HIPAA Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED, AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Our commitment

Aunyx Labs is required by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) to maintain the privacy of your Protected Health Information (“PHI”), to provide you with this Notice of our legal duties and privacy practices with respect to PHI, and to notify you in the event of a breach of unsecured PHI. We are required to abide by the terms of this Notice as currently in effect.

This Notice covers all of the health information we hold about you, including your intake, lab results, visit notes, recordings and transcripts of video visits, progress photos and documents you upload in the Aunyx app, and connected-device data.

How we may use and disclose your PHI

We may use and disclose your PHI without your written authorization for the following purposes:

• Treatment: To provide, coordinate, or manage your care. For example, your labs and intake information are shared with the licensed provider who reviews your results and builds your care plan, and with the phlebotomist and laboratory that collect and process your samples. If you connect a wearable or health app (such as Oura, Whoop, Apple Health, or Fitbit), the data you authorize becomes part of your health record, and your provider may use it as part of your care. If you agree, we may record and transcribe your video visits. We use software tools, including artificial intelligence tools run by contracted vendors that have signed business associate agreements with us, to help draft visit notes from those transcripts and to read values from lab reports you upload. Your clinician reviews AI-drafted notes before they become part of your record. Your care team may view progress photos you take in the app to follow your progress.
• Payment: To bill and receive payment for the services you receive. For example, we share limited information with our payment processor (Stripe) to process your card transaction.
• Healthcare operations: For activities like quality assessment, provider training, case review, and business planning, in each case using the minimum necessary PHI.
• As required by law: When state or federal law requires us to disclose PHI, for example in response to a valid subpoena or court order, or in reporting communicable diseases or suspected abuse.
• Public health and safety: To prevent a serious threat to health or safety, or to report to public health authorities as permitted or required by law.
• Business associates: We may share PHI with contracted business associates, companies that help us run our practice and have agreed in writing to protect your information the same way we must. They include our video visit platform, our AI documentation service, our database and hosting providers, our electronic health record vendor, our payment processor (which receives no health information), and diagnostic labs. Each is bound by a written Business Associate Agreement requiring them to safeguard your PHI, forbidding them from using it for their own purposes, and forbidding any AI vendor from training its models on it.

Uses that require your written authorization

Other uses and disclosures of your PHI that are not described above will be made only with your written authorization. This includes most uses and disclosures of psychotherapy notes, uses and disclosures for marketing purposes, and any sale of PHI. You may revoke any authorization you give at any time by writing to us at the address below. The revocation will not affect any disclosures we already made in reliance on your prior authorization.

If we receive substance use disorder treatment records that are protected by 42 CFR Part 2, we will not use or disclose them in any civil, criminal, administrative, or legislative proceeding against you without your written consent or a court order, as that law requires.

Your rights under HIPAA

• Access. You have the right to inspect and obtain a copy of your PHI held by us, subject to limited exceptions. We may charge a reasonable, cost-based fee for copies.
• Amendment. You have the right to request that we amend PHI we hold if you believe it is inaccurate or incomplete. We may deny your request under certain circumstances.
• Accounting of disclosures. You have the right to receive a list of certain disclosures of your PHI we have made in the six years prior to your request.
• Restrictions. You have the right to request a restriction on how we use or disclose your PHI for treatment, payment, or healthcare operations. We are not required to agree, but if we do, we will honor the restriction except in an emergency.
• Confidential communications. You have the right to request that we communicate with you in a specific way or at a specific location (for example, by email rather than SMS).
• Paper copy of this Notice. You have the right to obtain a paper copy of this Notice at any time, even if you have received it electronically.
• Notification of breach. You have the right to be notified in the event of a breach of your unsecured PHI.

Text messages

This Notice covers protected health information. Text messaging is governed by our Privacy Policy at aunyxlabs.com/privacy. We do not share, sell, or provide your mobile phone number or messaging consent data to third parties or affiliates for marketing or promotional purposes.

Changes to this Notice

We reserve the right to change this Notice and our privacy practices at any time. Any revised Notice will apply to PHI we already maintain and to PHI we create or receive in the future. A copy of our current Notice will always be posted at aunyxlabs.com/hipaa.

Complaints

If you believe your privacy rights have been violated, you may file a complaint with us or with the Secretary of the US Department of Health and Human Services. You will not be retaliated against for filing a complaint.

To file a complaint with us, email hello@aunyxlabs.com with the subject line “Privacy Complaint.” Please include a brief description of the issue and your preferred method of contact. We will respond within 30 days.

You may also file a complaint in writing with the US Department of Health and Human Services, Office for Civil Rights, at hhs.gov/hipaa/filing-a-complaint.

Contact us

For questions about this Notice or to exercise any of your rights listed above, contact us at hello@aunyxlabs.com.