Last updated: January
2026
Health Care And Support ("Health Care And Support," "we," "us," or "our") is
committed to protecting your personal and health
information. This Privacy Policy explains how we
collect, use, disclose, and safeguard your data when you
use our platform, website, and mobile applications. By
using our Services, you consent to these practices.
1.
Personal Information We Collect
We collect
personal details you provide directly: full name, email
address, phone number, mailing address, date of birth,
gender, Social Security Number (when required for
insurance), and emergency contact information during
account creation, appointment booking, and insurance
enrollment processes.
2.
Protected Health Information
We collect PHI
including medical history, symptoms, diagnoses,
prescriptions, lab results, imaging reports, treatment
plans, allergy information, and clinical notes shared
during consultations. All PHI is handled in strict
compliance with HIPAA Privacy and Security Rules.
3.
Financial and Payment Data
We collect payment
card details, bank account information, insurance policy
and group numbers, and billing addresses. Card data is
processed through PCI DSS Level 1 compliant processors
and never stored on our servers.
4.
Automatically Collected Technical Data
We
automatically gather IP address, browser type and
version, operating system, device identifiers, pages
visited, time on page, click patterns, referring URLs,
screen resolution, and interaction data with telehealth
tools, chat features, and booking forms.
5. Cookies
and Tracking Technologies
Essential cookies for
authentication and sessions, functional cookies for
preferences, analytics cookies for usage analysis. We do
not sell cookie data. Manage preferences through browser
settings or our consent tool.
6. How We
Use Your Information
Deliver healthcare services;
schedule appointments; facilitate telehealth; process
payments and insurance claims; send appointment
reminders, test results, follow-ups; personalize
recommendations; improve platform functionality; comply
with legal obligations; detect fraud and security
threats.
7.
Appointment and Scheduling Communications
We send
confirmations, reminders via email and SMS, pre-visit
instructions, post-visit summaries, prescription
notifications, and follow-up care recommendations. These
are essential transactional communications that cannot
be opted out.
8.
Insurance Processing Data Sharing
We share
necessary information with carriers, clearinghouses, and
billing partners to verify eligibility, submit claims,
obtain pre-authorizations, and process reimbursements
under HIPAA's Treatment, Payment, and Healthcare
Operations provisions.
9.
Promotional Communications
With explicit consent,
we send promotional emails about new services, wellness
programs, health campaigns, partnerships, and offers.
Opt out anytime via unsubscribe link, Unsubscribe page,
or account preferences without affecting transactional
emails.
10.
Third-Party Service Provider Sharing
We share
data with providers performing functions on our behalf:
cloud hosting (HIPAA-eligible AWS), payment processing
(Stripe, PCI DSS Level 1), telehealth infrastructure
(Zoom Healthcare), analytics (anonymized), and email
delivery (SendGrid). All bound by data processing
agreements.
11.
Healthcare Provider Network Access
PHI is shared
with licensed providers involved in your care, each
bound by HIPAA, confidentiality obligations, and
Business Associate Agreements. Providers access only the
minimum necessary information for treatment.
12. Legal
and Regulatory Disclosures
We may disclose
information for: court orders, subpoenas, government
requests; suspected child abuse reporting; public health
reporting; health oversight audits; law enforcement
involving imminent harm; and workers' compensation
proceedings.
13.
Business Transfers and Mergers
In a merger,
acquisition, reorganization, bankruptcy, or asset sale,
your information may transfer. We will notify you via
email before your data becomes subject to a different
privacy policy.
14. Data
Encryption at Rest
All data at rest encrypted
using AES-256 (FIPS 197). Database access requires
encrypted connections. Backup data encrypted with
separate key management. Keys rotated per security best
practices.
15. Data
Encryption in Transit
All data in transit uses
TLS 1.3 with perfect forward secrecy. API endpoints
enforce HTTPS exclusively. Certificate pinning
implemented for mobile applications to prevent
man-in-the-middle attacks.
16.
Infrastructure Security Controls
HIPAA-eligible
cloud environment with dedicated VPCs, encrypted
storage, IAM policies, security groups, WAF protection,
IDS, automated vulnerability scanning. SOC 2 Type II
certified infrastructure.
17. Access
Control and Authentication
PHI access requires
multi-factor authentication, 12+ character passwords,
15-minute session timeout, IP allowlisting for admin
access, role-based access controls. All access logged in
immutable audit trail.
18.
Employee and Personnel Security
All employees
undergo background checks, sign confidentiality
agreements, complete HIPAA training upon hire and
annually, access data per role only. Vendor personnel
subject to equivalent requirements through BAAs.
19.
Penetration Testing and Audits
Annual penetration
testing by independent firms, quarterly vulnerability
assessments, continuous monitoring, semi-annually tested
incident response plan, and annual SOC 2 Type II audit
by independent auditors.
20. Data
Retention Periods
Active accounts: retained while
active. Health records: per state law (typically 7–10
years). Payment records: 7 years. Marketing data: until
unsubscribe/deletion. Inactive accounts: anonymized
after 3 years.
21. Your
Right to Access Data
Request a copy of all
personal and health information. Processed within 30
days per HIPAA. Provided in readable electronic format
via patient portal or written request to Privacy
Officer.
22. Your
Right to Correction
Request correction of
inaccurate information. Health record corrections
coordinated with treating provider. Submit via portal or
privacy@healthcareandsupport.com.
23. Your
Right to Deletion
Request deletion subject to
legal retention requirements. HIPAA records cannot be
deleted during mandatory period but restricted from
further use. Non-essential data erased within 45
days.
24. Your
Right to Data Portability
Request data in
structured, machine-readable format (JSON/CSV). Health
records exportable as Continuity of Care Document (CCD)
compatible with any EHR system.
25. Your
Right to Restrict Processing
Request restriction
of PHI disclosures for payment/operations when paid
out-of-pocket in full. We accommodate reasonable
requests per HIPAA.
26. Your
Right to Opt Out of Marketing
Opt out of
promotional emails, SMS, and push notifications anytime
without affecting healthcare access or transactional
communications. Processing within 10 business days.
27. HIPAA
Notice of Privacy Practices
Separate HIPAA NPP
detailing rights, PHI use/disclosure, and legal duties.
Available in patient portal and provided at first
service.
28.
State-Specific Privacy Rights
California:
CCPA/CPRA rights. Virginia, Colorado, Connecticut, and
other states: analogous rights under applicable
statutes. All rights honored regardless of state.
29.
Children's Privacy
Not directed to children under
13. No knowingly collected data from under-13. If
discovered, deleted immediately. Minors 13–17 require
parental/guardian consent.
30. Breach
Notification Procedures
PHI breach: notify
individuals without unreasonable delay, within 60 days
per HIPAA. Notifications include description, data
types, protective steps, mitigation measures via email
or first-class mail.
31. Policy
Update Procedures
Periodic updates. Material
changes communicated via email 30 days before taking
effect. "Last updated" date revised. Continued use
constitutes acceptance.
32.
Privacy Officer Contact Information
Health Care And Support
., Privacy Officer, 1112 Davisson Street
Indianapolis, IN 46225. Email: privacy@healthcareandsupport.com. Phone: +1
765-919-2397, Option 4. Response within 30 days.
