HIPAA Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

The Pep Club Medical Practice (the “Medical Practice”) is a covered entity under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). The Pep Club Inc., as the management-services organization that operates the patient platform, is a business associate of the Medical Practice and is bound by a written Business Associate Agreement that mirrors the privacy and security duties imposed on the Medical Practice. This Notice applies jointly to the Medical Practice and to The Pep Club Inc. for the information that flows between them.

The complete consumer-privacy framework that incorporates this Notice and adds state-specific addenda (California CCPA, Washington MHMDA, Texas TDPSA, Nevada SB220) is published at the Privacy Policy.

We are required by law to:

• Maintain the privacy and security of Protected Health Information (“PHI”) about you;
• Give you this Notice of our legal duties and privacy practices with respect to PHI;
• Notify you, without unreasonable delay and no later than sixty (60) calendar days after discovery, in the event of a breach of unsecured PHI that involves you; and
• Follow the terms of the Notice currently in effect.

We reserve the right to change the terms of this Notice and to make the new terms effective for all PHI that we maintain, including PHI created or received before the change. When we make a material change, we will post the revised Notice at this URL and update the Last reviewed date.

We may use and disclose your PHI without a separate written authorization for the following purposes:

• Treatment: to provide, coordinate, or manage your healthcare, including disclosure to physicians of the Medical Practice, the affiliated compounding pharmacy that dispenses your prescriptions, and the reference laboratory that processes your biomarker samples.
• Payment: to bill for and collect payment for the services we provide, including disclosure to your payment method, our payment processor, and, where you instruct, your insurer.
• Healthcare operations: to run the Medical Practice and the patient platform, including quality improvement, training, audit, accreditation, and managing customer service.
• Public health activities: to public-health authorities authorized by law to collect information for preventing or controlling disease, injury, or disability; reporting medication-related adverse events to public-health authorities authorized by law to receive such reports; and reporting child abuse or neglect to authorized agencies.
• Victims of abuse, neglect, or domestic violence: to a governmental authority authorized by law to receive such reports, where we reasonably believe abuse has occurred.
• Health-oversight activities: to agencies overseeing the healthcare system, government benefits, or regulatory programs (for example, state pharmacy boards, state medical boards, the HHS Office for Civil Rights).
• Judicial and administrative proceedings: in response to a valid subpoena, court order, or other lawful process.
• Law enforcement: in limited circumstances permitted by HIPAA, including court orders, certain identification requests, and reports of crime victims.
• Decedents: to coroners, medical examiners, and funeral directors as necessary.
• Research: if approved by an Institutional Review Board (IRB) with appropriate privacy protections in place.
• Health or safety threats: to prevent a serious and imminent threat to the health or safety of you or another person.
• Specialized government functions: for military and veterans' activities, national security, protective services for the President, or correctional institutions as permitted by law.
• Workers' compensation: as required by applicable state workers' compensation laws.
• As required by law: any other use or disclosure required by federal, state, or local law.

For uses and disclosures of PHI not described above, we will obtain your written authorization. The following always require your written authorization, except in the narrow exceptions HIPAA itself recognizes:

• Marketing communications that constitute “marketing” under HIPAA;
• Any sale of PHI;
• Any use or disclosure of psychotherapy notes; and
• Outreach from the affiliated pharmacy to its existing patients about The Pep Club services, which requires the patient's separate written authorization under 45 CFR 164.508(a)(3).

You may revoke any written authorization at any time by writing to privacy@thepepclub.com or by using the in-portal data-request workflow. Revocation is effective from the time we receive it and does not affect uses or disclosures we already made in reliance on the authorization.

If you believe your privacy rights have been violated, you may file a complaint with us by writing to the Privacy Officer at privacy@thepepclub.com. Include your name, your account email, and a description of the concern. We will investigate and respond.

You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, at 200 Independence Avenue SW, Washington, DC 20201, by phone at 1-877-696-6775, or online at www.hhs.gov/ocr/privacy/hipaa/complaints. We will not retaliate against you for filing a complaint.

The Pep Club Privacy Officer is responsible for the privacy and security of PHI handled by the Medical Practice and The Pep Club Inc.. Direct privacy questions, data-subject requests, and HIPAA-rights requests to the Privacy Officer at privacy@thepepclub.com.

Written privacy requests may also be directed to the Privacy Officer using the contact options on the Contact page.