Privacy Policy

Who this policy covers

This Privacy Policy applies to helixpathmd.com, our online questionnaire, patient portal, emails and text messages, and any other service that links to this policy (together, the "Services"). "We", "us" and "our" mean HelixPath LLC.

When you become a patient, health information created or received for your treatment is also governed by our HIPAA Privacy Policy. If the two policies differ for a piece of health information, the HIPAA Privacy Policy controls.

Information we collect

Depending on how you use the Services, we may collect:

• Identity and contact details — name, date of birth, email, phone number, shipping and billing address.
• Health information — answers to your medical questionnaire, medical history, medications, allergies, photos you choose to upload, lab results, visit notes and prescriptions.
• Account and payment details — login credentials and the last digits and type of your payment card. Full card numbers are processed by our payment processor and are not stored by us.
• Communications — messages with your care team or our support team, and your communication preferences.
• Device and usage information — IP address, browser type, pages viewed, referring pages and similar data collected through cookies and analytics tools.

How we use information

• To confirm eligibility, connect you with a licensed provider and coordinate your care.
• To send prescriptions to a licensed pharmacy and arrange delivery where permitted.
• To process payments, memberships, cancellations and refunds.
• To respond to questions, send appointment and treatment reminders and provide customer support.
• To operate, secure and improve the Services, including preventing fraud and misuse.
• To send marketing messages when you have agreed to receive them. Health information is never used for marketing without your written authorization.
• To meet legal, regulatory, licensing and recordkeeping obligations.

How we share information

We share information only as needed to provide the Services or as the law requires:

• With your treating providers at Arora Health & Aesthetics, LLC.
• With our partner pharmacy (The Pharmacy Hub) and shipping carriers to fill and deliver prescriptions.
• With laboratories, when your provider orders testing.
• With service providers that host our systems, process payments, send messages or support our operations. Vendors that handle PHI sign business associate agreements.
• With government agencies, courts or law enforcement when required by law.
• With a successor organization in a merger, acquisition or sale of assets, subject to this policy.

We do not sell or rent personal information, and we do not share health information with advertisers, data brokers or employers.

Cookies and analytics

We use essential cookies to keep the Services working and optional analytics cookies to understand how the site is used. Analytics tools are configured so that health information you enter in the questionnaire or portal is not sent to them.

You can block or delete cookies in your browser settings. Blocking essential cookies may stop parts of the Services from working.

Email and text messages

If you give us your phone number, we may text you about your account, visits, prescriptions and shipments. Message frequency varies and message and data rates may apply. Reply STOP to stop texts or HELP for help. Consent to marketing texts is never a condition of receiving care.

Every marketing email includes an unsubscribe link. Transactional and care-related messages continue while you have an active account.

Your choices and rights

Subject to applicable law, you may:

• Request a copy of the personal information we hold about you.
• Ask us to correct information that is inaccurate or incomplete.
• Ask us to delete information we are not legally required to keep. Medical records must be kept for the period set by state law.
• Withdraw consent to marketing at any time.
• Appeal a decision we make about your request.

To make a request, email privacy@helixpathmd.com or call (800) 555-0147. We will verify your identity before acting and respond within the time the law requires. Rights over your medical record are described in our HIPAA Privacy Policy.

Consumer health data (Washington, Nevada and similar laws)

Some states give residents additional rights over consumer health data that is not covered by HIPAA. We collect such data only to provide the Services you request, we do not sell it, and you may request access to or deletion of it using the contact details below.

How we protect information

We use administrative, technical and physical safeguards, including encryption in transit (SSL/TLS) and at rest, role-based access and access logging. No system is completely secure, so please keep your login details private and tell us right away if you believe your account has been compromised.

How long we keep information

Medical records are kept for the period required by the laws of the state where you received care. Other information is kept only as long as needed for the purposes described here, then deleted or de-identified.

Children

The Services are for adults 18 and older. We do not knowingly collect information from children. If you believe a child has given us information, contact us and we will delete it.

Changes to this policy

We may update this policy from time to time. The effective date at the top shows when it last changed. If a change is material, we will tell you by email or through the Services before it takes effect.

Contact us

HelixPath LLC

30 N Gould Street, Suite R, Sheridan, WY 82801, United States

Phone: (800) 555-0147 (Monday–Friday, 9 a.m.–6 p.m. Mountain Time)

Privacy questions: privacy@helixpathmd.com