HIPAA Notice of Privacy Practices

1. Our Commitment to Your Privacy

VirtualVisitRX ("we," "us," or "our") is a licensed telehealth medical clinic providing virtual healthcare services to patients across the United States. We are required by law to maintain the privacy of your Protected Health Information ("PHI"), to provide you with this notice of our legal duties and privacy practices, and to abide by the terms of the notice currently in effect.

PHI is information about you — including demographic data — that relates to your past, present, or future physical or mental health condition, the provision of healthcare to you, or payment for that healthcare, and that can be used to identify you. We are committed to protecting your PHI in compliance with the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and applicable Florida state law.

2. How We May Use and Disclose Your Health Information

The following categories describe the ways we may use and disclose your PHI without requiring your separate written authorization:

3. Uses and Disclosures Requiring Your Written Authorization

For uses and disclosures not described in this notice, we will ask for your written authorization before using or sharing your PHI. You may revoke your authorization at any time in writing, except where we have already acted in reliance on it. Uses and disclosures that require your authorization include:

• Marketing communications that involve remuneration to us
• Sale of your PHI to third parties
• Most uses and disclosures of psychotherapy notes
• Disclosures to employers for employment-related decisions based on your health
• Any other use or disclosure not permitted by HIPAA without authorization

We do not sell your PHI or personal health information to any third party for marketing or commercial purposes.

4. Your Rights Regarding Your Health Information

You have the following rights regarding your PHI. To exercise any of these rights, please contact us in writing at [email protected].

5. Our Duties and Safeguards

We are required by law to:

• Maintain the privacy and security of your PHI
• Provide you with this notice of our privacy practices
• Follow the terms of the notice currently in effect
• Notify you if a breach occurs that may have compromised the privacy or security of your PHI
• Not use or share your PHI other than as described in this notice unless you authorize it in writing

We implement the following safeguards to protect your PHI:

• Encrypted data transmission (TLS/SSL) for all communications
• Secure storage of health records and clinical intake information
• Access controls limiting PHI access to authorized clinical and administrative personnel only
• Secure fax transmission for clinical communications to pharmacies and labs
• Regular security assessments and workforce training on HIPAA compliance
• Google Analytics 4 with IP anonymization — analytics tracking is activated only after patient cookie consent and does not receive PHI or clinical data

6. Telehealth-Specific Disclosures

As a telehealth provider, we want you to understand the following specific to virtual care:

• Electronic Transmission: Your health information is transmitted electronically during telehealth consultations. We use industry-standard encryption to protect these transmissions.
• Pharmacy Transmissions: Prescriptions are transmitted electronically or via secure fax to your designated pharmacy. Only the information necessary to fill your prescription is shared.
• Clinical Intake Forms: Information you submit through our online intake forms is transmitted securely and stored in our clinical records system. This information is used solely for your care.
• Compounded Medications: For patients receiving compounded medications (including GLP-1 therapies), relevant clinical information may be shared with licensed compounding pharmacies to fulfill your prescription.
• State Telehealth Laws: We comply with Florida telehealth regulations (Florida Statute § 456.47) and applicable laws in the states where our providers are licensed to practice.

7. Medical Records Retention

We retain your medical records and PHI in accordance with Florida state law and applicable federal regulations. Florida law generally requires medical records to be retained for a minimum of five (5) years from the date of service, or longer if required by other applicable law. Payment records are retained as required by applicable tax and financial regulations.

8. Changes to This Notice

We reserve the right to change this notice at any time. We reserve the right to make the revised or changed notice effective for PHI we already have about you as well as any information we receive in the future. We will post the current notice on our website with the effective date. You are entitled to a copy of the notice currently in effect.