Notice of Privacy Practices

Your Information. Your Rights. Our Responsibilities.

This document outlines how Rover Medical manages your medical information, including how it may be used and disclosed and how you can access it.

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Rover Medical Group P.A. and its employed and contracted clinicians (collectively, "Rover Medical", "we", "us", "our") are dedicated to maintaining the privacy of your personal health information, as required by applicable federal and state laws. These laws require us to provide you with this Notice of Privacy Practices and to inform you of your rights and our obligations concerning Protected Health Information, or "PHI," which is information that identifies you and that relates to your physical or mental health condition, the provision of health care to you, or payment for that care. We are required to follow the privacy practices described below while this Notice is in effect.

Rover Medical delivers care via telehealth and works with Rovi Health, Inc. ("Rovi Health"), which provides the technology platform and management and administrative services that support your care. Rovi Health's separate data practices are described in the Rovi Health Privacy Policy. This Notice applies to PHI created or received by Rover Medical in the course of providing health care to you.

A. Permitted Uses and Disclosures of PHI

We may use and disclose your PHI for the following reasons without your written authorization:

1. Treatment. We may disclose your PHI to physicians, clinicians, and other personnel involved in providing or coordinating your care. For example, we may share medical information about you with another clinician we consult about your treatment, or with a pharmacy to fill a prescription.
2. Payment. We may use and disclose your PHI to bill and collect payment for the services we provide to you. For example, we may send a bill to you or to a third-party payor, and that bill may contain information that identifies you, your diagnosis, and the services provided. We may also share your PHI with our business associates that process healthcare claims on our behalf.
3. Healthcare Operations. We may use and disclose your PHI in connection with our healthcare operations, including quality assessment, evaluating clinician performance, training, accreditation, and other business operations. We may also share your PHI with accountants, attorneys, and consultants to help us comply with the laws that govern us.
4. If You Are Incapacitated or Unavailable. If you are unable to communicate with us (for example, due to a medical emergency or incapacity), we may use or disclose your PHI when we believe in good faith that doing so is in your best interest.
5. Family and Friends. We may disclose your PHI to a family member, friend, or any other person you identify as being involved in your care or payment for your care, unless you object.
6. Required by Law. We may disclose your PHI for law enforcement purposes and as otherwise required by state or federal law. For example, the law may require us to report instances of suspected abuse, neglect, or domestic violence; to report certain injuries such as gunshot wounds; or to disclose PHI to assist law enforcement in locating a suspect, fugitive, material witness, or missing person. We will inform you or your representative if we disclose your PHI because we believe you are a victim of abuse, neglect, or domestic violence, unless we determine that doing so would place you at risk. We must also provide PHI to comply with a court order in a legal or administrative proceeding, and may be required to provide PHI in response to a subpoena, discovery request, or other lawful process if reasonable efforts have been made to contact you or to obtain a protective order.
7. Serious Threat to Health or Safety. We may disclose your PHI if we believe it is necessary to prevent or lessen a serious and imminent threat to the health or safety of you or the public.
8. Public Health. We may disclose your PHI to public health or other authorities charged with preventing or controlling disease, injury, or disability, or with collecting public health data, including to report adverse reactions to medications or product defects.
9. Health Oversight Activities. We may disclose your PHI to a health oversight agency for activities authorized by law, including audits; civil, administrative, or criminal investigations; inspections; licensure or disciplinary actions; and oversight of the health care system, government benefit programs, and civil rights laws.
10. Research. We may use or disclose your PHI for certain research purposes, but only when an Institutional Review Board or privacy board has reviewed the research and put protections in place to ensure the privacy of your PHI, or where otherwise permitted by law.
11. Workers' Compensation. We may disclose your PHI to comply with laws relating to workers' compensation or other similar programs.
12. Specialized Government Activities. If you are active military or a veteran, we may disclose your PHI as required by military command authorities. We may also be required to disclose PHI to authorized federal officials for the conduct of intelligence or other national security activities.
13. Appointment Reminders and Health-Related Communications. We may use your PHI to contact you with appointment reminders, follow-up messages, treatment alternatives, or information about other health-related benefits and services that may be of interest to you.

B. Disclosures Requiring Your Written Authorization

1. Not Otherwise Permitted. In any situation not described in Section A above, we will not use or disclose your PHI without your written authorization. You may revoke an authorization at any time, in writing, except to the extent we have already acted in reliance on it.
2. Marketing and Sale of PHI. We must receive your written authorization before any use or disclosure of your PHI for marketing purposes, and before any disclosure that constitutes a sale of PHI.
3. Psychotherapy Notes. Most uses and disclosures of psychotherapy notes (if any are created) require your written authorization.

C. Your Rights

You may exercise the rights described below by submitting a written request to the Privacy Officer at the contact information at the end of this Notice. Requests submitted by email are accepted.

1. Right to Receive a Copy of This Notice. You have the right to receive a paper or electronic copy of this Notice upon request.
2. Right to Access PHI. You have the right to inspect and obtain a copy of your PHI for as long as we maintain your medical record. We may charge a reasonable, cost-based fee permitted by applicable law for the copying and delivery of your record. In limited circumstances we may deny your request, and you may request that the denial be reconsidered by another licensed health care professional we select.
3. Right to Request Restrictions. You have the right to request a restriction on our use or disclosure of your PHI for treatment, payment, or healthcare operations, and on disclosures to a family member or friend involved in your care. We are not legally required to agree to such a restriction except as described in the following item.
4. Right to Restrict Disclosure for Services Paid by You in Full. You have the right to restrict disclosure of your PHI to a health plan if the PHI pertains to health care services for which you paid us in full directly out of pocket.
5. Right to Request Amendment. You have the right to request that we amend your PHI if you believe it is incorrect or incomplete. We may deny your request if (a) we did not create the PHI, (b) we do not maintain it, (c) it is not information you are permitted to inspect or copy, or (d) we determine that the PHI is accurate and complete.
6. Right to an Accounting of Disclosures. You have the right to request an accounting of disclosures of your PHI made by us during the six (6) years prior to your request, other than disclosures made for treatment, payment, or healthcare operations or disclosures you authorized. One accounting per twelve-month period is provided without charge; additional requests may be subject to a reasonable, cost-based fee.
7. Right to Confidential Communications. You have the right to request that we communicate with you about your PHI by alternative means or at alternative locations. We will accommodate reasonable requests.
8. Right to Notice of Breach. You have the right to be notified following a breach of your unsecured PHI.

D. Special Protections for Sensitive Information

Certain categories of health information receive heightened protection under federal or state law and may not be used or disclosed without your specific written authorization, except in limited circumstances. These categories may include, depending on applicable state law:

• Alcohol and substance use treatment records (42 CFR Part 2)
• Mental and behavioral health records
• HIV/AIDS-related information
• Genetic information
• Reproductive health information
• Sexually transmitted infection records
• Information about abuse, neglect, or domestic violence

Where state law provides greater privacy protection than HIPAA for any of the above, we will follow the more protective standard.

E. Changes to This Notice

We reserve the right to change this Notice at any time in accordance with applicable law, and to make the revised Notice effective for PHI we already have about you as well as any PHI we receive in the future. The current version will be posted on the Rovi Health website, and we will indicate the effective date at the top of this Notice. When you first use the Services, we will ask you to acknowledge electronically that you have received this Notice.

F. Questions and Complaints

If you would like more information about our privacy practices, or if you believe your privacy rights have been violated or you disagree with a decision we made about access to your PHI, please contact the Privacy Officer using the information below.

You may also submit a written complaint to the U.S. Department of Health and Human Services, Office for Civil Rights. We will provide you the address upon request, or you can find it at hhs.gov/ocr.

We support your right to the privacy of your PHI and will not retaliate in any way if you choose to file a complaint with us or with the U.S. Department of Health and Human Services.

Contact Information