HIPAA Compliance

What is HIPAA?

The Health Insurance Portability and Accountability Act (HIPAA) of 1996 is a U.S. federal law that established national standards to protect sensitive patient health information from being disclosed without the patient's consent or knowledge. HIPAA applies to healthcare providers, health plans, healthcare clearinghouses, and business associates of these entities.

HIPAA's Privacy Rule protects the privacy of individually identifiable health information, while the Security Rule sets standards for the security of electronic protected health information (ePHI).

Our Commitment to HIPAA Compliance

EveCare Health Inc. ("EveCare", "we", "us", or "our") is committed to maintaining the highest standards of data protection and privacy for all health information collected through our Application. While we operate globally and may not be directly subject to HIPAA regulations in all jurisdictions, we voluntarily implement HIPAA-compliant practices to ensure the security and privacy of your health data.

We understand the sensitive nature of health information and have implemented comprehensive administrative, physical, and technical safeguards to protect your Protected Health Information (PHI) in accordance with HIPAA standards.

Protected Health Information (PHI)

Protected Health Information (PHI) refers to any information about health status, provision of health care, or payment for health care that can be linked to a specific individual. In the context of EveCare, PHI includes but is not limited to:

• Menstrual cycle data and tracking information
• Health symptoms and conditions
• Body measurements (weight, height, body temperature, blood pressure, blood sugar levels)
• Medical history and health-related activities
• Any other health information you choose to provide through the Application

We treat all health-related data you provide as Protected Health Information and apply the same rigorous security and privacy standards regardless of your location.

Administrative Safeguards

We have implemented comprehensive administrative safeguards to ensure HIPAA compliance:

• Security Management Process: We conduct regular risk assessments and implement security measures to reduce risks and vulnerabilities to PHI.
• Workforce Security: All employees and contractors with access to PHI undergo background checks and receive HIPAA training.
• Information Access Management: Access to PHI is restricted to authorized personnel only, based on their job functions and responsibilities.
• Workforce Training: All team members receive regular training on HIPAA requirements and our privacy policies.
• Security Incident Procedures: We have established procedures to identify, respond to, and mitigate security incidents.
• Contingency Plan: We maintain backup and disaster recovery procedures to ensure continuity of operations and protection of PHI.
• Business Associate Agreements: We enter into written agreements with all third-party service providers who may have access to PHI, ensuring they maintain the same level of protection.

Physical Safeguards

Physical safeguards protect electronic information systems and related equipment from unauthorized physical access:

• Facility Access Controls: Our data centers and facilities have restricted access with appropriate security measures.
• Workstation Security: Workstations that access PHI are secured and located in controlled environments.
• Device Controls: We implement controls to prevent unauthorized removal of devices containing PHI.
• Media Controls: All media containing PHI is securely stored, transported, and disposed of according to established procedures.

Technical Safeguards

Technical safeguards protect PHI through technology and policies:

• Access Control: We use unique user identification, authentication, and encryption to control access to PHI.
• Audit Controls: We maintain audit logs to track access to PHI and detect unauthorized access attempts.
• Integrity Controls: We implement measures to ensure PHI is not improperly altered or destroyed.
• Transmission Security: We encrypt PHI during transmission over electronic networks to prevent unauthorized access.
• Encryption: PHI is encrypted both in transit and at rest using industry-standard encryption protocols.

Your Rights Under HIPAA

As a user of EveCare, you have the following rights regarding your Protected Health Information:

Right to Access

You have the right to access and obtain a copy of your PHI maintained by EveCare. You can access your data directly through the Application, or request a copy by contacting us at support@evecarehealth.com.

Right to Amendment

You have the right to request amendments to your PHI if you believe it is inaccurate or incomplete. You can update most information directly through the Application, or contact us to request changes.

Right to Accounting of Disclosures

You have the right to receive an accounting of certain disclosures of your PHI made by EveCare. This includes disclosures made for purposes other than treatment, payment, healthcare operations, or as required by law.

Right to Request Restrictions

You have the right to request restrictions on how we use or disclose your PHI. While we will consider all requests, we are not required to agree to all restrictions.

Right to Request Confidential Communications

You have the right to request that we communicate with you about your PHI in a certain way or at a certain location.

Right to File a Complaint

If you believe your privacy rights have been violated, you have the right to file a complaint with us or with the appropriate regulatory authority. We will not retaliate against you for filing a complaint.

Breach Notification

In the unlikely event of a breach of unsecured PHI, we will notify affected individuals without unreasonable delay and in no case later than 60 days after discovery of the breach. Notifications will include:

• A description of what happened
• The types of information involved
• Steps you should take to protect yourself
• What we are doing to investigate the breach, mitigate harm, and prevent further breaches
• Contact information for questions

We will also notify the appropriate regulatory authorities as required by law.

Business Associate Agreements

When we work with third-party service providers who may have access to PHI (such as cloud hosting providers, analytics services, or payment processors), we enter into Business Associate Agreements (BAAs) that require them to:

• Maintain the same level of privacy and security protections
• Use PHI only for specified purposes
• Report any breaches or security incidents
• Return or destroy PHI when the relationship ends

Compliance Monitoring and Audits

We regularly review and update our HIPAA compliance program to ensure ongoing adherence to privacy and security standards. This includes:

• Regular risk assessments and security audits
• Ongoing employee training and education
• Review and update of policies and procedures
• Monitoring of access logs and security events
• Regular testing of our security measures

Data Retention and Deletion

We retain your PHI only for as long as necessary to provide our services and as required by law. When you delete your account or request deletion of your data, we will securely delete or de-identify your PHI in accordance with our data retention policies and applicable legal requirements.

International Data Transfers

As EveCare operates globally, your PHI may be transferred to and stored in locations outside your country of residence. We ensure that all such transfers comply with applicable data protection laws and that appropriate safeguards are in place to protect your PHI, regardless of where it is stored or processed.