Notice of Privacy Practices
This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.
Our pledge regarding your protected health information
Canary Health ("Canary", "we") is committed to protecting the privacy of your protected health information (PHI). PHI includes any information we collect, hold, or transmit about your past, present, or future physical or mental health, the health care you receive through us, or the payment for that care, when that information is reasonably linkable to you. This Notice tells you how we may use and disclose your PHI, our obligations regarding the use and disclosure of PHI, and your rights regarding your PHI.
Uses and disclosures of PHI
For treatment
We may disclose your PHI to inspectors who provide environmental testing services to you, and to licensed providers in our network who review your health questionnaire and sign Letters of Medical Necessity (LMNs) for HSA/FSA reimbursement. Inspectors receive only the minimum necessary information to complete the inspection (see Privacy Policy for the field-by-field breakdown). Providers receive only the questionnaire and the booking context relevant to their LMN review.
For payment
We may use and disclose your PHI to bill and collect payment for the services you receive through Canary. This includes generating receipts and supporting documentation for HSA and FSA plan administrators in compliance with IRS Publication 502.
For health care operations
We may use and disclose your PHI for our health care operations, including improving the quality of services, evaluating inspector performance, and conducting compliance audits. Audit access is logged in our tamper-evident audit log.
Required by law
We may use or disclose your PHI when required to do so by federal, state, or local law, including in response to a court order, warrant, or subpoena where mandated. When the law permits us to notify you first, we will.
Public health activities
We may disclose PHI for public health activities authorized by law, including reporting elevated lead exposure, reportable environmental conditions, or threats to public safety.
Health oversight activities
We may disclose PHI to a health oversight agency for activities such as audits, investigations, or inspections authorized by law.
Business associates
Some functions of our service are performed by third-party business associates (cloud storage provider, email vendor, SMS vendor, lab partners). We require each such business associate to sign a Business Associate Agreement (BAA) committing them to the same standards of confidentiality, integrity, and availability described in this Notice.
Uses and disclosures requiring your written authorization
Other uses and disclosures of your PHI not covered by this Notice require your written authorization, including:
- Most uses and disclosures of psychotherapy notes (we do not currently collect or store these).
- Uses and disclosures for marketing purposes.
- Sale of your PHI to a third party (we do not sell PHI under any circumstance).
- Disclosures to your employer or insurer for purposes other than payment or care coordination you've explicitly opted into.
You may revoke an authorization in writing at any time. Once revoked, we will not use or disclose your PHI for the previously authorized purpose, except where we have already taken action in reliance on the authorization.
Your rights regarding your PHI
Right to inspect and copy
You have the right to inspect and obtain a copy of the PHI we maintain about you. You can do this in one tap from the mobile app (Account → Download my data) or by email request. We will respond within 30 days. Some specialized records (psychotherapy notes, information compiled for legal proceedings) are excluded by law.
Right to request amendment
If you believe PHI we hold is inaccurate or incomplete, you have the right to request an amendment. We may deny the request if the information is accurate or if we did not create it, in which case we will explain in writing and you may submit a statement of disagreement that becomes part of your record.
Right to an accounting of disclosures
You have the right to a list of PHI disclosures we have made for purposes other than treatment, payment, health care operations, or as authorized by you. The accounting is available for the six years preceding your request and can be pulled from the mobile app at any time.
Right to request restrictions
You have the right to request a restriction on certain uses and disclosures of your PHI. We will consider your request and let you know whether we can accommodate it. We are required to accommodate a request to restrict disclosure to a health plan for a service you paid for in full out of pocket.
Right to request confidential communications
You have the right to request that we communicate with you about your PHI by alternative means or at alternative locations (e.g. a different phone number, or postal mail rather than email). We will accommodate reasonable requests.
Right to a paper copy of this Notice
You have the right to a paper copy of this Notice on request, even if you have agreed to receive the Notice electronically.
Right to be notified of a breach
You have the right to be notified following a breach of unsecured PHI. We will notify you in writing within 60 days of discovery of the breach.
Changes to this Notice
We reserve the right to change the terms of this Notice. We will post the revised Notice in the app and on this page at least 30 days before it takes effect, and we will prompt you to acknowledge the new version on your next sign-in. The version date at the top of this page tracks every revision.
Complaints
If you believe your privacy rights have been violated, you may file a complaint with our Privacy Officer at privacy@canary.health and / or with the U.S. Department of Health and Human Services Office for Civil Rights. You will not be retaliated against for filing a complaint.
Contact
Privacy Officer: privacy@canary.health
Mailing address: Canary Health, c/o Steps Ventures, [TO BE COMPLETED BEFORE PUBLISH]