HIPAA Privacy and Security Policy

1. Introduction and Commitment to Patient Privacy

SDKare LLC (“SDKare,” “Company,” “we,” “us,” or “our”) recognizes the importance of protecting the privacy, confidentiality, integrity, and security of patient health information.

As a telehealth healthcare organization, SDKare is committed to handling protected health information responsibly and complying with applicable provisions of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the Health Information Technology for Economic and Clinical Health Act (HITECH Act), and other relevant federal and state privacy and security laws.

This HIPAA Privacy and Security Policy describes the principles and requirements governing:

• The collection, use, and disclosure of protected health information.
• Confidentiality and patient privacy protections.
• Administrative, physical, and technical security safeguards.
• Access to healthcare records.
• Workforce responsibilities and training.
• Business associate relationships.
• Security risk assessment and management.
• Patient privacy rights.
• Security incident and breach response.
• Privacy complaints and enforcement.
• Privacy and security governance.

SDKare recognizes that privacy and security protections are fundamental to maintaining patient trust and supporting responsible healthcare delivery.

This Policy supplements, but does not replace, SDKare’s HIPAA Notice of Privacy Practices, which provides patients with the legally required notice of applicable uses, disclosures, rights, and organizational duties.

2. Scope and Applicability

This Policy applies to the handling of protected health information by SDKare and individuals or organizations acting on its behalf, to the extent required by applicable law.

Relevant activities may include:

• Telehealth consultations.
• Patient registration and identification.
• Appointment scheduling.
• Medical evaluations and treatment.
• Mental and behavioral healthcare.
• Online therapy and counseling.
• Prescription and medication management.
• Laboratory and diagnostic coordination.
• Medical record maintenance.
• Payment and billing administration.
• Patient Support communications.
• Healthcare operations.
• Authorized information exchanges with third parties.

This Policy applies to information in electronic, paper, and oral forms when such information constitutes PHI under HIPAA.

The HIPAA Security Rule specifically governs electronic protected health information, referred to as ePHI.

Additional federal or state confidentiality protections may apply to certain categories of sensitive health information.

3. Definitions

For purposes of this Policy:

Protected Health Information (PHI): Individually identifiable health information maintained or transmitted by a HIPAA-regulated entity in a covered capacity, subject to applicable exclusions.

Electronic Protected Health Information (ePHI): PHI created, received, maintained, or transmitted electronically.

Covered Entity: A health plan, healthcare clearinghouse, or healthcare provider that meets the applicable HIPAA definition.

Business Associate: A person or organization that performs qualifying services or activities involving PHI on behalf of a HIPAA-covered entity or another business associate.

Workforce: Employees, trainees, volunteers, and other persons whose work is under the direct control of SDKare, whether or not they are paid.

Patient or Individual: A person whose information is subject to applicable privacy protections.

Privacy Officer: The designated individual responsible for developing and implementing privacy-related policies and procedures.

Security Official: The designated individual responsible for developing and implementing policies and procedures required by the HIPAA Security Rule.

Breach: An acquisition, access, use, or disclosure of PHI that meets the applicable legal definition of a breach after consideration of relevant exceptions and required assessments.

4. HIPAA Privacy Principles

SDKare is committed to observing the following privacy principles:

• Using and disclosing PHI only when authorized, permitted, or required by applicable law.
• Protecting confidential healthcare information from unauthorized access or disclosure.
• Restricting access based on appropriate workforce responsibilities.
• Honoring applicable patient privacy rights.
• Maintaining appropriate safeguards for health information.
• Limiting uses and disclosures where the minimum necessary standard applies.
• Addressing privacy complaints and suspected violations appropriately.
• Maintaining the documentation, policies, and procedures required by law.

Patient information must not be accessed, used, or disclosed merely out of curiosity, personal interest, or for an unauthorized purpose.

5. Collection and Maintenance of Health Information

SDKare and authorized healthcare providers may collect and maintain information reasonably necessary for providing healthcare and administering related services.

Depending on the patient’s circumstances and requested care, information may include:

• Personal identification and contact details.
• Medical history.
• Health conditions and symptoms.
• Diagnoses.
• Medication and prescription records.
• Allergies and adverse reactions.
• Mental and behavioral health information.
• Clinical examination and consultation notes.
• Laboratory results and diagnostic reports.
• Treatment plans and follow-up recommendations.
• Appointment and healthcare administration records.
• Billing and payment information related to healthcare services.
• Information received from authorized healthcare providers or other legally permitted sources.

The collection and maintenance of such information must comply with applicable privacy, clinical, and recordkeeping requirements.

6. Permitted Uses and Disclosures of PHI

HIPAA permits certain uses and disclosures of PHI without an individual’s separate written authorization, while other uses and disclosures require authorization or another valid legal basis.

6.1 Treatment

PHI may be used or disclosed to support treatment and related healthcare activities, as permitted by law.

Examples include:

• Clinical evaluations.
• Medical consultations.
• Medication management.
• Coordination with other treating healthcare professionals.
• Referrals and follow-up care.
• Relevant diagnostic or laboratory services.

6.2 Payment

PHI may be used or disclosed for legally permitted payment-related activities, including:

• Processing healthcare payments.
• Maintaining billing records.
• Resolving payment discrepancies.
• Reviewing billing or payment disputes.
• Other payment activities permitted by HIPAA.

SDKare operates on a self-pay basis and does not bill insurance on patients’ behalf.

6.3 Healthcare Operations

PHI may be used or disclosed for legally permitted healthcare operations, which may include:

• Quality assessment and improvement.
• Workforce training.
• Credentialing and professional review.
• Compliance activities.
• Administrative management.
• Evaluating healthcare delivery processes.
• Other activities meeting HIPAA’s definition of healthcare operations.

6.4 Uses and Disclosures Required or Permitted by Law

PHI may also be used or disclosed under specific legal conditions, including certain:

• Public health activities.
• Health oversight activities.
• Judicial and administrative proceedings.
• Law enforcement circumstances.
• Mandatory reporting obligations.
• Activities involving serious threats to health or safety.
• Other disclosures permitted or required under applicable law.

Such disclosures must meet the relevant legal requirements.

6.5 Uses Requiring Authorization

When HIPAA or another applicable law requires written authorization, SDKare or the responsible regulated entity must obtain the required authorization before making the use or disclosure.

Examples may include certain marketing activities, most uses and disclosures of psychotherapy notes, and certain other disclosures that do not fall within an applicable legal permission or exception.

7. Minimum Necessary Standard

SDKare applies the HIPAA minimum necessary standard where legally required.

Under this standard, reasonable efforts must be made to limit the use, disclosure, and requested amount of PHI to the minimum necessary to accomplish the intended permitted purpose.

Examples of measures supporting this principle may include:

• Role-based access permissions.
• Limiting access to relevant categories of information.
• Restricting administrative access to information needed for assigned duties.
• Reviewing requests for PHI when required.
• Applying appropriate disclosure procedures.

The minimum necessary standard does not apply to all uses and disclosures.

For example, qualifying disclosures to healthcare providers for treatment are generally exempt from this standard.

SDKare will apply the requirements and exceptions established by HIPAA.

8. Privacy and Security Governance

SDKare designates responsible personnel to oversee privacy and information security compliance.

8.1 Privacy Officer

Sophie Brown serves as SDKare LLC’s designated Privacy Officer.

The Privacy Officer’s responsibilities include overseeing the development and implementation of applicable privacy policies and procedures.

These responsibilities include:

• Supporting compliance with HIPAA Privacy Rule requirements.
• Overseeing privacy-related procedures.
• Coordinating the review of privacy complaints.
• Supporting workforce privacy training.
• Reviewing suspected improper uses or disclosures of PHI.
• Coordinating responses to eligible patient privacy requests.
• Supporting legally required documentation and compliance activities.
• Coordinating with relevant personnel concerning privacy risks.

8.2 Security Official

Sophie Brown also serves as SDKare LLC’s designated Security Official.

The Security Official is responsible for overseeing the development and implementation of policies and procedures required by the HIPAA Security Rule.

Responsibilities include:

• Coordinating security risk analysis.
• Supporting risk-management decisions.
• Overseeing appropriate security policies and safeguards.
• Coordinating security incident response.
• Supporting workforce security awareness and training.
• Reviewing identified information security risks.
• Monitoring the need for security assessments and corrective actions.
• Coordinating with relevant technology and service providers.

8.3 Organizational Accountability

Designation of a Privacy Officer or Security Official does not eliminate the responsibilities of other workforce members, authorized providers, or regulated service providers.

All individuals handling PHI must comply with the legal requirements applicable to their roles.

9. Administrative Security Safeguards

SDKare is responsible for establishing and maintaining reasonable and appropriate administrative safeguards where the HIPAA Security Rule applies.

Administrative safeguards include policies and procedures designed to manage the selection, development, implementation, and maintenance of security measures protecting ePHI.

Relevant requirements include:

9.1 Security Management

SDKare must maintain an appropriate security management process, including risk analysis, risk management, and other measures required by law.

9.2 Workforce Security

Access to ePHI must be appropriately authorized and managed based on workforce responsibilities.

Processes must address access authorization, supervision, and the modification or removal of access when appropriate.

9.3 Information Access Management

Access to ePHI must be limited according to applicable security requirements and legitimate workforce needs.

9.4 Security Awareness and Training

Workforce members must receive appropriate security awareness and training in accordance with applicable legal requirements and organizational policies.

9.5 Security Incident Procedures

SDKare must maintain procedures for identifying, reporting, responding to, and documenting security incidents.

9.6 Contingency Planning

Appropriate contingency planning must address relevant risks to the availability and restoration of electronic information systems supporting ePHI.

9.7 Security Evaluation

Security measures must be evaluated periodically and when relevant environmental or operational changes affect the protection of ePHI.

10. Security Risk Analysis and Risk Management

SDKare recognizes that security risk analysis is a foundational requirement of the HIPAA Security Rule.

10.1 Risk Analysis Commitment

SDKare will maintain a process for performing and documenting accurate and thorough assessments of potential risks and vulnerabilities affecting the confidentiality, integrity, and availability of ePHI, as required by applicable law.

The risk analysis should consider relevant systems, technology, workflows, information access, and third-party relationships within the applicable scope.

10.2 Risk Management

Identified risks must be evaluated and addressed through reasonable and appropriate security measures consistent with applicable legal requirements.

Risk-management activities may include:

• Assessing the likelihood and potential impact of identified threats.
• Identifying vulnerabilities.
• Determining appropriate safeguards.
• Assigning responsibility for corrective measures.
• Reviewing the implementation of required protections.
• Reassessing risks when circumstances materially change.

10.3 Ongoing Review

Security risk analysis is not a one-time activity.

SDKare must reassess risks as appropriate when changes in technology, business processes, vendors, systems, or other relevant conditions affect ePHI security.

10.4 Documentation

SDKare must maintain risk-analysis and risk-management documentation as required by the HIPAA Security Rule.

This public Policy does not disclose confidential details concerning internal system vulnerabilities or protective configurations.

11. Physical Security Safeguards

SDKare must implement reasonable and appropriate physical safeguards for systems and locations where ePHI is accessed, processed, stored, or maintained.

Such safeguards may address:

• Physical access to facilities or equipment.
• Workstation placement and use.
• Protection of devices used to access ePHI.
• Storage of electronic media.
• Device and media disposal.
• Reuse of equipment containing sensitive information.
• Prevention of unauthorized viewing or access.

Safeguards must reflect applicable HIPAA requirements and the specific risks associated with SDKare’s operations.

Remote work and telehealth delivery do not eliminate the need for appropriate physical protections.

12. Technical Security Safeguards

SDKare must implement technical safeguards appropriate to its systems and the requirements of the HIPAA Security Rule.

These safeguards address the protection of ePHI maintained or transmitted electronically.

12.1 Access Controls

Systems containing ePHI must have appropriate mechanisms for controlling authorized access.

Applicable requirements may include unique user identification and other access-control capabilities.

12.2 Authentication

Appropriate authentication measures must be maintained to verify that persons or entities seeking access to ePHI are authorized.

12.3 Audit Controls

Systems containing or using ePHI must support applicable mechanisms for recording and examining relevant activity.

12.4 Integrity Controls

Appropriate mechanisms must protect ePHI against improper alteration or destruction.

12.5 Transmission Security

Electronic transmission of ePHI must be protected according to applicable HIPAA requirements.

Safeguards may involve encryption or other appropriate measures based on applicable standards, risk assessments, and legal requirements.

12.6 Security Monitoring and Maintenance

Security measures must be reviewed and maintained as necessary to address relevant risks and changing operational conditions.

This section describes SDKare’s security obligations and does not constitute a representation that any particular unverified technology or configuration has already been deployed.

13. Telehealth Privacy and Security

SDKare provides healthcare services through electronic communications and recognizes the additional privacy and security considerations associated with remote healthcare delivery.

Appropriate safeguards must apply to telehealth systems and related handling of PHI.

13.1 Telehealth Platforms

Platforms and vendors involved in handling PHI must be assessed for applicable privacy and security obligations.

Where a third-party service provider qualifies as a business associate, an appropriate Business Associate Agreement must be in place as required.

13.2 Patient Privacy

Patients are encouraged to attend consultations from private locations whenever possible.

Patients should take reasonable steps to reduce unnecessary exposure of confidential information during their consultations.

13.3 Provider and Workforce Responsibilities

Providers and workforce members must use authorized systems and handle patient information according to applicable privacy and security requirements.

13.4 Technical Interruptions

If a telehealth consultation is interrupted, any subsequent communication or handling of patient information must continue to comply with applicable confidentiality requirements.

13.5 Recording of Consultations

Any recording of a telehealth consultation must comply with applicable federal and state law, relevant organizational procedures, and any required patient consent or authorization.

Patients should not assume that consultations are routinely recorded.

14. Workforce Confidentiality, Access, and Training

SDKare workforce members who handle PHI are responsible for maintaining confidentiality and following applicable privacy and security procedures.

14.1 Authorized Access

Workforce access must be limited to legitimate and authorized duties.

Personnel may not access patient records for personal interest or unrelated purposes.

14.2 Training

Appropriate privacy and security training must be provided as required by applicable HIPAA provisions.

Training should address relevant workforce responsibilities, including:

• Confidential information handling.
• Appropriate uses and disclosures of PHI.
• Access restrictions.
• Recognition and reporting of security incidents.
• Handling of patient privacy requests.
• Applicable safeguards for electronic communications.

14.3 Reporting Concerns

Workforce members must follow established reporting procedures for suspected privacy violations, unauthorized access, or security incidents.

14.4 Violations and Sanctions

SDKare must maintain and apply appropriate sanctions for workforce noncompliance with applicable privacy and security policies, subject to law.

SDKare prohibits retaliation against individuals for making reports or complaints protected by law.

15. Business Associates and Third-Party Service Providers

SDKare may engage external organizations to perform authorized administrative, technical, payment-related, or healthcare support functions.

When such organizations qualify as HIPAA business associates, SDKare must obtain the legally required written assurances concerning appropriate uses, disclosures, and safeguards for PHI.

15.1 Business Associate Agreements

Applicable Business Associate Agreements must address the responsibilities required by HIPAA, including appropriate safeguards and reporting obligations.

15.2 Permitted Information Sharing

PHI may be shared with service providers only as permitted by applicable law and relevant contractual arrangements.

15.3 Third-Party Security Responsibilities

Business associates and their qualifying subcontractors are responsible for applicable HIPAA obligations.

SDKare must address its own legal responsibilities for selecting, contracting with, and overseeing service arrangements.

15.4 Vendor Incidents

Where a business associate identifies a relevant breach or security incident, reporting and response obligations are governed by applicable law and contractual requirements.

16. Patient Rights Regarding Protected Health Information

Patients have rights regarding their PHI under the HIPAA Privacy Rule, subject to applicable conditions and exceptions.

16.1 Access to Records

Patients may request access to qualifying medical and billing records maintained in designated record sets.

Eligible access requests must be handled according to applicable HIPAA procedures and deadlines.

16.2 Requests for Amendments

Patients may request amendments to PHI that they believe is inaccurate or incomplete.

Requests will be evaluated under the applicable legal requirements.

16.3 Confidential Communications

Patients may request confidential communications using an alternative method or location.

Reasonable requests will be accommodated when required by HIPAA.

16.4 Requests for Restrictions

Patients may request limitations on certain uses or disclosures of their PHI.

Some requests may be declined where permitted by law.

Certain restrictions, including qualifying requests involving disclosures to health plans for services paid in full out of pocket, must be honored where the applicable legal conditions are met.

16.5 Accounting of Disclosures

Patients may request an accounting of certain disclosures of PHI, subject to applicable statutory and regulatory exceptions.

16.6 Copies of Privacy Notices

Patients may obtain a copy of SDKare’s applicable HIPAA Notice of Privacy Practices.

16.7 Complaints

Patients may file privacy complaints with SDKare or the U.S. Department of Health and Human Services Office for Civil Rights.

SDKare will not retaliate against individuals for exercising legally protected rights.

17. Identity and Authority Verification

SDKare must take reasonable steps, as required by HIPAA, to verify the identity and authority of persons requesting access to PHI or acting on behalf of patients.

Verification may apply to:

• Medical record access requests.
• Requests submitted by personal representatives.
• Requests for disclosures to third parties.
• Requests for amendments or other privacy-related actions.
• Other circumstances requiring identity or authority confirmation.

The method of verification must be appropriate to the circumstances and consistent with applicable law.

SDKare should not request unnecessary sensitive information or impose unreasonable barriers to legitimate patient rights.

18. Specially Protected Health Information

Certain categories of health information may be subject to confidentiality protections beyond the general HIPAA requirements.

18.1 Mental and Behavioral Health Information

Mental and behavioral health information is protected under applicable privacy laws.

Certain records may be subject to additional confidentiality requirements depending on their content, source, and applicable law.

18.2 Psychotherapy Notes

Psychotherapy notes, as specifically defined by HIPAA, generally receive additional protection.

Most uses and disclosures of psychotherapy notes require a valid authorization unless an applicable HIPAA exception permits otherwise.

Ordinary treatment records and general progress notes do not automatically qualify as psychotherapy notes merely because they concern mental health services.

18.3 Substance Use Disorder Information

Certain substance use disorder treatment records are subject to additional protections under 42 CFR Part 2.

Whether these specialized protections apply depends on the status of the program, the records involved, and other legally relevant conditions.

Where SDKare receives or maintains records protected by Part 2, those records must be handled according to applicable legal requirements.

The existence of an addiction-related healthcare service does not, by itself, establish that every related record is subject to Part 2.

18.4 Other Sensitive Healthcare Information

Reproductive health, sexual health, HIV-related, genetic, and other sensitive healthcare information may be subject to additional federal or state confidentiality protections.

SDKare will comply with such requirements where applicable.

19. Patient Communications and Information Disclosure

SDKare may communicate with patients regarding appointments, care coordination, billing, follow-up, and other legitimate healthcare purposes.

Communications involving PHI must comply with applicable privacy and security requirements.

19.1 Electronic Communications

Electronic communication may involve risks associated with interception, misdelivery, shared devices, or unauthorized account access.

SDKare must apply appropriate safeguards and honor legally required confidential communication requests.

19.2 Appointment Reminders

Appointment reminders and administrative notifications may be sent as permitted by applicable law and patient communication preferences.

19.3 Marketing Communications

Where a communication constitutes marketing requiring authorization under HIPAA, SDKare must obtain the required authorization before using or disclosing PHI for that purpose.

Other marketing communications must comply with applicable consumer communications and consent laws.

19.4 Patient Communication Preferences

Patients may request applicable changes to communication preferences or confidential communication methods.

Requests will be evaluated in accordance with legal requirements and available authorized communication channels.

20. Website Tracking, Cookies, and Online Health Information

SDKare recognizes that website analytics, advertising technologies, and other digital tools may raise additional privacy concerns.

The use of tracking technologies must comply with applicable HIPAA requirements when PHI is involved.

20.1 Protected Health Information and Tracking

SDKare must not impermissibly disclose PHI through website pixels, analytics tools, advertising services, or similar technologies.

20.2 Patient Portals and Intake Processes

Digital appointment forms, intake questionnaires, patient portals, and other healthcare-related systems must be assessed for applicable PHI protections.

20.3 Third-Party Tracking Providers

Where a tracking or technology provider performs functions that create a HIPAA business associate relationship, the applicable contractual and safeguard requirements must be satisfied.

20.4 Consent and Authorization

General cookie consent does not substitute for HIPAA authorization where such authorization is legally required.

Detailed information about general website data practices is provided in SDKare’s Privacy Policy.

21. Medical Record Retention and Secure Disposal

SDKare maintains healthcare and related records according to applicable federal and state requirements.

21.1 Retention Requirements

Medical record retention requirements may differ depending on the record type, provider obligations, and governing state law.

HIPAA’s documentation retention requirements are not a universal six-year retention period for all patient medical records.

21.2 HIPAA Policy Documentation

Documentation required under applicable HIPAA Privacy and Security Rule provisions must be maintained for the required period, generally six years from creation or the date last in effect, whichever is later, unless a longer applicable requirement governs.

21.3 Disposal

PHI and ePHI must be disposed of using appropriate procedures designed to prevent unauthorized access, use, or disclosure.

21.4 Patient Account Closure

Closure of a patient account does not automatically require deletion of medical records that must be retained under applicable law.

22. Security Incidents and Breach Response

SDKare must maintain appropriate procedures for identifying, reporting, responding to, and documenting relevant information security incidents.

22.1 Incident Identification

Potential incidents may include unauthorized account access, improper information disclosure, lost devices, malicious activity, or other events affecting the confidentiality, integrity, or availability of ePHI.

22.2 Investigation and Assessment

SDKare must assess suspected incidents according to the applicable HIPAA Security Rule, Breach Notification Rule, and other relevant legal requirements.

22.3 Breach Risk Assessment

When required, SDKare must evaluate whether an impermissible use or disclosure of unsecured PHI constitutes a reportable breach.

The assessment must consider the applicable regulatory factors and any relevant exceptions.

22.4 Mitigation

SDKare will take reasonable and appropriate action to address confirmed problems and mitigate harmful effects to the extent practicable, as required by law.

22.5 Documentation

Incidents, assessments, required notifications, and relevant corrective actions must be documented and retained in accordance with applicable requirements.

23. HIPAA Breach Notification

Where the HIPAA Breach Notification Rule applies, notifications concerning a reportable breach of unsecured PHI must be provided according to applicable legal requirements.

23.1 Notification to Affected Individuals

Required individual notices must be provided without unreasonable delay and generally no later than 60 calendar days after discovery of a reportable breach.

The timing and method of notification remain subject to applicable legal provisions.

23.2 Notification to HHS

Reportable breaches must be submitted to the U.S. Department of Health and Human Services according to the applicable reporting thresholds and deadlines.

Breaches involving 500 or more individuals generally require notification to HHS without unreasonable delay and no later than 60 calendar days after discovery.

Smaller reportable breaches are generally submitted according to the applicable annual reporting deadline.

23.3 Media Notification

Where a reportable breach affects more than 500 residents of a state or jurisdiction, applicable media notification requirements may apply.

23.4 Business Associate Notification

Business associates must notify the responsible covered entity of breaches of unsecured PHI in accordance with applicable HIPAA requirements and contractual obligations.

23.5 State Breach Notification Laws

Additional state notification requirements may apply.

SDKare will comply with the relevant legal obligations where federal and state laws govern an incident.

24. Privacy Complaints, Investigations, and Non-Retaliation

Patients may submit privacy concerns or complaints regarding the handling of PHI.

SDKare must maintain procedures for receiving, reviewing, and addressing complaints as required by HIPAA.

Complaints may involve:

• Suspected unauthorized access to medical records.
• Improper disclosure of health information.
• Confidential communication concerns.
• Medical record access disputes.
• Other potential privacy violations.

Complaints may be directed to SDKare’s Privacy Officer.

Patients may also file qualifying complaints with the U.S. Department of Health and Human Services Office for Civil Rights.

SDKare prohibits retaliation against individuals for exercising rights protected by HIPAA.

Information about filing an HHS privacy complaint is available at:

https://www.hhs.gov/ocr/complaints/index.html

25. Policy Administration, Documentation, and Review

SDKare is responsible for maintaining the policies, procedures, and documentation required by applicable privacy and security laws.

This includes, where relevant:

• Privacy policies and procedures.
• Security policies and procedures.
• Workforce training documentation.
• Designation of privacy and security officials.
• Required risk assessments.
• Security evaluations.
• Relevant business associate agreements.
• Complaint documentation.
• Required breach assessments and notifications.
• Corrective actions and legally required records.

Policies and procedures must be reviewed and updated as appropriate to changes in law, technology, organizational practices, and information security risks.

Records must be retained for the legally required periods.

26. Relationship to Other SDKare Policies

This HIPAA Privacy and Security Policy should be read alongside:

• SDKare’s HIPAA Notice of Privacy Practices.
• Privacy Policy.
• Terms & Conditions.
• Payment Policy for Clients.
• Other relevant patient-facing policies.

The HIPAA Notice of Privacy Practices provides more detailed information about legally required notice contents, permitted uses and disclosures, patient rights, and organizational obligations.

This Policy describes the privacy and security framework applicable to SDKare.

If a provision conflicts with applicable law, the governing legal requirement controls.

27. Changes to This Policy

SDKare LLC may revise this Policy to reflect changes in applicable regulations, privacy and security requirements, organizational practices, or healthcare services.

The Last Updated date at the beginning of this document identifies the most recent approved revision.

Where applicable law requires additional notice, authorization, or another procedure in connection with a change, SDKare will satisfy that requirement.

An updated policy does not replace any separate notice or consent required by law.

28. Contact Information and Designated Officials

For questions about this Policy, privacy rights, medical record requests, or suspected privacy and security concerns, contact:

SDKare LLC

Website: https://sdkare.com/

Email: contact.support@sdkare.com

Phone: (520) 800-6043

Mailing address: 2810 N Church St, Wilmington, DE 19802, United States

Privacy Officer: Sophie Brown

Security Official: Sophie Brown

Privacy-related communications may be directed to the Privacy Officer through SDKare’s official contact channels.

Individuals may also contact the U.S. Department of Health and Human Services Office for Civil Rights concerning eligible HIPAA complaints.

SDKare prohibits retaliation for the lawful exercise of privacy rights.