Privacy Policy & Notice of Privacy Practices

1. Our Commitment to Your Privacy

IndoQubix Health Solutions ("we", "us", "our") is committed to protecting the privacy and security of your Protected Health Information (PHI). This comprehensive policy describes our practices concerning the collection, use, and disclosure of your health information in compliance with the Health Insurance Portability and Accountability Act (HIPAA), the Health Information Technology for Economic and Clinical Health (HITECH) Act, state privacy laws, and other applicable regulations.

1.1 Legal Framework

Our privacy practices are governed by the Health Insurance Portability and Accountability Act (HIPAA) of 1996, the HITECH Act of 2009, the 21st Century Cures Act, state-specific healthcare privacy laws, Federal Trade Commission (FTC) regulations, and the General Data Protection Regulation (GDPR) for EU residents.

2. Information We Collect

2.1 Protected Health Information (PHI)

We collect and maintain various types of health information necessary for providing comprehensive healthcare services through our platform.

Healthcare Provider Information

We collect healthcare provider information including provider communications and notes, referrals and consultation reports, care team assignments and roles, progress notes and care summaries, and discharge summaries and care transitions to ensure comprehensive and coordinated healthcare delivery.

Financial and Insurance Information

We maintain financial and insurance information including insurance policy numbers and coverage details, billing and payment information, claims processing data, co-payment and deductible information, and financial assistance and payment plans to facilitate healthcare billing and payment processing.

2.2 Technical and Usage Information

2.3 Communication Data

We collect communication data including messages between patients and providers, appointment scheduling communications, customer support interactions, survey responses and feedback, marketing communication preferences, and consent forms and authorizations to facilitate effective healthcare communication and service delivery.

3. How We Use Your Information

We use your Protected Health Information for the following primary purposes as permitted by HIPAA:

3.1 Treatment

We use your Protected Health Information primarily to provide, coordinate, and manage your healthcare and related services in a comprehensive and integrated manner. This includes coordinating care between multiple healthcare providers and specialists to ensure seamless treatment delivery, managing comprehensive care plans and treatment protocols tailored to your specific needs, and facilitating secure communication within your entire care team. We provide clinical decision support and evidence-based recommendations to enhance the quality of your care, continuously monitor treatment outcomes and adjust care plans accordingly based on your progress and response to treatment.

Our platform also manages critical safety features such as medication interactions and allergy alerts to prevent adverse events, schedules and coordinates appointments and procedures to streamline your healthcare experience, and provides telehealth and remote monitoring services for convenient access to care. We coordinate care transitions and hospital discharges to ensure continuity of care, and manage chronic disease programs and population health initiatives to support long-term wellness and disease management.

3.2 Payment

We use your information for various billing and payment-related activities essential for healthcare service delivery. This includes processing insurance claims and prior authorizations to ensure coverage for your care, verifying insurance coverage and benefits to help you understand your financial responsibility, and calculating co-payments, deductibles, and out-of-pocket expenses accurately. We collect payment for healthcare services rendered and process refunds and adjustments when necessary to maintain accurate financial records.

Additionally, we manage payment plans and financial assistance programs to make healthcare more accessible, conduct medical necessity reviews to ensure appropriate care delivery, and support appeals and grievance processes when coverage disputes arise. We also handle reporting to insurance companies and government payers as required by regulatory and contractual obligations, ensuring compliance with all applicable healthcare billing regulations.

3.3 Healthcare Operations

We use your information for administrative and operational purposes:

3.4 Required by Law

We may use and disclose your PHI when required by federal, state, or local law including court orders, subpoenas, and legal proceedings, law enforcement investigations and activities, public health reporting requirements, communicable disease reporting, child abuse and neglect reporting, elder abuse reporting, FDA adverse event reporting, workers' compensation claims, and coroner and medical examiner requirements.

4. Information Sharing and Disclosure

We may share your PHI in the following circumstances, always with appropriate safeguards:

4.1 With Your Written Authorization

We will always seek your written permission before sharing PHI for purposes not covered by this notice including sharing with family members or caregivers you specifically designate, participation in research studies (with your explicit consent), marketing communications about health-related products or services, sale of PHI (only with your authorization and as permitted by law), use of PHI for fundraising purposes beyond what is permitted, sharing with employers (except as required for workers' compensation), and disclosures for purposes not outlined in this notice.

4.2 Without Your Authorization (as permitted by law)

4.3 Business Associates and Third-Party Providers

We may share your information with third-party service providers who assist us in delivering healthcare services:

Important: All business associates are required to sign Business Associate Agreements (BAAs) ensuring they protect your PHI in accordance with HIPAA requirements and implement appropriate safeguards.

4.4 Healthcare Information Exchange

We may participate in health information exchanges to improve care coordination:

• Regional Health Information Organizations (RHIOs)
• Statewide health information networks
• National networks for care coordination
• Interoperability initiatives and data sharing programs
• Quality reporting and public health networks

5. Your Rights Regarding Your PHI

Under HIPAA and applicable state laws, you have comprehensive rights regarding your health information:

5.7 Right to Notification of Breaches

You have the right to be notified if a breach of your PHI occurs, including:

• Description of what happened and when it was discovered
• Types of information involved in the breach
• Steps we are taking to investigate and address the breach
• Measures you can take to protect yourself
• Contact information for follow-up questions

6. Security Safeguards and Data Protection

We implement comprehensive security measures to protect your health information using the "Defense in Depth" approach:

7. Data Retention and Disposal

We retain your Protected Health Information in accordance with federal and state laws:

7.1 Retention Periods

7.2 Secure Disposal

When PHI is no longer needed, we ensure secure disposal through:

• Cryptographic erasure of encrypted data
• DOD 5220.22-M standard data wiping for magnetic media
• Physical destruction of hard drives and storage devices
• Shredding of paper documents containing PHI
• Certificate of destruction from approved vendors
• Documentation of all disposal activities

8. Breach Notification and Incident Response

We have comprehensive procedures in place to address potential security incidents and breaches:

8.1 Incident Detection and Response

8.2 Notification Requirements

Individual Notification

• Written notification within 60 days of breach discovery
• Description of what happened and when it occurred
• Types of information involved in the breach
• Steps individuals can take to protect themselves
• Contact information for questions and assistance
• What we are doing to investigate and prevent future breaches

Regulatory Reporting

• HHS Office for Civil Rights: Within 60 days of discovery
• State attorneys general: As required by state law
• Media notification: If breach affects 500+ individuals in a jurisdiction
• FBI and other law enforcement: If criminal activity is involved

8.3 Post-Breach Support

Following a breach, we provide:

• Dedicated call center for affected individuals
• Credit monitoring services when appropriate
• Identity theft protection resources
• Regular updates on investigation progress
• Additional security measures and monitoring

9. International Data Transfers and Global Privacy

9.1 Cross-Border Data Transfers

When we transfer your PHI internationally, we ensure adequate protections through:

• Appropriate safeguards and contractual obligations with international partners
• Compliance with applicable international privacy laws (GDPR, etc.)
• Data processing agreements with international service providers
• Regular monitoring of international data handling practices
• Implementation of standard contractual clauses where applicable

9.2 Rights for International Users

If you are located outside the United States, you may have additional rights under local privacy laws:

10. Cookies and Tracking Technologies

10.1 Types of Cookies We Use

10.2 Managing Your Cookie Preferences

You can control cookies through:

• Browser settings to accept, reject, or delete cookies
• Our cookie preference center within the platform
• Opt-out tools for specific analytics services
• Third-party privacy tools and browser extensions

11. Contact Information and Support

For questions about this privacy policy or to exercise your rights, please contact:

12. Changes to This Policy

We may update this privacy policy periodically to reflect:

We may update this privacy policy to reflect changes in applicable laws and regulations, updates to our services and technology, improvements to our security and privacy practices, feedback from patients, providers, and regulatory authorities, and industry best practices and standards.

12.1 Notification of Changes

Material changes will be posted prominently on our platform with email notification to active users 30 days before the effective date. Updated privacy notices will be available at registration, and previous versions will be available upon request for historical reference. A summary of changes will be provided with each update to help you understand what has been modified.

12.2 Effective Date

Changes to this policy become effective on the date specified in the updated notice. We reserve the right to make changes to this notice that will be effective for PHI we already have as well as PHI we create or receive in the future.

13. Acknowledgment and Consent

By using our healthcare platform, you acknowledge that you have read and understand this comprehensive Notice of Privacy Practices, been informed of your rights regarding your Protected Health Information, understand how we may use and disclose your PHI, had the opportunity to ask questions about our privacy practices, and agree to our privacy policies and procedures as outlined in this notice.

Important: You may revoke your consent at any time by contacting our Privacy Officer, except to the extent that we have already taken action based on your consent.