Notice of Privacy Practices

Effective Date: March 6, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

CrownGenix is required by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) to maintain the privacy of your Protected Health Information (PHI), to provide you with this Notice of Privacy Practices, and to follow the terms of the Notice currently in effect. This Notice applies to all health information created or maintained through our telehealth platform.

1. How We May Use and Disclose Your Health Information

We may use and disclose your Protected Health Information (PHI) for the following purposes without your written authorization:

For Treatment

We may use and disclose your PHI to provide, coordinate, or manage your healthcare and related services. This includes sharing information with licensed physicians, pharmacists, and other healthcare providers involved in your care through our platform. For example:

  • Sharing your health questionnaire and medical history with the prescribing physician
  • Transmitting your prescription to a licensed pharmacy for fulfillment
  • Facilitating communication between you and your healthcare provider through our secure messaging system

For Payment

We may use and disclose your PHI to obtain payment for the services we provide. This includes:

  • Processing payment transactions for your orders
  • Providing billing information to payment processors
  • Conducting billing and collections activities

For Healthcare Operations

We may use and disclose your PHI for our healthcare operations, which include:

  • Quality assessment and improvement activities
  • Reviewing the competence and qualifications of healthcare providers
  • Conducting compliance programs and audits
  • Business planning and general administrative activities

2. Other Permitted Uses and Disclosures

We may also use or disclose your PHI without your authorization in the following circumstances:

  • As Required by Law: When required by federal, state, or local law.
  • Public Health Activities: For public health purposes, such as reporting adverse drug reactions to the FDA.
  • Health Oversight: To health oversight agencies for activities authorized by law, such as audits and investigations.
  • Judicial and Administrative Proceedings: In response to a court order, subpoena, or other lawful process.
  • Law Enforcement: Under certain limited circumstances to law enforcement officials.
  • To Avert Serious Threat: To prevent a serious threat to the health or safety of a person or the public.
  • Workers' Compensation: As authorized by and necessary to comply with workers' compensation laws.
  • Coroners and Funeral Directors: To coroners, medical examiners, and funeral directors as necessary to carry out their duties.

3. Uses and Disclosures Requiring Your Written Authorization

We will obtain your written authorization before using or disclosing your PHI for purposes other than those described above, including:

  • Marketing purposes (other than face-to-face communications and promotional gifts of nominal value)
  • Sale of your PHI
  • Most uses of psychotherapy notes (if applicable)
  • Any other uses and disclosures not described in this Notice

You may revoke your authorization in writing at any time, except to the extent that we have already taken action in reliance on your authorization.

4. Your Rights Regarding Your Health Information

Right to Access

You have the right to inspect and obtain a copy of your PHI maintained by us. To request access, submit a written request to our Privacy Officer. We may charge a reasonable fee for copying and mailing costs. We will respond to your request within 30 days.

Right to Amend

You have the right to request an amendment to your PHI if you believe it is incorrect or incomplete. To request an amendment, submit a written request to our Privacy Officer explaining the reason for the amendment. We may deny your request under certain circumstances and will provide you with a written explanation if we do.

Right to Restrict

You have the right to request that we restrict how we use or disclose your PHI for treatment, payment, or healthcare operations. You may also request restrictions on disclosures to persons involved in your care. We are not required to agree to your request, except that we must agree to restrict disclosures to a health plan if the disclosure is for payment or healthcare operations and the PHI pertains solely to a service for which you have paid out of pocket in full.

Right to Confidential Communications

You have the right to request that we communicate with you about your health information in a certain way or at a certain location. For example, you may request that we contact you only at a specific email address or phone number. We will accommodate reasonable requests.

Right to an Accounting of Disclosures

You have the right to request a list of certain disclosures of your PHI that we have made. This accounting will not include disclosures made for treatment, payment, healthcare operations, or disclosures you authorized in writing. To request an accounting, submit a written request to our Privacy Officer.

Right to a Copy of This Notice

You have the right to obtain a paper copy of this Notice at any time, even if you previously agreed to receive it electronically. You may request a copy by contacting our Privacy Officer.

5. Breach Notification

In the event of a breach of your unsecured Protected Health Information, we will notify you as required by law. Notification will be made without unreasonable delay and no later than 60 days after discovery of the breach. The notification will include:

  • A description of the breach, including the date of the breach and the date of discovery
  • The types of information involved in the breach
  • Steps you should take to protect yourself from potential harm
  • A description of what we are doing to investigate the breach, mitigate losses, and prevent future breaches
  • Contact information for you to ask questions or receive additional information

6. Complaints

If you believe your privacy rights have been violated, you have the right to file a complaint:

File a Complaint with Us

You may file a complaint directly with our Privacy Officer:

  • Privacy Officer
  • CrownGenix
  • [Your Address]
  • Email: [Your Email]
  • Phone: [Your Phone Number]

File a Complaint with the U.S. Department of Health and Human Services

You may also file a complaint with the Secretary of the U.S. Department of Health and Human Services, Office for Civil Rights:

  • U.S. Department of Health and Human Services
  • Office for Civil Rights
  • 200 Independence Avenue, S.W.
  • Washington, D.C. 20201
  • Phone: 1-877-696-6775
  • Website: www.hhs.gov/ocr

You will not be retaliated against for filing a complaint.

7. Changes to This Notice

We reserve the right to change the terms of this Notice at any time. Any changes will apply to all PHI we already maintain as well as any PHI we create or receive in the future. The revised Notice will be posted on our website and will be available upon request. The effective date of the current Notice will be listed at the top of this page.

8. Contact Information

For questions about this Notice or to exercise your rights, please contact:

  • Privacy Officer
  • CrownGenix
  • [Your Address]
  • Email: [Your Email]
  • Phone: [Your Phone Number]
© 2026 CrownGenix. All rights reserved. This Notice of Privacy Practices is provided in compliance with HIPAA requirements and does not constitute legal advice.