HIPAA Notice of Privacy Practices

FemmeKare is a telehealth service operated by SDKare LLC and is not a separate legal entity. This Notice describes the privacy practices of SDKare LLC with respect to Protected Health Information created, received, maintained, or transmitted in connection with healthcare services provided through FemmeKare.

Your Information. Your Rights. Our Responsibilities.

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

This Notice of Privacy Practices explains how SDKare LLC may use and disclose your Protected Health Information, your rights regarding that information, and our legal responsibilities for protecting it.

For purposes of this Notice, Protected Health Information (“PHI”) means individually identifiable health information that is protected under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and its implementing regulations.

1. Your Rights Regarding Your Health Information

You have certain rights regarding PHI that we maintain about you.

These rights are subject to applicable law and may include the following.

Obtain an Electronic or Paper Copy of Your Health Information

You may ask to inspect or obtain an electronic or paper copy of your medical record and other PHI that we maintain about you and that is subject to the HIPAA right of access.

We will generally act on your request within 30 days, as required by HIPAA. If additional time is permitted by law, we will notify you.

We may charge a reasonable, cost-based fee where permitted by law.

Certain information may not be subject to the right of access under HIPAA or other applicable law.

Request an Amendment

If you believe PHI about you is incorrect or incomplete, you may request that we amend the information.

We may deny an amendment request where permitted by law. If we deny your request, we will provide a written explanation as required by HIPAA.

We will generally act on an amendment request within 60 days, subject to any extension permitted by law.

Request Confidential Communications

You may ask us to communicate with you about your health information in a particular way or at a different location.

For example, you may request that we contact you through a particular telephone number, email address, or mailing address.

We will accommodate reasonable requests as required by HIPAA.

Request Restrictions on Uses or Disclosures

You may ask us not to use or disclose certain PHI for treatment, payment, or healthcare operations.

We are generally not required to agree to every requested restriction. If we agree to a restriction, we will comply with it except where disclosure is permitted or required by law, including where information may be necessary for emergency treatment.

If you pay for a healthcare service in full out of pocket, you may request that we not disclose PHI relating solely to that service to a health plan for payment or healthcare operations purposes. We will honor such a request when HIPAA requires us to do so, unless the disclosure is otherwise required by law.

FemmeKare operates on a self-pay basis and does not routinely submit insurance claims for FemmeKare services.

Receive an Accounting of Certain Disclosures

You may request a list of certain disclosures of your PHI made during the six years before the date of your request.

An accounting generally does not include disclosures made for:

Treatment

Payment

Healthcare operations

Disclosures made directly to you

Disclosures you specifically authorized

Certain other disclosures excluded from accounting requirements under HIPAA

We will provide one accounting within a 12-month period without charge. We may charge a reasonable, cost-based fee for additional requests during the same 12-month period where permitted by law.

Obtain a Copy of This Notice

You may request a paper copy of this Notice at any time, even if you previously agreed to receive it electronically.

A current copy of this Notice is also available through the FemmeKare website.

Choose Someone to Act for You

If another person has legal authority to act on your behalf, such as a legally authorized personal representative, that person may exercise applicable HIPAA rights on your behalf.

We may verify the person’s identity and legal authority before processing a request or disclosing PHI.

Verification of Identity and Authority

Before disclosing Protected Health Information where verification is required by HIPAA, SDKare LLC will take reasonable steps to verify the identity of the person requesting the information and, when applicable, that person’s authority to receive or act with respect to the requested PHI.

Verification may include documentation, identifying information, credentials, representations, or other evidence appropriate to the circumstances and permitted by law.

When a request is made by a personal representative, legal representative, public official, or another person acting on behalf of an individual, SDKare LLC may require reasonable documentation or other evidence establishing that person’s authority before disclosing PHI or permitting the person to exercise applicable rights.

Where HIPAA or another applicable law requires particular documentation, representations, or legal process before a disclosure may be made, SDKare LLC will obtain and evaluate the required information before making the disclosure.

Verification procedures will be applied consistent with HIPAA and other applicable law and will not be used to create unreasonable barriers to the lawful exercise of an individual’s privacy rights.

File a Privacy Complaint

You may file a complaint if you believe your privacy rights have been violated.

You may submit a complaint to:

Sophie Brown

Patient Care Manager and Privacy Officer

SDKare LLC, operating FemmeKare

Email: sophie.brown@femmekare.com

Mailing address: 2810 N Church St, Wilmington, DE, United States, 19802

You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights.

U.S. Department of Health and Human Services

Office for Civil Rights

200 Independence Avenue, S.W.

Washington, D.C. 20201

Phone: 1-877-696-6775

SDKare LLC will not retaliate against you for filing a privacy complaint or exercising a right provided by HIPAA.

2. Your Choices About Certain Uses and Disclosures

For certain health information, you may tell us your preferences regarding how the information is used or disclosed.

Family, Friends, Caregivers, and Others Involved in Your Care

You may tell us whether we may disclose relevant PHI to a family member, close friend, caregiver, or other person involved in your care or payment for your care.

If you are unable to tell us your preference, we may disclose limited information when permitted by HIPAA and when, based on professional judgment, the disclosure is in your best interest.

Disaster Relief

Where permitted by law, we may disclose relevant information to a disaster-relief organization to assist with notification of your condition, location, or status.

Serious Threats to Health or Safety

We may use or disclose PHI where permitted by law when necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public.

3. Uses and Disclosures Requiring Your Written Authorization

We will obtain your written authorization before using or disclosing PHI when HIPAA requires authorization.

This generally includes:

Most uses and disclosures of psychotherapy notes

Marketing activities that require authorization under HIPAA

A sale of PHI

Other uses or disclosures that are not otherwise permitted or required by HIPAA

SDKare LLC does not sell PHI.

If you provide an authorization, you may revoke it in writing at any time.

A revocation will apply to future uses or disclosures but will not affect actions already taken in reliance on a valid authorization.

4. How We May Use and Disclose Your Health Information

HIPAA permits or requires us to use and disclose PHI without your written authorization in certain circumstances.

Treatment

We may use and disclose PHI to provide, coordinate, or manage your healthcare.

For example, a healthcare provider treating you through FemmeKare may disclose relevant information to another healthcare professional involved in your treatment, consultation, or referral.

Payment

We may use and disclose PHI for lawful payment-related activities.

FemmeKare is a self-pay service and does not routinely submit insurance claims for FemmeKare services.

Payment-related activities may include:

Processing payments

Confirming payment status

Addressing billing questions

Processing eligible refunds

Maintaining transaction records

Resolving payment disputes

Healthcare Operations

We may use or disclose PHI as reasonably necessary to operate our healthcare services.

Healthcare operations may include:

Quality assessment and improvement

Care coordination

Provider and workforce review

Compliance activities

Auditing

Patient support

Credentialing activities

Training where permitted by law

Business planning and administration

Fraud and abuse prevention

Legal and regulatory compliance

Where a Business Associate performs services involving PHI on our behalf, we will require appropriate protections where required by HIPAA.

5. Other Uses and Disclosures Permitted or Required by Law

HIPAA and other applicable laws permit or require PHI to be used or disclosed in certain circumstances.

Public Health Activities

We may disclose PHI for authorized public health activities, including where permitted or required for:

Preventing or controlling disease

Reporting certain diseases or health conditions

Reporting certain adverse events

Product recalls

Reporting suspected abuse, neglect, or domestic violence where permitted or required by law

Health Oversight Activities

We may disclose PHI to authorized health oversight agencies for activities such as:

Audits

Investigations

Inspections

Licensing activities

Disciplinary proceedings

Other legally authorized healthcare oversight activities

Compliance With Law

We may use or disclose PHI when federal, state, or other applicable law requires or permits us to do so.

We may also disclose information to the U.S. Department of Health and Human Services when required to demonstrate compliance with HIPAA.

Research

We may use or disclose PHI for research only when applicable HIPAA requirements and other legal requirements have been satisfied.

Depending on the circumstances, this may require:

Your written authorization

Approval or waiver by an Institutional Review Board or Privacy Board

Another legally permitted basis for the use or disclosure

Judicial and Administrative Proceedings

We may disclose PHI in connection with a judicial or administrative proceeding where permitted or required by law.

This may include disclosures made in response to a valid court order, administrative order, subpoena, discovery request, or other lawful process when applicable legal requirements have been satisfied.

Law Enforcement

We may disclose PHI for certain law-enforcement purposes where HIPAA and other applicable laws permit or require the disclosure.

Workers’ Compensation

We may disclose PHI as permitted or required by law for workers’ compensation or similar programs established by law.

Coroners, Medical Examiners, and Funeral Directors

We may disclose PHI to coroners, medical examiners, or funeral directors where permitted or required by law.

Organ, Eye, and Tissue Donation

Where applicable, we may disclose PHI to organizations involved in organ, eye, or tissue donation and transplantation as permitted by law.

Government Functions

We may disclose PHI for certain legally authorized government functions, including certain military, national-security, correctional-institution, and protective-service activities where permitted by HIPAA.

6. Substance Use Disorder Records

Certain substance use disorder records may receive additional confidentiality protections under 42 CFR Part 2.

To the extent SDKare LLC maintains PHI that is subject to 42 CFR Part 2, additional federal protections apply to those records.

Part 2-protected records generally may not be used or disclosed in civil, criminal, administrative, or legislative investigations or proceedings against you based on the content of those records unless the disclosure is permitted under applicable Part 2 requirements, such as through your written consent or qualifying legal process.

The inclusion of this section does not mean that all FemmeKare records or services are subject to 42 CFR Part 2.

7. Other Laws That Provide Greater Privacy Protection

HIPAA establishes federal requirements for health-information privacy.

Certain federal or state laws may provide greater protection for particular categories of health information, including information concerning:

Mental health

Substance use disorder treatment

Reproductive or sexual health

HIV-related information

Genetic information

Other specially protected medical information

Where an applicable law provides greater privacy protection than HIPAA, SDKare LLC will comply with the applicable more protective requirement.

8. Our Responsibilities

SDKare LLC is required by law to protect PHI and comply with applicable HIPAA requirements.

We are required to:

Maintain the privacy of PHI

Maintain appropriate safeguards to protect PHI

Provide you with this Notice explaining our legal duties and privacy practices

Follow the terms of the Notice currently in effect

Respect applicable rights described in this Notice

Notify affected individuals following a reportable breach of unsecured PHI as required by law

We will not use or disclose your PHI other than as described in this Notice or as otherwise permitted or required by law unless we obtain your written authorization.

9. Breach Notification

If a reportable breach of unsecured PHI occurs, SDKare LLC will notify affected individuals in accordance with the HIPAA Breach Notification Rule and other applicable law.

Required notices will be provided without unreasonable delay and within the timeframe required by law.

Depending on the circumstances, SDKare LLC may also be required to notify the U.S. Department of Health and Human Services, the media, or other governmental authorities.

10. Business Associates

SDKare LLC may engage third parties to perform services that require access to PHI.

Where HIPAA requires it, these entities are treated as Business Associates and are required through appropriate agreements to safeguard PHI and comply with applicable HIPAA requirements.

Examples may include service providers that support healthcare operations, technology, communications, data hosting, billing, or other functions involving PHI.

11. Electronic Communications and Telehealth

Healthcare services provided through FemmeKare may involve electronic communications and telehealth technologies.

SDKare LLC will use and disclose PHI through telehealth and electronic systems in accordance with applicable HIPAA requirements.

Patients are encouraged to:

Participate in telehealth appointments from a reasonably private location

Protect account credentials

Use personal devices and networks responsibly

Avoid allowing unauthorized individuals to view or hear healthcare communications

These recommendations do not reduce SDKare LLC’s obligations under HIPAA.

12. Changes to This Notice

SDKare LLC may change this Notice and its privacy practices as permitted by law.

We reserve the right to make a revised Notice effective for PHI we already maintain as well as PHI we create or receive after the revised Notice becomes effective.

When a material change is made, we will make the revised Notice available as required by HIPAA.

The current Notice will be available:

On the FemmeKare website

Upon request

Through other methods required by applicable law

The effective date of the current Notice appears at the top of this page.

13. Availability and Acknowledgment of This Notice

SDKare LLC will make this Notice available to individuals as required by HIPAA.

For healthcare services provided electronically, the Notice may be provided electronically in connection with the first delivery of services where permitted by law.

Where HIPAA requires a good-faith effort to obtain acknowledgment that an individual received the Notice, SDKare LLC will make that effort.

An acknowledgment confirms only that you received the Notice. It does not mean that you agreed to any additional use or disclosure of your PHI.

If you decline to provide an acknowledgment, your refusal will not prevent uses or disclosures otherwise permitted by HIPAA. Where required, the refusal or inability to obtain acknowledgment will be documented.

14. Contact Information

For questions about this Notice, your HIPAA rights, our privacy practices, or a privacy complaint, contact:

Sophie Brown

Patient Care Manager, Privacy Officer, and Security Official

SDKare LLC, operating FemmeKare

Email: sophie.brown@femmekare.com

For general FemmeKare inquiries:

FemmeKare, operated by SDKare LLC

Email: support.contact@femmekare.com

Mailing address: 2810 N Church St, Wilmington, DE, United States, 19802
Phone: (520) 800-6043

You may also file a HIPAA complaint directly with:

U.S. Department of Health and Human Services

Office for Civil Rights

200 Independence Avenue, S.W.

Washington, D.C. 20201

Phone: 1-877-696-6775

SDKare LLC will not retaliate against you for filing a complaint with SDKare LLC or the U.S. Department of Health and Human Services.