HIPAA Notice of Privacy Practices

1. Applicability of This Notice

Your Stride, LLC operates the YourStrideRx.com platform and is not a health care provider, pharmacy, or medical practice. Medical services made available through the platform are provided by Beluga Health, P.A. and its affiliated licensed health care providers, who are responsible for the provision of medical care, including clinical evaluation and prescribing decisions.

To the extent protected health information is created or maintained in connection with medical services provided through YourStrideRx.com, Beluga Health, P.A. is the applicable health care provider and HIPAA covered entity, and its Notice of Privacy Practices governs the use and disclosure of protected health information relating to those medical services.

Pharmacy services are provided by independently licensed pharmacies, which maintain responsibility for their own pharmacy services and applicable privacy obligations.

Beluga Health, P.A. publishes the following for patients:

• Beluga Health, P.A. Privacy Policy (PDF) — how Beluga collects, uses, and protects patient information, and how to reach its privacy contact at security@belugahealth.com.
• Informed Consent for Telehealth Services (PDF) — what to expect from your telehealth provider, the limits of telehealth, and the terms you agree to before care begins.

To request a copy of the Notice of Privacy Practices of Beluga Health, P.A., or of the pharmacy that dispensed your prescription, contact our Privacy Officer using the information in Section 13, and we will direct your request to the correct party.

2. Who This Notice Covers

This notice describes the privacy practices that apply to protected health information created or maintained in connection with your use of YourStrideRx.com. “Protected health information” means individually identifiable health information about your past, present, or future physical or mental health, the health care you receive, and payment for that care. This notice refers to that information as “your health information.”

In this notice, “we,” “us,” and “our” refer to Beluga Health, P.A. and its affiliated licensed health care providers with respect to your medical care, and to Your Stride, LLC when it handles your health information on their behalf in operating the platform. Your Stride, LLC does not make clinical decisions and does not practice medicine, pharmacy, or any other licensed health profession.

This notice applies to your health information. Information that is not health information — for example, general website analytics that are not linked to your care — is addressed in our Privacy Policy. Where the two documents cover the same information, this notice governs.

3. Your Rights

You have the following rights regarding your health information. To exercise any of them, contact our Privacy Officer using the information in Section 13. We may ask you to put your request in writing and to verify your identity before we act on it.

Get an electronic or paper copy of your health information

You may ask to inspect or receive a copy of the health information we hold about you, including your medical record and billing records. We will provide a copy, or a summary if you agree to one, usually within 30 days of your request. If we need more time, we will tell you in writing. If you ask for an electronic copy of information we keep electronically, we will provide it in the form and format you request if we can readily produce it. We may charge a reasonable, cost-based fee. In limited circumstances we may deny your request; if we do, we will explain why in writing and tell you whether the denial can be reviewed.

Ask us to correct your health information

If you believe health information we hold about you is incorrect or incomplete, you may ask us to amend it. We will respond within 60 days. We may deny your request — for example, if the information was not created by us or is accurate and complete — and if we do, we will explain why in writing and tell you how to submit a statement of disagreement.

Ask us to limit what we use or share

You may ask us to restrict how we use or disclose your health information for treatment, payment, or health care operations. We are not required to agree to your request, and we may say no if it would affect your care.

There is one restriction we must honor: if you pay for a service or item out of pocket in full, you may ask us not to disclose that information to your health plan for purposes of payment or health care operations, and we will agree unless a law requires us to share it. Because services obtained through YourStrideRx.com are generally self-pay, this right may apply to most of your care with us.

Request confidential communications

You may ask us to contact you in a specific way — for example, at a particular phone number or address, or by mail rather than by phone or email. We will accommodate all reasonable requests, and we will not ask you why you are making the request.

Get a list of those with whom we have shared your information

You may request an accounting of disclosures of your health information for the six years before the date of your request. The accounting will not include disclosures for treatment, payment, and health care operations, disclosures you authorized, and certain other disclosures that the law excludes. We will provide one accounting free of charge in any 12-month period and may charge a reasonable, cost-based fee for additional requests within that period.

Get a paper copy of this notice

You may ask for a paper copy of this notice at any time, even if you agreed to receive it electronically, and we will provide one promptly.

Choose someone to act for you

If you have given someone medical power of attorney, or if someone is your legal guardian, that person may exercise your rights and make choices about your health information. We will verify that the person has this authority before we act.

File a complaint if you believe your rights were violated

You may complain to us and to the U.S. Department of Health and Human Services. See Section 12. We will not retaliate against you for filing a complaint.

4. How We Use and Share Your Health Information

We may use and share your health information for the following purposes without a separate authorization from you.

For your treatment

We use and share your health information with the licensed health care providers, pharmacists, and other professionals involved in your care so they can evaluate, prescribe, dispense, and follow up on your treatment. For example, the health history and responses you submit in your online assessment are provided to the Beluga Health, P.A. provider who reviews them, and if that provider writes a prescription, the prescription and the information the pharmacy needs are sent to the independently licensed pharmacy that prepares and ships your medication.

For payment

We use and share your health information to bill and collect payment for the services and medications you receive. For example, we share the information a payment processor needs to charge the card you provide at checkout, and we may share information with a bank or processor to resolve a disputed or reversed charge.

For our health care operations

We use and share your health information to run our operations, improve your care, and meet our legal and quality obligations. For example, we review records of provider consultations and pharmacy fulfillment to check the quality and safety of the services delivered through our platform, and we use aggregated information to train our support staff and evaluate our vendors.

5. Other Ways We May Use or Share Your Health Information

We are permitted or required to use or share your health information in the following additional ways, without your authorization, and only in the manner the law allows.

• When required by law. We will share information when federal, state, or local law requires it, including with the U.S. Department of Health and Human Services if it wants to see whether we are complying with federal privacy law.
• Public health and safety activities. We may share information to prevent or control disease, injury, or disability; to report births and deaths; to report adverse events, product defects, or problems with medications or medical products to the Food and Drug Administration; and to notify a person who may have been exposed to a disease.
• Victims of abuse, neglect, or domestic violence. We may notify government authorities, including a social service or protective services agency, if we reasonably believe you are a victim of abuse, neglect, or domestic violence, as the law allows or requires.
• Health oversight activities. We may share information with agencies that oversee the health care system, including for audits, investigations, inspections, and licensure actions.
• Judicial and administrative proceedings. We may share information in response to a court or administrative order, or in response to a subpoena, discovery request, or other lawful process where the required assurances have been given.
• Law enforcement. We may share information with law enforcement officials for purposes the law permits, such as responding to a court order, warrant, or grand jury subpoena, or identifying or locating a suspect, fugitive, witness, or missing person.
• Serious threat to health or safety. We may share information when necessary to prevent or lessen a serious and imminent threat to your health or safety or to the health or safety of the public.
• Coroners, medical examiners, and funeral directors. We may share information with a coroner, medical examiner, or funeral director as necessary for them to carry out their duties.
• Organ and tissue donation. We may share information with organ procurement organizations as necessary to facilitate donation and transplantation.
• Research. We may use or share information for research when an institutional review board or privacy board has approved a waiver of authorization, or when the information has been de-identified or is otherwise permitted for research use.
• Workers’ compensation. We may share information as authorized by, and to the extent necessary to comply with, workers’ compensation laws.
• Specialized government functions. We may share information for military and veterans’ activities, national security and intelligence activities, protective services for the President and others, and the health and safety of inmates and those in lawful custody.
• Business associates. We may share information with vendors who perform services for us — for example, hosting, telehealth technology, payment processing, and shipping coordination. Each is required by a written contract to safeguard your health information and to use it only for the services it performs for us.
• People involved in your care. We may share information relevant to your care with a family member, friend, or other person you identify as involved in your care or payment for your care. If you are not present or are unable to agree, we will use our professional judgment and share only what is directly relevant. You may ask us not to make these disclosures.
• Disaster relief. We may share information with an organization assisting in a disaster relief effort so your family can be notified of your location and condition.
• Appointment and refill reminders. We may contact you with reminders about scheduled consultations, follow-up care, refills, and treatment alternatives or other health-related benefits and services that may interest you.

6. Where State Law Gives You More Protection

Some state laws protect certain health information more strictly than federal law does. Where a state law that applies to your care is more protective than this notice, we will follow that more protective law. This can include, depending on the state, additional protections for information about mental health and substance use treatment, HIV and other communicable diseases, genetic testing, and reproductive health care. Texas law also imposes additional requirements on the use and disclosure of health information, and we follow those requirements for the care we provide.

7. Uses That Require Your Written Permission

We will obtain your written authorization before we use or share your health information for any of the following:

• Most uses and disclosures of psychotherapy notes;
• Marketing purposes; and
• Any disclosure that is a sale of your health information. We do not sell your health information.

Any other use or disclosure not described in this notice will be made only with your written authorization. If you give us an authorization, you may revoke it at any time by telling us in writing. A revocation will stop future uses and disclosures made under that authorization, but it cannot undo a use or disclosure we already made while the authorization was in effect.

8. Special Protections for Reproductive Health Care Information

Federal law prohibits us from using or disclosing your health information to investigate or impose liability on any person for the act of seeking, obtaining, providing, or facilitating reproductive health care that was lawful in the state where it was provided, or to identify any person for that purpose. For example, if a law enforcement official asked us for your records in order to investigate you for lawfully obtaining reproductive health care in another state, we would refuse the request.

In addition, before we disclose health information that is potentially related to reproductive health care in response to a health oversight activity, a judicial or administrative proceeding, a law enforcement request, or a request about a decedent, we must first obtain a signed attestation from the person requesting it confirming that the information will not be used for a prohibited purpose. For example, if we received a subpoena seeking records that could relate to pregnancy status collected during your assessment, we would require a valid signed attestation before disclosing anything, and we would refuse to disclose if the attestation were not provided or were not valid.

9. Redisclosure by Others

When we disclose your health information to a person or organization that is not covered by federal health privacy law, that recipient may be permitted to disclose it again, and the information may no longer be protected by the federal privacy rules described in this notice. Other laws, or a contract between us and that recipient, may still limit what the recipient can do with the information.

10. Our Responsibilities

• We are required by law to maintain the privacy and security of your health information.
• We are required to provide you with this notice of our legal duties and privacy practices with respect to your health information.
• We are required to notify you promptly if a breach occurs that may have compromised the privacy or security of your unsecured health information.
• We are required to abide by the terms of the notice currently in effect.
• We must obtain your written permission before using or sharing your health information in any way not described in this notice, and you may tell us in writing to stop at any time.

11. Changes to This Notice

We reserve the right to change the terms of this notice, and to make the new notice provisions effective for all health information we maintain, including health information we created or received before the revised notice was issued.

If we make a material change, we will promptly revise this notice and post the revised notice prominently on YourStrideRx.com with a new effective date. You may request a copy of the notice currently in effect at any time, and we will provide a paper copy on request.

12. How to File a Complaint

If you believe your privacy rights have been violated, you may file a complaint with us, with the U.S. Department of Health and Human Services, or with both. You do not have to complain to us first.

Complaining to us

Contact our Privacy Officer by phone at (469) 559-1589 or in writing at the address in Section 13. Please describe what happened and how you believe your privacy rights were violated, and include your name and how to reach you so we can respond.

Complaining to the U.S. Department of Health and Human Services

You may file a complaint with the Secretary of the U.S. Department of Health and Human Services, Office for Civil Rights:

13. Who to Contact

For more information about this notice, to exercise any of the rights described in it, or to file a complaint, contact:

This notice is provided under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations at 45 CFR Part 160 and Part 164, Subpart E. A paper copy is available on request at no charge.