Elyvate, Inc. ("Elyvate") is required by law to maintain the privacy of your Protected Health Information (PHI) and to provide you with this Notice of Privacy Practices. We are required to follow the terms of this Notice as currently in effect.
1. How We Use and Disclose Your PHI
We may use and disclose your PHI for the following purposes without requiring your additional authorization:
Treatment
We may use and disclose your PHI to facilitate your medical treatment. This includes transmitting your health intake information to independent physicians affiliated with our clinical partner, OpenLoop Health, so that they may evaluate your eligibility and issue a prescription. We may also share necessary information with our compounding pharmacy partner via CareValidate to fulfill your prescription.
Payment
We may use and disclose your PHI to obtain payment for services rendered. This includes processing subscription payments through Stripe and maintaining billing records associated with your account.
Healthcare Operations
We may use and disclose your PHI for our internal healthcare operations, including quality assurance, compliance audits, training, legal and regulatory compliance, and improving the efficiency and quality of care provided through our platform.
As Required by Law
We will disclose your PHI when required to do so by federal or state law, including in response to valid court orders, subpoenas, or government investigations.
2. Minimum Necessary Standard
When using or disclosing your PHI, we make reasonable efforts to limit PHI to the minimum amount necessary to accomplish the intended purpose. This standard does not apply to disclosures to or requests by a healthcare provider for treatment purposes, disclosures to you, or disclosures made pursuant to your written authorization.
3. Our Business Associates
We share certain PHI with business associates who perform services on our behalf. We require all business associates to appropriately safeguard your PHI through written Business Associate Agreements (BAAs).
OpenLoop Health
Clinical partner. Independent physicians review patient intakes and issue prescriptions. OpenLoop operates as a covered entity under a BAA with Elyvate.
CareValidate
Health verification and pharmacy coordination. PHI is transmitted to facilitate prescription fulfillment with our compounding pharmacy network.
Amazon Web Services (AWS)
Cloud infrastructure. Our database, application servers, and encrypted PHI are hosted on AWS in U.S. regions, under a BAA with Elyvate.
4. Uses and Disclosures Requiring Your Authorization
Other uses and disclosures of your PHI not described in this Notice will be made only with your written authorization. You may revoke any such authorization in writing at any time, except where we have already taken action in reliance on the authorization. The following categories always require your specific authorization:
- Marketing communications
- Sale of your PHI
- Psychotherapy notes (if applicable)
5. Your Rights Regarding Your PHI
Right to access your PHI
You may inspect and receive a copy of your PHI held by Elyvate. We will respond to requests within 30 days. A reasonable fee may apply for copies.
Right to amend your PHI
You may request that we amend PHI you believe is inaccurate or incomplete. We may deny the request if the information was not created by us.
Right to an accounting of disclosures
You may request a list of the disclosures we have made of your PHI for purposes other than treatment, payment, or operations in the prior six years.
Right to request restrictions
You may request that we restrict how we use or disclose your PHI. We are not required to agree to all requests, but will consider them in good faith.
Right to confidential communications
You may request that we communicate with you by alternative means or at alternative locations.
Right to a paper copy of this Notice
You may request a paper copy of this Notice at any time, even if you have agreed to receive it electronically.
6. Our Duties
- We are required by law to maintain the privacy of your PHI and to provide you with this Notice of our legal duties and privacy practices.
- We are required to abide by the terms of this Notice currently in effect.
- We reserve the right to change the terms of this Notice. Revised Notices will be available on our website and, upon request, by mail.
- We will notify you in the event of a breach of your unsecured PHI as required by applicable law.
7. How to File a Complaint
If you believe your privacy rights have been violated, you may file a complaint with Elyvate directly or with the U.S. Department of Health and Human Services (HHS) Office for Civil Rights. You will not be penalized for filing a complaint.
File with Elyvate
privacy@elyvate.healthHHS Office for Civil Rights
200 Independence Ave SW
Washington, DC 20201
hhs.gov/ocr
8. Contact
To exercise your rights or for questions about this Notice:
Elyvate, Inc. — Privacy Officer
privacy@elyvate.health