CICADA HEALTH PRIVACY POLICY
1. Introduction. Cicada Health (“Cicada Health”, “Company”, “we”, “us”, or “our”) is committed to maintaining robust privacy protections for our users. This Privacy Policy describes how we collect, use, share, retain, and protect information in connection with your use of our website (cicadahealthco.com) and any other Cicada Health platform (together, the “Platforms”).
2. Scope. This Privacy Policy applies to individuals accessing health-related services through the Platforms, healthcare providers and other third parties contracted with Cicada Health, and use of the Platforms and related services.
3. Information Collection, Use, and Purpose. We collect a variety of information from our users, including personal identifiers (names, email addresses, geographic locations, ages, sexes, etc.), health and medical data, and technical/usage data. This data is obtained through direct interactions on our Platforms, as well as through cookies and third-party analytics tools. Our Platforms additionally collect comprehensive medical and health-related information. All such data is collected for the purpose of providing our services, processing payment, conducting operations, understanding user needs, and maintaining compliance with relevant health information privacy regulations. Third-party vendors comply with U.S. data protection laws, ensuring the security and confidentiality of your personal data. All third-party vendors and business associates are bound by HIPAA Business Associate Agreements and Colorado confidentiality laws, as applicable.
4. Data Sharing, Disclosure, and Third-Party Relations. Your personal data is a critical aspect of our operations, and we take the responsibility of handling it with the utmost care. Colorado law prohibits the sale of sensitive personal data without prior consent. We do not sell or lease user data to third parties for their marketing purposes. SMS consent obtained through our services is not shared with third parties for marketing purposes. Your mobile phone number and SMS opt-in status are used solely to facilitate communications between you and Cicada Health. Third-party vendors and service providers engaged by us are contractually bound to respect the confidentiality of your information. Additionally, we may disclose personal information when legally required, or in situations where such disclosure is necessary to protect our rights or the rights of others. We conduct audits to ensure the accuracy and security of your personal data.
5. User Rights and Data Governance. In accordance with data protection laws, you have the right to access, correct, delete, and object to processing or opt out of targeted advertising, profiling, or precise geolocation. You may also limit or object to the processing or sharing of your data, subject to legal and operational limits. Requests regarding your data rights can be directed to our designated contact point, as detailed at the end of this policy. Our advanced security measures include end-to-end encryption and secure storage facilities, fully compliant with U.S. data protection laws including HIPAA and HITECH.
You also have rights under HIPAA and Colorado law to access, correct, amend, and request copies of your medical records, which shall be furnished in a timely manner.
6. Data Security Measures and Protocols. The security of your personal data is paramount. We employ advanced security measures to protect against unauthorized access, alteration, disclosure, or destruction of your information. Compliance with industry-standard protocols and continuous monitoring ensures the integrity and security of your data.
Despite safeguards, no system is 100% secure. Patients are encouraged to use strong passwords and maintain confidentiality of their Platform access.
7. Data Retention and Destruction Policies. We retain personal data only as long as necessary to fulfill the purposes for which it was collected. Data is securely destroyed or anonymized upon the expiration of the retention period.
8. Cross-Border Data Transfers. Our services are currently confined within the territorial bounds of the United States. We do not engage in international data transfers, ensuring that your data remains under the jurisdiction of U.S. privacy laws. We operate exclusively within the United States, adhering strictly to U.S. privacy laws.
9. Do Not Track Signals. Our website respects and responds to Do Not Track (“DNT”) signals. We modify our tracking practices in accordance with your browser’s DNT settings, ensuring that your preferences in terms of tracking are honored.
10. Children’s Privacy. We do not knowingly collect or solicit personal information from children under the age of 18 without parental or guardian consent. Dependents covered under employer eligibility will have their information managed in compliance with HIPAA and applicable laws.
11. Opt-Out & Unsubscribe from Third-Party Communications. We provide users with the opportunity to opt-out of having their personal information used for certain purposes. This includes opting out of receiving communications from third-party partners and withdrawing consent for the disclosure of personal information.
12. Tracking User Behavior. We monitor user behavior on our website to enhance user experience, tailor our services, and conduct market research. This tracking is conducted in a manner that respects user privacy and preferences.
13. Use of Cookies and Web Beacons. Cookies and web beacons are used on our website to improve user experience, analyze trends, administer the site, and gather demographic information about our user base as a whole. Users can control the use of cookies at the individual browser level.
14. External Data Storage Sites. We may store data on servers provided by third-party hosting vendors with whom we have contracted, ensuring that these vendors adhere to our strict data protection standards. Our third-party hosting vendors are based in the United States and comply with all relevant U.S. data protection standards.
15. Legal and Governmental Use of PHI. In compliance with legal and governmental requirements, we may use or disclose your PHI as necessary and in accordance with applicable laws and regulations.
16. Communication Platforms. We utilize various communication platforms to keep you informed about your care and treatment, send appointment reminders, and notify you about healthcare-related services or benefits that may be of interest to you.
17. Telehealth. The laws that protect the privacy and confidentiality of PHI also apply to telehealth. Information obtained during telehealth that identifies you will not be given to anyone without your consent except for purposes of treatment, education, billing, and healthcare operations. By using telehealth services, you consent to Cicada Health sharing your PHI with certain third parties.
18. Changes to this Policy. This Privacy Policy may be updated from time to time to reflect changes in our practices, technology, legal requirements, and other factors. Users will be notified through the Platforms or other reasonable means of communication when updates are made. We encourage users to periodically review this policy for the latest information on our privacy practices.
19. Contact Information for Privacy Concerns. Should you have any questions or concerns regarding this Privacy Policy or the handling of your data, you can reach us at admin@cicadahealthco.com. We will investigate and attempt to resolve any complaints and disputes regarding the use and disclosure of personal information in accordance with this Privacy Policy.
20. Acknowledgement and Consent. By using the Platforms, you acknowledge that you have read and understood this Privacy Policy and agree to its terms. You also consent to the collection, use, and disclosure of your information as outlined in this policy.
THIS NOTICE DESCRIBES HOW YOUR MEDICAL INFORMATION MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
This Telemedicine HIPAA Notice of Privacy Practices (the “Notice”) is being provided to you by Cicada Health, as that entity or its subsidiaries and affiliated entities may be formed and incorporated in your state, and the employees and practitioners that work at such entity and/or for such practices (collectively referred to herein as “We” or “Our”). It contains important information regarding your medical information. You also have the right to receive a paper copy of this Notice and may ask us to give you a copy of this Notice at any time. If you received this Notice electronically, you are still entitled to a paper copy of this Notice upon your request. You can request a paper copy of our current Notice from the Privacy Officer at admin@cicadahealthco.com or on our website at cicadahealthco.com.
The Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) imposes numerous requirements on health care practices such as ours, regarding how certain individually identifiable health information — known as protected health information or “PHI” — may be used and disclosed. We understand that medical information about you and your health is personal. We are committed to protecting medical information about you and will use it to the minimum necessary to accomplish the intended purpose of the use, disclosure or request of it. As required by law, this notice provides you with information about your rights and our legal duties and privacy practices with respect to the privacy of PHI. This notice also discusses the uses and disclosures we will make of your PHI. We must comply with the provisions of this notice as currently in effect, although we reserve the right to change the terms of this notice from time to time and to make the revised notice effective for all PHI we maintain.
PERMITTED USES AND DISCLOSURES
We can use or disclose your PHI for purposes of treatment, payment, and health care operations.
Treatment means the provision, coordination, or management of your health care, including consultations between health care providers relating to your care and referrals for health care from one health care provider to another.
Payment means the activities we undertake to obtain reimbursement for the health care provided to you, including billing, claims management, determinations of eligibility and coverage, collections, case management, and other utilization review activities.
Health Care Operations means the support functions for our practice and providers, related to referral, facilitating the telemedicine connection and visit, care coordination, compliance reviews, quality assurance activities, receiving and responding to patient comments and complaints, provider training, audits, business planning, development, management, legal, and administrative activities.
OTHER USES AND DISCLOSURES OF PROTECTED HEALTH INFORMATION
We may also use your PHI in the following ways:
- To provide appointment reminders and schedule your availability for your treatment.
- To tell you about or recommend possible treatment alternatives or other health-related benefits and services that may be of interest to you.
- To your family, personal representative, power of attorney, guardian, or any other individual identified by you to the extent directly related to such person’s involvement in your care or the payment for your care.
- When permitted by law, we may coordinate our uses and disclosures of PHI with public or private entities authorized by law or by charter to assist in disaster relief efforts.
- We may use or disclose your PHI for research purposes, subject to the requirements of applicable law.
- In certain cases, we will provide your information to contractors, agents and other parties who need the information in order to perform a service for us (“Business Associates”).
- We may share your information with an insurance company, law firm or risk management organization in order to maintain professional advice about how to manage risk and legal liability.
- We will use or disclose PHI about you when required to do so by applicable law.
SPECIAL SITUATIONS
Subject to the requirements of applicable law, we will make the following uses and disclosures of your PHI:
- Emergencies: In life threatening emergencies, we will disclose information necessary to avoid serious harm or death.
- Organ and Tissue Donation: If you are an organ donor, we may release PHI to organizations that handle organ procurement or transplantation.
- Military and Veterans: If you are a member of the Armed Forces, we may release PHI about you as required by military command authorities.
- Worker’s Compensation: We may release PHI about you for programs that provide benefits for work-related injuries or illnesses.
- Public Health Activities: We may disclose PHI about you for public health activities including disease prevention, reporting births and deaths, reporting child abuse or neglect, and notifying persons exposed to disease.
- Health Oversight Activities: We may disclose PHI to federal or state agencies that oversee our activities.
- Lawsuits and Disputes: If you are involved in a lawsuit or a dispute, we may disclose PHI subject to certain limitations and only to the extent permissible by law.
- Law Enforcement: We may release PHI if asked to do so by a law enforcement official in response to a court order, warrant, summons or similar process.
- Serious Threats: We may use and disclose PHI if we, in good faith, believe that the use or disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public.
CONFIDENTIALITY OF MENTAL HEALTH, HIV, ALCOHOL, AND DRUG ABUSE PATIENT RECORDS
PHI related to your mental health, psychotherapy notes, HIV, genetic information, alcohol and/or substance abuse records, and other specially protected health information may enjoy certain heightened confidentiality protections under HIPAA and applicable state and federal law. Any disclosure of these types of records will be subject to these special provisions.
OTHER USES OF YOUR HEALTH INFORMATION
Certain uses and disclosures of PHI will be made only with your written authorization, including uses and/or disclosures of psychotherapy notes, for marketing purposes, and that constitute a sale of PHI under the Privacy Rule. You have the right to revoke that authorization at any time, provided that the revocation is in writing.
YOUR RIGHTS
You have the right to:
- Request restrictions on our uses and disclosures of PHI for treatment, payment and health care operations.
- Reasonably request to receive confidential communications of your PHI by alternative means or at alternative locations.
- Inspect and copy the PHI contained in our provider records.
- Request an amendment to your PHI.
- Receive an accounting of disclosures of PHI made by us.
- Receive a notification in the event of a breach of your unsecured PHI.
To make any of the above requests, submit your request in writing to the Privacy Officer at admin@cicadahealthco.com.
NOTICE REGARDING USE OF TECHNOLOGY
We may use electronic software, services, and equipment including email, video conferencing technology, cloud storage and servers, internet communication, cellular network, voicemail, facsimile, electronic health record, and related technology to share PHI with you or third-parties. We will take measures to safeguard the data transmitted, as well as ensure its integrity against intentional or unintentional breach or corruption.
CHANGES TO THIS NOTICE
We reserve the right to change this Notice at any time, for any reason permissible by law. We will post a copy of the current Notice at cicadahealthco.com. The Notice will contain on the first page, in the top right-hand corner, the effective date.
COMPLAINTS
If you believe that your privacy rights have been violated, you should immediately contact the Privacy Officer at admin@cicadahealthco.com. We will not take action against you for filing a complaint. You also may file a complaint with the Secretary of the U.S. Department of Health and Human Services.