HIPAA Notice of Privacy Practices

NOTICE OF PRIVACY PRACTICES

BrainSMART Lifestyle Companion

Effective Date: June 25, 2026
Last Updated: June 25, 2026

THIS NOTICE DESCRIBES HOW MEDICAL AND HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN ACCESS THIS INFORMATION.

PLEASE REVIEW IT CAREFULLY.

OUR COMMITMENT TO YOUR PRIVACY

BrainSMART Lifestyle Companion ("BrainSMART," "we," "our," or "us") is committed to protecting the privacy and security of your health information.

This Notice describes our privacy practices regarding Protected Health Information ("PHI") and explains your rights concerning that information.

We are required by applicable law to:

Maintain the privacy and security of Protected Health Information;
Provide you with this Notice of Privacy Practices;
Notify you following certain breaches of unsecured Protected Health Information;
Follow the privacy practices described in this Notice.

WHAT IS PROTECTED HEALTH INFORMATION (PHI)?

Protected Health Information ("PHI") is individually identifiable health information that relates to:

Your physical or mental health condition;
The provision of healthcare services;
Payment for healthcare services.

PHI may include:

Name;
Address;
Date of birth;
Health assessments;
Medical history;
Symptoms;
Wellness information;
Health-related questionnaire responses;
Other information that can identify you.

Not all information collected through BrainSMART necessarily constitutes PHI under HIPAA.

HOW WE MAY USE AND DISCLOSE YOUR INFORMATION

1. For Treatment-Related Activities

Where applicable, we may use or disclose health information to assist healthcare providers, care coordinators, or authorized healthcare organizations in supporting your care and wellness activities.

2. For Healthcare Operations

We may use information to:

Improve our services;
Conduct quality assessments;
Maintain security;
Perform audits;
Train personnel;
Evaluate system performance.

3. With Your Authorization

We may use or disclose your health information when you provide written or electronic authorization.

You may revoke authorization at any time unless we have already relied upon it.

4. Business Associates

We may share information with authorized service providers that assist us in operating the platform, including:

Cloud hosting providers;
Security vendors;
Analytics providers;
Customer support providers;
Technology service providers.

These organizations are required to safeguard information and are contractually obligated to protect Protected Health Information where applicable.

5. As Required by Law

We may disclose information when required by:

Federal law;
State law;
Court orders;
Legal proceedings;
Government investigations.

6. Public Health and Safety Activities

Where permitted or required by law, we may disclose information to:

Public health authorities;
Regulatory agencies;
Law enforcement authorities;
Government oversight agencies.

7. To Prevent Serious Threats

We may disclose information when necessary to help prevent a serious and imminent threat to health or safety.

YOUR RIGHTS REGARDING HEALTH INFORMATION

Right to Access

You have the right to inspect and obtain a copy of your health information maintained by BrainSMART, subject to certain legal limitations.

Requests may be submitted in writing using the contact information below.

Right to Request Corrections

If you believe information maintained about you is inaccurate or incomplete, you may request that it be corrected.

We may deny requests where permitted by law, but we will explain the reason for any denial.

Right to Request Restrictions

You may request restrictions on certain uses or disclosures of your information.

While we will consider all requests, we may not always be required to agree to requested restrictions.

Right to Request Confidential Communications

You may request that communications be sent through alternative means or to alternative locations.

We will accommodate reasonable requests when possible.

Right to Receive an Accounting of Disclosures

You may request a list of certain disclosures of your health information made by BrainSMART during the period required by applicable law.

Right to Receive a Copy of This Notice

You may request a paper or electronic copy of this Notice at any time.

Right to Revoke Authorization

If you previously authorized a use or disclosure of your information, you may revoke that authorization in writing at any time.

Revocation will not affect actions already taken before the authorization was withdrawn.

OUR RESPONSIBILITIES

BrainSMART is required to:

Maintain appropriate safeguards to protect information;
Limit access to authorized personnel;
Train workforce members regarding privacy obligations;
Monitor compliance with privacy requirements;
Notify affected individuals of certain breaches when required by law.

BREACH NOTIFICATION

If a breach of unsecured Protected Health Information occurs and notification is required by law, BrainSMART will provide notice without unreasonable delay and in accordance with applicable legal requirements.

Notifications may be provided by: