HIPAA Notice of Privacy Practices

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

This Notice describes how we may use and disclose PHI about you, and your rights with respect to that information. Avellum is required by law to maintain the privacy of your PHI, to provide you with this Notice, to notify you following a breach of your unsecured PHI, and to abide by the terms of the Notice currently in effect.

Avellum sells prescription peptide protocols online, and will sell a laboratory blood panel. It is not a pharmacy, it does not employ the clinicians who evaluate you, and it does not dispense medication. The medical intake, the telehealth visit, prescribing and patient support are run by our telehealth partner under our name, and that partner keeps the visit record. Prescriptions are filled by Precision Pharma (Precision Pharma Corp, NPI 1770389629) in the states it is licensed in, and by a partner pharmacy network elsewhere. Which pharmacy fills your order depends on where you live and on which product was prescribed.

This Notice covers the information Avellum itself holds, which includes your account and contact details, the health goals you tell us, your order and subscription records, the outcome the partner reports back to us, what you write to the assistant in your signed-in account, and anything you send our Privacy Officer. It does not cover the records the partner and the pharmacies keep about you. They carry their own obligations under HIPAA and give their own notices, which this one does not replace.

1. Uses and disclosures that do not require your written authorization

HIPAA allows us to use and disclose your PHI without your written authorization for the following purposes:

• Treatment. To provide, coordinate, or manage your care with the clinicians who evaluate you, our telehealth partner, the dispensing pharmacy, and any other health care provider involved in your care. Example: when you order a blood panel, we send the pharmacy that packs and ships your collection kit what it needs to get the box to you, including the recipient name and address, which kit to pack, our own order reference, and whether a prescription order is also on its way to the same person. No diagnosis, dose, laboratory marker or result goes with it.
• Payment. To arrange and account for payment for what you buy here, and to give a payment processor what it needs to take a charge. Avellum does not charge you for medication. our telehealth partner takes that payment on its own processor, on completion of the medical intake, before clinician review, and bills again every 28 days; we never see or hold your card number, and the partner’s terms govern that charge. A blood panel, once it goes on sale, is charged separately here at checkout, with Valdura rather than Avellum as the merchant of record, so someone buying both enters a card twice with two different merchants. The company charging you for the panel is named on the payment page. The processor handling that panel charge receives what it needs to take the payment, send you a receipt and get the kit to you, including your email address, the amount, a plain product name, our own order and patient references, and the name and shipping address you type on its payment page. We read that name and address back from it so the kit can reach you. No diagnosis, dose, laboratory marker or result goes to it.
• Health care operations. To run our internal operations, including quality review, training, vendor management, audits, and security. Example: our internal admin console requires a sign-in, is restricted to named staff accounts holding an administrator role, and writes what a member of staff opens there to an audit log that records who looked, at what, and when.
• Service providers under a business associate agreement. To the vendors that run our systems and fulfill what you buy, including application hosting, our database, the service that sends our email, the workspace that runs our mailboxes, the AI provider behind the assistant in your account, and the pharmacy that packs and ships your collection kit. Where a vendor handles PHI on our behalf, it does so under a business associate agreement, held by Avellum or by an affiliated company on our behalf, that obliges it to protect your PHI and limits what it may do with it.
• Payment processors. A payment processor is not a business associate, and ours has not signed a business associate agreement. HIPAA does not ask it to: 45 CFR §164.502(e)(1)(ii) treats a payment transaction as outside that requirement. What it gets is what is described under “Payment” above, which is what it needs to take the charge, send you a receipt and get your kit to you.
• Public health activities. To report disease, injury, vital events, and product safety issues to a public health authority that is authorized by law to collect the information.
• Victims of abuse, neglect, or domestic violence. To report to a government authority authorized by law to receive such reports, when we reasonably believe you have been a victim and the disclosure is required or permitted by law.
• Health oversight activities. To a health oversight agency conducting an audit, investigation, inspection, licensure proceeding, or other oversight activity authorized by law.
• Judicial and administrative proceedings. In response to a court or administrative order, a subpoena, or other lawful process, where the conditions set by HIPAA are met, including, in some cases, notice to you or a qualified protective order.
• Law enforcement purposes. In response to a lawful court order or process, to identify or locate a suspect, in connection with certain crime victims, or when otherwise required or permitted by law.
• To avert a serious threat to health or safety. When necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public, and the disclosure is to a person reasonably able to prevent or lessen the threat.
• Specialized government functions. For military and veterans activities, national security and intelligence, protective services for the President, and other functions specified in 45 CFR §164.512(k).
• Workers’ compensation. To comply with workers’ compensation laws and other similar programs that provide benefits for work-related injuries.
• Decedents. To coroners, medical examiners, and funeral directors, as necessary to carry out their duties.
• Organ and tissue donation. To organizations involved in procurement, banking, or transplantation of organs or tissue, as permitted by law.
• Research. Subject to approval by an Institutional Review Board or Privacy Board, where required by HIPAA. We do not currently disclose PHI for research.
• As required by law. For any other use or disclosure required by federal, state, or local law.

Some visitors reach this site through Amway, and an Amway account can unlock discounted pricing. Your health information is not part of that. When we check whether an account qualifies, what goes out is an obscured account reference, and what comes back is that account’s standing, meaning whether it is active and whether it carries a membership, along with Amway’s own reference for the account and the time it answered. No order, no prescription and nothing about your care crosses that line in either direction.

We may contact you about refills and about the care you have already bought, about other products and services we offer, and about health-related benefits and services from companies we work with. You can tell us to stop at any time: change your contact preference in your account, or write to the contact in Section 10.

2. Uses and disclosures that require your written authorization

Other uses and disclosures of your PHI will be made only with your written HIPAA authorization. In particular, we will not use or disclose your PHI for the following purposes without your authorization:

• Most uses and disclosures of psychotherapy notes, where any exist.
• Marketing communications that meet HIPAA’s definition of “marketing,” other than the limited categories that HIPAA permits without authorization, such as treatment-coordination messages, certain refill reminders, and face-to-face communications.
• Sale of your PHI. We will never sell your PHI.
• Any other use or disclosure not described in Section 1 or otherwise permitted by law.

If you give us a written authorization, you may revoke it at any time by sending a written revocation to the contact in Section 10. The revocation will not apply to uses or disclosures we have already made in reliance on the authorization.

3. How to provide or revoke a HIPAA authorization

To provide a HIPAA authorization, for example to direct us to send your PHI to a family member, another provider, or an attorney, email us at privacy@avellumhealth.com with the subject “HIPAA Authorization,” or write to our Privacy Officer at the postal address in Section 10. We will send back what your authorization has to contain: what information is to be disclosed, who is to receive it, the purpose, an expiry, and your signature and the date.

To revoke an authorization you have already given, send us a written revocation. Email it to the same mailbox, or post it to Avellum Health Co LLC, Attn: Privacy Officer, 4736 Pebble Bay Cir, Indian River Shores, FL 32963. Either one is a writing for this purpose.

4. Family members and friends involved in your care

Unless you object, we may disclose PHI relevant to a person’s involvement in your care or payment for your care to a family member, other relative, close personal friend, or other person you identify. If you are not present, or are incapacitated, we will use our professional judgment about whether the disclosure is in your best interest, consistent with HIPAA.

5. Breach notification

If a breach of your unsecured PHI occurs, we will notify you without unreasonable delay and in no case later than 60 calendar days after discovery of the breach, as required by HIPAA Subpart D. The notification will include a description of what happened, the types of PHI involved, the steps you should take to protect yourself, what we are doing to investigate and mitigate, and how to contact us with questions.

6. Changes to this Notice

We reserve the right to change this Notice and to make the new Notice effective for all PHI we maintain about you, including PHI we created or received before the change. When we make a material change, we will post the updated Notice on avellumhealth.com and update the “Last updated” date at the top of this document. You may also request a paper copy of the most current Notice at any time, by email or by post, using the contact in Section 10.

7. Your rights under HIPAA

With respect to your PHI, you have the following rights. To exercise any of them, contact us using Section 10. We may require you to make the request in writing and to verify your identity.

• Right to access and obtain a copy. You have the right to inspect and obtain a copy of the PHI we maintain about you, in the form and format you request if we can readily produce it that way, including an electronic copy if we maintain the record electronically. We work to the deadline HIPAA sets, which is 30 days from your request with a single 30-day extension where one is needed, and we do not charge you for the copy. Some of your records, including the record of your telehealth visit, are held by the clinical practice that treated you. Write to us and we will route your request to whoever holds the record.
• Right to amend. You have the right to ask us to amend PHI we maintain about you, if you believe it is incorrect or incomplete. We may deny your request in limited circumstances permitted by HIPAA; you will receive a written denial explaining why and your right to submit a disagreement statement.
• Right to an accounting of disclosures. You have the right to receive a list of disclosures we have made of your PHI for purposes other than treatment, payment, health care operations, disclosures you authorized, and certain other exceptions, going back up to six years before the date of the request.
• Right to request restrictions. You have the right to ask us to restrict certain uses and disclosures of your PHI. We are not required to agree, except in one situation: if you paid out of pocket and in full for a specific item or service, and you ask us to restrict disclosure to your health plan for payment or health care operations, we will agree, because HIPAA requires it. Everything sold here is paid out of pocket and we do not bill health plans, so no disclosure of that kind happens in the ordinary course. Where we agree to a restriction, we stop using the information for the restricted purpose; we still keep it for the period set by our retention schedule and by the law that applies to it.
• Right to confidential communications. You have the right to request that we communicate with you about your PHI in a specific way or at a specific location, for example by mail to a different address. We will accommodate reasonable requests.
• Right to a paper copy of this Notice. You have the right to a paper copy of this Notice on request, even if you have agreed to receive it electronically. Ask by email or by post using Section 10 and we will mail one to you.
• Right to be notified of a breach. You have the right to be notified following a breach of your unsecured PHI, as described in Section 5.
• Right to file a complaint. You have the right to file a complaint with us, under Section 9, or with the U.S. Department of Health and Human Services. We will not retaliate against you for filing a complaint.

8. How to exercise your rights

Email us at privacy@avellumhealth.com, write to our Privacy Officer at the postal address in Section 10, or telephone the number there. All three reach the same person. We respond within the time periods required by applicable law, which for HIPAA access requests is generally 30 days, with an extension possible. To prevent misuse, we may need to verify your identity before processing a request. Anyone acting as an authorized agent for someone else must provide written proof of authority.

9. Filing a complaint

If you believe your privacy rights have been violated, you may file a complaint with us by contacting our Privacy Officer under Section 10. You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1-877-696-6775, or visiting hhs.gov/ocr/privacy/hipaa/complaints. We will not retaliate against you for filing a complaint.

10. Contact us

HIPAA requests, complaints, revocations, and any other matter described in this Notice go to our Privacy Officer, by email at privacy@avellumhealth.com, by telephone at (689) 220-7908, or by post at the address below.

That line and that mailbox are for privacy and legal matters. An order, a shipment, a delivery problem or a clinical question goes to support@avellumhealth.com, which reaches the care team that runs your care and can act on it. Anything about your health information, your records, an authorization, or this Notice comes to the Privacy Officer above.