Privacy Policy

Scope — Relationship to HIPAA Agreements

This Privacy Policy applies to the Health Universe websites and the Health Universe Platform. Where Health Universe processes Protected Health Information (“PHI”) on behalf of a healthcare organization as a business associate under the Health Insurance Portability and Accountability Act (“HIPAA”), that processing is governed by the applicable Business Associate Agreement (“BAA”) and, for information exchanged through the TEFCA network, the applicable TEFCA Subparticipant Terms of Participation (“ToP”). If this Privacy Policy conflicts with an executed BAA, ToP, or other agreement, that agreement controls with respect to the information it governs. Where no BAA has been executed, users are prohibited from submitting another individual’s PHI to the platform unless that individual has given their express permission, as described in our Terms of Use; health information that individuals submit about themselves, or about another individual with that individual’s express permission, in a personal capacity is not governed by HIPAA and is handled as described in this policy. Your use of the Health Universe Platform is also subject to our Terms of Use.

Information We Collect

Account and Verification Information

When you create an account, we collect information such as your name, email address, organization, and role. For clinicians and other users authorized to access clinical records, we also collect professional verification information, which may include your National Provider Identifier (NPI), state license number, and identity-verification data.

Clinical Information Processed on Behalf of Our Customers

The Health Universe Platform may process identifiable clinical information, including PHI, on behalf of the healthcare organizations and professionals that use it. This may include information submitted to the platform by or on behalf of our customers and clinical records retrieved through connected health information networks, including the Trusted Exchange Framework and Common Agreement (“TEFCA”) network, solely for the Treatment purpose described below. We process this information as a business associate under the applicable BAA and do not use or disclose it except as permitted by that agreement, the ToP, and applicable law.

Information You Submit About Yourself or With Another’s Permission

If you use the Health Universe Platform in a personal capacity, you may submit health information about yourself, or about another individual if that individual has given you their express permission; you are responsible for obtaining and honoring that permission. Because you are not acting as a HIPAA covered entity or business associate when submitting this information, HIPAA does not apply to it; it is consumer health data governed by this Privacy Policy and applicable consumer-health privacy laws, including the FTC Health Breach Notification Rule and state health-data privacy laws where applicable. We process this information with your consent and solely to provide the services you request, we do not sell it, and we will provide breach notifications as required by applicable law. Individual accounts do not include access to TEFCA record retrieval.

Usage and System Data

We collect operational, performance, availability, usage, integrity, and security data generated by use of the platform, such as log data, device and browser information, and audit records of platform activity.

How We Use Information

We use the information we collect to provide, support, secure, and improve the Health Universe Platform; to verify the identity and credentials of users authorized to access clinical records; to maintain audit trails and purpose-of-use records required by HIPAA and TEFCA; to communicate with you about the services; and to comply with legal obligations. PHI is used and disclosed only as permitted by the applicable BAA, the ToP, and applicable law. We may create and use de-identified and aggregated data, in accordance with applicable law and our agreements with customers, for analytics, benchmarking, research, and service improvement; de-identified and aggregated data does not identify you, our customers, or any patient.

How We Share Information

We do not sell personal information, and we do not share personal or medical information with third parties without appropriate authorization except as described in this policy. We may share information with: (a) service providers and subprocessors that support the platform under contracts requiring confidentiality and security protections consistent with this policy and, where applicable, HIPAA; (b) connected health information networks, in order to fulfill Treatment-purpose record requests as described below; (c) legal and regulatory authorities where required by law; and (d) a successor entity in connection with a merger, acquisition, or sale of assets, subject to this policy. We may share de-identified, aggregated data with external parties, including for research purposes; such data does not include personally identifiable information.

TEFCA and Health Information Exchange

Health Universe participates in the TEFCA network as a Participant of Kno2, a Qualified Health Information Network (QHIN). Through this connectivity, authorized clinicians and healthcare organizations may retrieve a patient’s clinical records from participating organizations nationwide solely for the Treatment exchange purpose as defined under the TEFCA Common Agreement. Every query is purpose-of-use tagged, logged, encrypted, and audit-tracked. Health Universe accesses, uses, and retains TEFCA-retrieved information only as necessary to fulfill the Treatment-purpose request and deliver the results to the requesting organization, consistent with the ToP and applicable Standard Operating Procedures. Individuals who have questions about records exchanged through TEFCA, or who wish to exercise choices regarding health information exchange, should contact their healthcare provider, and may find more information about TEFCA at HealthIT.gov.

Data Retention

We retain personal information only as long as needed for the purposes described in this policy, to comply with legal, regulatory, and contractual obligations, and to resolve disputes. Clinical information retrieved through the TEFCA network is not retained as a system of record: Health Universe may purge retrieved records when they are no longer needed to provide the services, in accordance with our retention practices, the applicable BAA or ToP, and applicable law. We retain compliance documentation, such as audit logs and privacy and security program records, for the periods required by HIPAA and TEFCA, which is generally six years for required documentation.

Security

We maintain a written information security program with administrative, technical, and physical safeguards designed to protect the security, confidentiality, and integrity of the information we process, consistent with the HIPAA Security Rule, TEFCA requirements, and industry frameworks. Safeguards include encryption in transit and at rest, role-based access controls, identity verification for clinical-record access, audit logging, and regular review and updating of our security measures. No system is perfectly secure; we will notify affected customers and individuals of security incidents as required by applicable law and our agreements.

Cookies

Our websites use cookies and similar technologies. Necessary cookies enable core site functionality and cannot be disabled. Functional cookies remember your preferences. Performance cookies help us understand how visitors use the site so we can improve it. Interest-based cookies may be used to personalize content. You can control cookies through your browser settings; disabling some cookies may affect site functionality.

Your Rights and Choices

You may access, correct, or request deletion of your account information by contacting us. Depending on where you live, you may have additional rights under applicable privacy laws, including rights to know, delete, correct, or limit certain uses of your personal information; we will honor verified requests as required by law. For requests concerning clinical records — including records retrieved through health information networks — please contact your healthcare provider or the organization that holds your medical record, as Health Universe processes that information on their behalf and is not the medical-records custodian.

Children

The Health Universe Platform is intended for use by healthcare professionals and other authorized adult users. It is not directed to children, and we do not knowingly collect personal information directly from children. Patient records processed on behalf of our customers may include information about minors receiving care; that information is handled as PHI under the applicable BAA and applicable law.

Reporting Security Vulnerabilities

If you believe you have identified a security vulnerability in the Health Universe Platform or our websites, please report it to security@healthuniverse.com. We appreciate responsible disclosure and will work promptly to investigate and remediate confirmed issues.

Changes to This Policy; Contact

We may update this Privacy Policy from time to time by posting a revised version with an updated “Last updated” date. Material changes will be communicated through the platform or by other reasonable means. If you have questions about this policy or our privacy practices, please contact us at security@healthuniverse.com or at Health Universe, Inc., 2261 Market Street #5116, San Francisco, CA 94114.