of your PHI require your written authorization.  You may revoke that authorization, in writing, at any time.  However, uses and disclosures of PHI made before you revoke your authorization are not affected by your action, and we cannot take back any disclosures we may have already made with your earlier authorization.

Your Rights Regarding Your PHI

You have the following rights regarding the PHI maintained by us:

1. Confidential Communication. You have the right to request that we communicate with you about health matters in a certain way or at a certain location. If you want us to communicate with you in a special way, contact our Privacy Officer by emailing privacy@arivale.com with your request and details about how to contact you. All reasonable requests will be granted.

2. Request Restrictions. You have the right to request a restriction or limitation on the PHI we use or disclose about you when providing the Services or in our payment or health care operations functions. You also have the right to request a limit on the PHI we disclose about you to someone who is involved in you care or the payment for your care, like a family member or friend.  Except as expressly stated in this section below, we are not required to agree to your request.  If we agree, we will comply with your request unless the PHI is needed to provide you emergency treatment.  We are required to agree to your request to restrict certain disclosures of your name to a health plan, but only if you pay (or someone other than the health plan pays on your behalf) out of pocket in full for the health care item or service about which the restriction is requested.  To request restrictions, you must make your request in writing to our Privacy Officer by emailing privacy@arivale.com.  In your request, you must tell us (i) what PHI you want to limit; (ii) whether you want to limit our use, disclosure, or both; and (iii) to whom you want the limits to apply, for example, disclosure to your spouse.

3. Inspection and Copies. You have the right to inspect and copy your PHI that may be used to make decisions about your care. This includes records about the Services and billing records. To inspect and copy your PHI, you must submit your request in writing to our Privacy Office.  You may request an electronic copy of your PHI that is maintained by us in electronic designated record sets, and we will provide you access in the electronic form and format requested if it is readily reproducible in the requested format.  If not, we will the discuss the issue with you and provide a copy in a readable electronic form and format upon which we mutually agree, such as MS Word or Excel, text, HTML or text-based PDF format depending on the PHI and our capabilities at the time of the request.  You may also request that we send your PHI directly to a person you designate if your written request is signed, in writing and clearly identifies both the person designated and an address to send the requested PHI.  If you request a copy of the PHI, we may charge a fee for the costs of copying the PHI (whether in paper or electronic form), mailing the copy when requested, supplies for creating the paper copy (or electronic media, if the request is to provide the PHI on portable electronic media) and preparing an explanation or summary of the PHI, if appropriate.  Under certain very limited circumstances, we may deny your request to inspect and copy your PHI.  If you are denied access to your PHI for any other reason, you may request that the denial be reviewed.  Another licensed health care professional chosen by us will review your request and the denial.  The person conducting the review will not be the person who denied your request.  We will comply with the outcome of the review.

4. Amendment. You have a right to request that we amend your PHI if you believe it is incorrect or incomplete. To request an amendment, please submit a written request to our Privacy Office with a reason that supports your request. We may, under certain circumstances, deny your request by sending you a written notice of denial.  If we deny your request, you may submit a statement of disagreement.  We will keep the statement on file and distribute it with all future disclosures of the PHI to which it relates.

5. Accounting of Disclosures. You have a right to receive a list of certain disclosures we have made of your PHI in the six years prior to your request. This list will not include every disclosure made, including those disclosures made in the course of providing the Services or in our payment or health care operations functions. You must submit your request in writing to the Privacy Office.  Your request must specify the time period for which you want to receive the accounting.  The first accounting you request in a 12-month period will be free, and we may charge you for additional requests in that same period.

6. Breach Notification. You have the right to be notified in the event that we (or a service provider of ours) discover a “breach” your unsecured PHI, which means that your PHI has been used or disclosed in a way that is inconsistent with law and results in it being compromised.

7. Paper Copy. You have the right to obtain a paper copy of this Notice from us at any time upon request. To obtain a paper copy of this notice, please contact us by calling 206-981-5834 or emailing us at concierge@arivale.com.

8. Complaint. You may file a complaint with us or with the Secretary of the U.S. Department of Health and Human Services if you believe that your privacy rights have been violated. To file a complaint with us, you must submit a statement in writing to privacy@arivale.com. We will not retaliate against you for filing a complaint.

9. Further Information. If you would like more information about your privacy rights, please contact us by calling 206-981-5834 and ask to speak to the Privacy Officer. To the extent you are required to send a written request to us to exercise any right described in this Notice, you must submit your request to us at privacy@arivale.com.