URx - Privacy Policy

This privacy policy (the “Privacy Policy”) applies to the URx mobile application (the “App”), owned and operated by URx (“URx”; also referred to as “we”, “us”, or “our”). URx has created this Privacy Policy to tell users what information the App collects, how URx uses that information, and who URx will share that information with, if at all. This Privacy Policy does not address the privacy practices of any third parties that URx does not own, control, or is affiliated with. By visiting and/or using the App, you, as a user, are agreeing to the terms of this Privacy Policy. URx encourage the user to read the Privacy Policy and to use the information it contained to help make informed decisions.

1. Information URx Collects or Receives. In the course of operating the App, URx will collect and/or receive the following types of information. You authorize us to collect and/or receive such information.

Users of the App and the services provided within agree to use this App as intended, within the laws of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), including the HIPAA Privacy Rule and the HIPAA Security Rule. Information reported to URx by the User may constitute Protected Health Information (“PHI”), as the term is defined by HIPAA. URx will comply with HIPAA as it related to your PHI.

URx is a Business Associate as the term is defined by HIPAA. In the event URx creates, receives, maintains, or otherwise is exposed to personally identifiable or aggregate patient or other medical information defined as PHI, URx shall:

4. Accessing and Modifying Information and Communication Preferences. If you have provided us any Personal Information, you may access, remove, review, and/or make changes to the same by contacting us as set forth below. In addition, you may manage your receipt of marketing and non-transactional communications by clicking on the “unsubscribe” link located on the bottom of any of our marketing e-mails. We will use commercially reasonable efforts to process such requests in a timely manner. You should be aware, however, that it is not always possible to completely remove or modify information in our subscription databases. You cannot opt out of receiving transactional e-mails related to the App (e.g., requests for support). We may also deliver notifications to your mobile device (e.g., push notifications). You can disable these notifications by deleting the relevant service or by changing the settings on your mobile device.

5. How We Protect Your Information. We take commercially reasonable steps to protect the Information from loss, misuse, and unauthorized access, disclosure, alteration, or destruction. Please understand, however, that no security system is impenetrable. We cannot guarantee the security of our databases or the databases of the third parties with which we may share such Information, nor can we guarantee that the Information you supply will not be intercepted while being transmitted over the Internet. In particular, e-mail sent to us may not be secure, and you should therefore take special care in deciding what information you send to us via e-mail. For protected health information, security measures are taken pursuant to the HIPAA Security Rule.

6. Important Notices to Non-U.S. Residents. The App and its servers are operated in the United States. If you are located outside of the United States, please be aware that your Information, including your Personal Information, may be transferred to, processed, maintained, and used on computers, servers, and systems located outside of your state, province, country, or other governmental jurisdiction where the privacy laws may not be as protective as those in your jurisdiction. If you are located outside the United States and choose to use the App, you hereby irrevocably and unconditionally consent to such transfer, processing, and use in the United States and elsewhere.

7. App Stores; External Websites. Your app store may collect certain information in connection with your use of the App, such as Personal Information, Payment Information, Geolocational Information, and other usage-based data. We have no control over the collection of such information by a third-party app store, and any such collection or use will be subject to that third party’s applicable privacy policies. The App may contain links to third-party websites. We have no control over the privacy practices or the content of these websites. As such, we are not responsible for the content or the privacy policies of those third-party websites. You should check the applicable third-party privacy policy and terms of use when visiting any other websites.

You have the right to complain to a Data Protection Authority about our collection and use of your Personal Information. For more information, if you are in the European Economic Area (EEA), please contact your local data protection authority in the EEA.

9. CCPA Privacy. This privacy notice section for California residents supplements the information contained in Our Privacy Policy and it applies solely to all visitors, users, and others who reside in the State of California.

10. Children. The App is not directed to children under the age of 13. We adhere to the Children’s Online Privacy Protection Act (COPPA) and will not knowingly collect Personal Information from any child under the age of 13. We ask that minors (under the age of 13) not use the App. If a child under the age of 13 has provided us with Personal Information, a parent or guardian of that child may contact us and request that such information be deleted from our records.

11. Changes to this Privacy Policy. This Privacy Policy is effective as of the date stated at the top of this Privacy Policy. We may change this Privacy Policy from time to time. Any such changes will be posted on the App. By accessing the App after we make any such changes to this Privacy Policy, you are deemed to have accepted such changes. Please be aware that, to the extent permitted by applicable law, our use of the Information is governed by the Privacy Policy in effect at the time we collect the Information. Please refer back to this Privacy Policy on a regular basis.

12. How to Contact Us. If you have questions about this Privacy Policy, please e-mail us at urxservice@helicase.ai with “Privacy Policy” in the subject line or mail us at the following address: 119, Epperson St, Athens, TN 37303-3478, United States.

URx HIPPA PRIVACY AND SECURITY POLICY

URx (the “Company”) is involved in providing services relating to ePrescribing for covered entities and for business associates of covered entities and is itself considered a “business associate” as defined by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). The Company has adopted this policy to ensure compliance of the company under HIPAA.

Members of the Company’s workforce may have access to “protected health information” (as described below) of users of the URx application (the “App”). The Company intends to fully comply with HIPAA requirements, as administered by the United States Department of Health and Human Services (HHS), including HIPAA’s Privacy Rule and Security Rule and with the terms of any Business Associate Agreement with a Covered Entity. HIPAA restricts the Company’s use and disclosure of protected information related to the use and function of the App.

“Protected health information” (“PHI”) means information that is created or received by the Company through the App and relates to the past, present, or future physical or mental health condition of a user of the App; the provision of health care to a user of the App; or the past, present, or future payment for the provision of health care to a user of the App; and that identifies the user of the App or for which there is a reasonable basis to believe the information can be used to identify the participant. PHI includes information concerning persons living or deceased. The Security Rule governs electronically conveyed PHI, or “E-PHI”. (PHI herein includes E-PHI unless E-PHI is specified.) Special aspects of Security Rule compliance are addressed below.

PHI does NOT include individually identifiable health information which may be contained in employment records, such as sick leave, family leave, disability and other such records obtained from employees directly or from sources other than the App, in connection with those personnel matters. However, PHI from the APP may NOT be used in personnel matters without written consent of the individual.

The Company has adopted this Privacy Policy and the Company’s Separate Security Manual regarding the use and disclosure of individual’s rights related to their PHI. All members of the Company’s workforce who have access to PHI must comply with these policies, procedures, and manuals.

All issues arising from privacy practices or any related issues shall be directed to a Privacy Official or Security Official where appropriate, and any other personnel receiving inquiries regarding such issues shall not attempt to answer or address such inquiries, but shall refer such inquiries to the Privacy or Security Official.

ARTICLE I. Plan Responsibilities as Business Associate of Covered Entity
1. Privacy Official and Contact Person. Blessy Berachah will be the Privacy Official for the Company. The Privacy Official shall be responsible for the administration of policies and procedures relating to privacy, including but not limited to this Privacy Policy.
2. Security Official and Contact Person. The Security Official is designated according to the Security Manual.
3. Persons with Access; Workforce Training. It is the Company’s policy to limit access to PHI to those who have need and to train employees who have access to PHI on its privacy and security policies and procedures. The Privacy Official, Security Official and Contact Person will develop training schedules and programs so that employees who have access to PHI (including E-PHI) receive the training necessary and appropriate to permit them to carry out their functions within Plan. Initially, the Company has determined that the following positions (and their incumbents) will have access to PHI and will receive training: (hereinafter “Persons With Access”): Blessy Berachah, Developer . The Security Official will arrange supplemental training of Persons with Access in elements of Security Rule compliance.
4. Technical and Physical Safeguards and Firewall. The safeguards for PHI can be found in the URx HIPAA Security Risk Analysis and Assessment document.
5. Privacy Notice. Should a Covered Entity require Company to distribute Covered Entity’s Privacy Notice, Company shall do so.
6. Complaints. The appropriate Contact Person is responsible for administering a process for individuals to lodge complaints about privacy and security procedures. A copy of the complaint procedure shall be provided to any user upon request.
7. Sanctions for Violations of Privacy and Security Policy. Sanctions for using or disclosing PHI in violation of this HIPAA Privacy and Security Policy will be imposed in accordance with the Company’s discipline policy.
8. Mitigation of Inadvertent Disclosures of Protected Health Information. The Company shall mitigate, to the extent possible, any harmful effects that become known to it of a use or disclosure of an individual’s PHI in violation of the policies and procedures set forth in this Policy. As a result, if an employee becomes aware of a disclosure of PHI that violates this Policy, either by an employee of the Company or a third-party administrator or insurer, the employee may contact the Privacy Official so that the appropriate steps can be taken to mitigate the harm to the participant.
9. Breach Notification Requirements. The Company shall report any breach to the applicable Covered Entity or other required entity as outlined in its Business Associate Agreement
10. No Intimidating or Retaliatory Acts; No Waiver of HIPAA Privacy and Security. No employee may intimidate, threaten, coerce, discriminate against, or take other retaliatory action against individuals for exercising their rights, filing a complaint, participating in an investigation, or opposing any improper practice under HIPAA. No individual shall be required to waive his or her privacy rights under HIPAA as a condition of treatment, payment, enrollment or eligibility.
11. Documentation and Document Retention. The Company’s privacy policies and procedures must be documented and maintained for at least six years. Policies and procedures must be changed as necessary or appropriate to comply with changes in the law, standards, requirements and implementation specifications (including changes and modifications in regulations). Any changes to policies or procedures must promptly be documented. If a change in law impacts the Notice, the Notice must promptly be revised and made available to the necessary parties. Such change is effective only with respect to PHI created or received after the effective date of the Notice. The Plan and the Company shall document certain events and actions (including authorizations, requests for information, sanctions, complaints) relating to an individual’s privacy rights. The documentation of any policies and procedures, actions, activities and designations may be maintained in either written or electronic form.
ARTICLE II. Policies on Use and Disclosure of PHI.
1. Use and Disclosure Defined; Workforce Compliance. The Company and the Plan will use and disclose PHI only as permitted under HIPAA. The terms “use” and “disclosure” are defined as follows:
  - Use. The sharing, employment, application, utilization, examination, or analysis of individually identifiable health information by any Persons with Access of the Company, or by an affiliated Covered Entity or Business Associate.
  - Disclosure. For information that is PHI, disclosure means any release, transfer, provision of access to, or divulging in any other manner of individually identifiable health information to persons who are not Persons with Access of the Company.
  - Workforce Compliance. Workforce Must Comply with Company’s Policies and Procedures.
2. Access to PHI is Limited to Certain Employees. Only the Persons with Access shall have regular and recurring access to and use of PHI. Persons with Access may use and disclose PHI for App administrative functions, and they may disclose PHI to other Persons with Access for App administrative functions (but the PHI disclosed must be limited to the minimum amount necessary to perform the App administrative function). Persons with Access may not generally disclose PHI to employees (other than other Persons with Access) unless an authorization is in place or the disclosure otherwise is in compliance with this Company’s policies and procedures.
3. Permitted Uses and Disclosures: Payment and Health Care Operations. PHI may be disclosed for the App’s own payment purposes, and PHI may be disclosed to a covered entity or another business associate for the payment purposes of that covered entity or business associate.
  - Payment. Payment includes activities undertaken to obtain Plan contributions or to determine or fulfill the Plan’s responsibility for provision of benefits under the Plan, or to obtain or provide reimbursement for health care. Payment also includes: eligibility and coverage determinations, including coordination of benefits and adjudication or subrogation of health benefit claims; risk adjusting based on enrollee status and demographic characteristics; and billing, claims management, collection activities, obtaining payment under a contract for reinsurance (including stop-loss insurance and excess loss insurance) and related health care data processing.
  - Any other Permitted Use and Disclosure allowed by law.
4. Mandatory Disclosures of PHI to Individual and HHS. A user’s PHI must be disclosed as required by HIPAA in two situations:
  - The disclosure is to the individual who is the subject of the information; and
  - The disclosure is made to HHS for purposes of enforcing HIPAA.
5. Permissive Disclosures of PHI for Legal and Public Policy Purposes. PHI may be disclosed in the following situations without a participant’s authorization, when specific requirements are satisfied, subject to policies developed by and approval of the Company’s Privacy Official. The permissive disclosures are:
  - about victims of abuse, neglect or domestic violence;
  - for judicial and administrative proceedings;
  - for law enforcement purposes;
  - for public health activities;
  - for health oversight activities;
  - about decedents;
  - about crime on Company premises;
  - for cadaveric organ, eye or tissue donation purposes;
  - for certain limited research purposes;
  - to avert a serious threat to health or safety;
  - for specialized government functions; and
  - that relate to workers’ compensation programs.
6. Disclosures of PHI Pursuant to an Authorization. PHI may be disclosed for any purpose if an authorization that satisfies all of HIPAA’s requirements for a valid authorization is provided by the user. All uses and disclosures made pursuant to a signed authorization must be consistent with the terms and conditions of the authorization.
7. Complying with the “Minimum-Necessary” Standard
  HIPAA requires that when PHI is used or disclosed, the amount disclosed generally must be limited to the “minimum necessary” to accomplish the purpose of the use or disclosure, as determined by the Privacy Official case-by-case, or, in the instance of routine and recurring disclosures, as set forth in Company policies or procedures.
  The “Minimum Necessary” Standard does not apply to any of the following:
  - uses or disclosures made to the individual;
  - uses or disclosures made pursuant to a valid authorization;
  - disclosures made to the DOL;
  - uses or disclosures required by law;
  - uses or disclosures required to comply with HIPAA.
8. Minimum Necessary When Disclosing PHI. For routine and recurring disclosures developing prospectively, the Privacy Official (or Contact Person if directed by the Privacy Official) will direct an analysis of such disclosures and further, specific standards will be developed
  All other disclosures must be reviewed on an individual basis with the Privacy Official to ensure that the amount of information disclosed is the minimum necessary to accomplish the purpose of the disclosure.
9. Minimum Necessary When Requesting PHI.
  For making requests for disclosure of PHI for purposes of claims, claims reports, stop loss insurance and other payment and health care operations, the Privacy Official will outline policies and procedures designed to limit the amount requested to the amount reasonably necessary to accomplish the purpose for which the disclosure is requested.
  All other requests must be reviewed on an individual basis with the Privacy Official to ensure that the amount of information requested is the minimum necessary to accomplish the purpose of the disclosure.
10. Disclosures of PHI to Business Associates. Persons with Access may disclose PHI to the Company’s business associates and allow Company’s business associates to create or receive PHI on its behalf. However, prior to doing so, the Plan must first obtain assurances from the business associate (in the form of business associate agreements) that it will appropriately safeguard the information. Before sharing PHI with outside consultants or contractors who meet the definition of a “business associate”, employees must contact the Contact Person and verify that a business associate agreement is in place.
11. Disclosures of De-Identified Information and Limited Data Sets. The Company and App may freely use and disclose de-identified information. De-identified information is health information that does not identify an individual and with respect to which there is no reasonable basis to believe that the information can be used to identify an individual. There are two ways a covered entity can determine that information is de-identified: either by professional statistical analysis, or by removing 18 specific identifiers under HIPAA.
12. Policies Specific to E-PHI/Security Rule. The Company has performed a risk analysis and assessment and developed a document called the HIPAA Security Risk Analysis and Assessment document, including recommended administrative, physical and technical safeguards that reasonably protect the confidentiality, integrity and availability of electronic PHI the Company creates, receives, maintains or transmits.
ARTICLE III. Policies on Individual Rights.
1. Access to Protected Health Information and Requests for Amendment.
  
  HIPAA gives users the right to access and obtain copies of their PHI that the Company/App (or its business associates) maintains in designated record sets. HIPAA also provides that participants may request to have their PHI amended. The Company will provide access to PHI and it will consider requests for amendment that are submitted in writing by participants.
  
  A “Designated Record Set” is a group of records maintained by or for the Company that includes: (a) the enrollment, payment, and claims adjudication record of an individual maintained by or for the Company/App, or (b) any other information used to make decisions about individuals.
2. Accounting. An individual has the right to obtain an accounting of certain disclosures of his or her own PHI. This right to an accounting extends to disclosures made in the last six years, other than disclosures:
  - to carry out treatment, payment or health care operations;
  - to individuals about their own PHI;
  - incident to an otherwise permitted use or disclosure;
  - pursuant to an authorization;
  - for purposes of creation of a facility directory or to persons involved in the patient’s care or other notification purposes;
  - as part of a limited data set; or
  - for national security or law enforcement purposes.
  The Company shall respond to an accounting request within 60 days. If the Company is unable to provide the accounting within 60 days, it may extend the period by 30 days, provided that it gives the participant notice (including the reason for the delay and the date the information will be provided) within the original 60-day period.
  
  The accounting must include the date of the disclosure, the name of the receiving party, a brief description of the information disclosed, and a brief statement of the purpose of the disclosure (or a copy of the written request for disclosure, if any).
  
  The first accounting in any 12-month period shall be provided free of charge. The Contact Person may impose reasonable production and mailing costs for subsequent accountings.
3. Requests for Requested Confidential Communications.
  Participants may request to receive communications regarding their PHI by alternative means or at alternative locations. For example, participants may ask to be called only at work rather than at home. Such requests shall be honored if, in the sole discretion of the Company, the requests are reasonable.
  
  However, the Company shall accommodate such a request if the participant clearly provides information that the disclosure of all or part of that information could endanger the participant. The Contact Person has responsibility for addressing requests for confidential communications.
4. Requests for Restrictions on Uses and Disclosures of PHI. A participant may request restrictions on the use and disclosure of the participant’s PHI. It is the Company’s policy to attempt to honor such requests if, in the sole discretion of the Company, the requests are reasonable. The Contact Person is charged with responsibility for addressing requests for restrictions.
5. Requests for Amendment. No third-party rights are intended to be created by this Policy. The Company reserves the right to amend or change this Policy at any time (and even retroactively) without notice. To the extent this Policy establishes requirements and obligations above and beyond those required by HIPAA, the Policy shall be aspirational and shall not be binding upon the Company. This Policy does not address requirements under other Federal laws or under state laws.

URx MOBILE APPLICATION PRIVACY POLICY

URx HIPPA PRIVACY AND SECURITY POLICY