HIPAA Privacy Notice

MyCyberClinics is committed to protecting the privacy and security of patients' health information. We follow applicable HIPAA privacy and security requirements and take appropriate measures to protect personal health information (PHI) from unauthorised access, use, disclosure or loss.

This notice explains how health information may be used and disclosed, the rights available to individuals, and our responsibilities in protecting their information.

Protected Health Information (PHI) refers to individually identifiable health information, including:

• Names, contact details and other identifying information.
• Medical histories and health records.
• Diagnoses, treatment information and clinical notes.
• Health conditions and information about healthcare services.
• Other information that identifies an individual and relates to their health or healthcare.

Where applicable under HIPAA, individuals have the right to:

• Access their information: Request access to and copies of their health records.
• Request corrections: Ask for corrections to information they believe is inaccurate or incomplete.
• Request restrictions: Ask that certain uses or disclosures of their health information be restricted.
• Request confidential communications: Ask to be contacted through a preferred method or at a specific address.
• Request an accounting of disclosures: Request a record of certain disclosures of their health information.
• Receive a copy of this notice: Obtain a copy of our HIPAA Privacy Notice.
• File a complaint: Report concerns about how their health information has been handled without fear of retaliation.

We may use or disclose health information for purposes permitted under applicable HIPAA requirements, including:

• Treatment: Supporting healthcare delivery, care coordination and communication between authorised healthcare providers.
• Payment: Activities related to billing, claims and payment for healthcare services, where applicable.
• Healthcare Operations: Activities necessary to support healthcare operations, quality improvement and service administration, where applicable.
• Legal Requirements: Disclosures required by applicable laws and regulations.
• Public Health and Safety: Disclosures permitted for public health activities and to prevent serious threats to health or safety.
• Other Permitted Purposes: Other disclosures permitted under HIPAA and applicable regulations.

Certain uses and disclosures of health information require written authorisation, including:

• Uses and disclosures for marketing where HIPAA requires authorisation.
• Sale of protected health information.
• Other uses and disclosures not otherwise permitted under HIPAA without authorisation.

Individuals may revoke an authorisation in writing, subject to applicable legal limitations and actions already taken in reliance on that authorisation.

MyCyberClinics may work with third-party service providers who support its operations and may require access to protected health information.

Where applicable, these service providers are required to follow appropriate privacy and security obligations. Business Associate Agreements (BAAs) will be maintained with business associates where required under HIPAA.

We implement appropriate safeguards to protect health information, including:

• Administrative safeguards to manage access and protect information.
• Technical safeguards to protect electronic health information.
• Physical safeguards to prevent unauthorised access to systems and facilities.
• Access controls to ensure that only authorised individuals can access information necessary for their responsibilities.

If a breach involving protected health information occurs, MyCyberClinics will investigate and take appropriate steps in accordance with applicable HIPAA requirements.

Where a breach is reportable, affected individuals and relevant regulatory authorities will be notified within the timelines required by law.

Individuals who have questions about this notice, wish to exercise their privacy rights or have concerns about how their health information is handled may contact MyCyberClinics through its designated privacy contact.

Individuals may also submit complaints to the US Department of Health and Human Services Office for Civil Rights:

HHS Office for Civil Rights: privacy complaints

MyCyberClinics will not retaliate against anyone for filing a privacy complaint.

Contact our support team to route a privacy question, request or complaint to the appropriate person. Please do not include medical records or sensitive health details in your initial email.

Contact support: customerservice@mycyberclinics.com

MyCyberClinics does not discriminate against any individual on the basis of race, colour, national origin, disability, or sex.

We are committed to providing our services fairly and equally, without discrimination on any of these grounds.

MyCyberClinics is committed to protecting the privacy and security of health information. Where HIPAA applies, we are responsible for:

• Protecting the privacy of individuals' health information.
• Providing a notice explaining our privacy practices and legal responsibilities.
• Following the terms of our applicable privacy notice.
• Not using or disclosing health information beyond what is permitted or required by law.
• Notifying affected individuals of breaches when required by law.
• Ensuring relevant third-party service providers protect health information appropriately.

MyCyberClinics may update this HIPAA Privacy Notice when necessary to reflect changes in its privacy practices, services or applicable legal requirements.

Updated versions will be made available on the website, with the effective date clearly indicated.