Last updated: January
2026
Healthy Pulse Care . ("Healthy Pulse Care," "we," "us," or "our")
is committed to safeguarding your personal and health
information. This Privacy Policy explains how we
collect, use, disclose, and protect your information
when you use our healthcare platform, website, and
mobile applications (collectively, the "Services"). By
using our Services, you consent to the practices
described herein.
1.
Personal Information Collection
We collect
personal details you provide directly: full name, email
address, phone number, mailing address, date of birth,
gender, Social Security Number (when required for
insurance), and emergency contact details during account
creation, appointment booking, and insurance
enrollment.
2.
Health and Medical Data
We collect Protected
Health Information (PHI) including medical history,
current symptoms, diagnoses, prescriptions, lab results,
imaging reports, treatment plans, allergy information,
and clinical notes shared during consultations. All PHI
is handled in strict compliance with HIPAA
regulations.
3.
Financial and Payment Data
We collect payment
card details, bank account information, insurance policy
and group numbers, and billing addresses for processing
payments and insurance claims. Card data is processed
through PCI DSS Level 1 compliant payment processors and
never stored on our servers.
4.
Automatically Collected Technical Data
We
automatically gather IP address, browser type and
version, operating system, device identifiers, pages
visited, time on page, click patterns, referring URLs,
screen resolution, and interaction data with telehealth
tools, chat features, and booking forms.
5.
Cookies and Similar Technologies
We use essential
cookies for authentication and session management,
functional cookies for preference storage, and analytics
cookies for usage pattern analysis. We do not sell
cookie data to advertisers. You can manage preferences
through browser settings or our consent management
tool.
6.
Purpose of Data Use
Your information is used to:
deliver and manage healthcare services; schedule and
track appointments; facilitate telehealth consultations;
process payments and insurance claims; send appointment
reminders, test results, and follow-up instructions;
personalize health recommendations; improve platform
functionality; comply with legal obligations; detect
fraud and security threats.
7.
Appointment Communication
We use your contact
information to send appointment confirmations, reminders
via email and SMS, pre-visit preparation instructions,
post-visit summaries, prescription notifications, and
follow-up care recommendations. These are essential
transactional communications.
8.
Insurance Processing Sharing
When you use
insurance services, we share necessary information with
carriers, clearinghouses, and billing partners to verify
eligibility, submit claims, obtain pre-authorizations,
and process reimbursements under HIPAA's Treatment,
Payment, and Healthcare Operations provisions.
9.
Promotional Communications
With your explicit
consent, we send promotional emails about new services,
wellness programs, health campaigns, partnerships, and
offers. You may opt out anytime via the unsubscribe
link, our Unsubscribe page, or account preferences —
without affecting transactional emails.
10.
Service Provider Data Sharing
We share data with
third-party providers performing functions on our
behalf: cloud hosting (HIPAA-eligible AWS), payment
processing (Stripe, PCI DSS Level 1), telehealth
infrastructure (Zoom Healthcare), analytics (anonymized
Google Analytics), and email delivery (SendGrid). All
are bound by data processing agreements.
11.
Healthcare Provider Access
Your PHI is shared
with licensed providers directly involved in your care,
each bound by HIPAA, confidentiality obligations, and
our Business Associate Agreements. Providers access only
the minimum necessary information for your
treatment.
12.
Legal and Regulatory Disclosures
We may disclose
information when required by law: court orders,
subpoenas, government requests; suspected child abuse
reporting; public health reporting; health oversight
agency audits; law enforcement requests involving
imminent harm; and workers' compensation
proceedings.
13.
Business Transfers
In a merger, acquisition,
reorganization, bankruptcy, or asset sale, your
information may transfer. We will notify you via email
before your data becomes subject to a different privacy
policy.
14.
Data Encryption Standards
All data at rest is
encrypted using AES-256 (FIPS 197). Data in transit uses
TLS 1.3. Database access requires encrypted connections.
Backup data is encrypted with separate key
management.
15.
Infrastructure Security
Our HIPAA-eligible cloud
environment uses dedicated VPCs, encrypted storage
volumes, IAM policies, security groups, WAF protection,
intrusion detection systems, and automated vulnerability
scanning. Infrastructure is SOC 2 Type II certified.
16.
Access Control and Authentication
PHI access
requires multi-factor authentication, minimum
12-character passwords, session timeout after 15 minutes
of inactivity, IP allowlisting for admin access, and
role-based access controls. All access is logged in an
immutable audit trail.
17.
Personnel Security Measures
All employees undergo
background checks, sign confidentiality agreements,
complete HIPAA training upon hire and annually, and
access data only per their role. Vendor personnel are
subject to equivalent requirements through Business
Associate Agreements.
18.
Regular Security Audits
We conduct annual
penetration testing by independent security firms,
quarterly vulnerability assessments, continuous security
monitoring, and maintain an incident response plan
tested semi-annually.
19.
Data Retention Periods
Active accounts: data
retained while active. Health records: per state medical
record retention laws (typically 7–10 years). Payment
records: 7 years for tax compliance. Marketing data:
until unsubscribe or deletion request. Inactive
accounts: anonymized after 3 years of inactivity.
20.
Right to Access Your Data
You may request a copy
of all personal and health information we hold. Requests
are processed within 30 days per HIPAA. Data is provided
in readable electronic format through your patient
portal or upon written request to our Privacy
Officer.
21.
Right to Correction
You may request correction of
inaccurate personal or health information. Health record
corrections are coordinated with your treating provider.
Submit requests through your portal or by contacting
privacy@healthypulsecare.com.
22.
Right to Deletion
You may request deletion
subject to legal retention requirements. HIPAA-covered
health records cannot be deleted during mandatory
retention but will be restricted from further use.
Non-essential data is permanently erased within 45 days
of request.
23.
Right to Data Portability
You may request your
data in a structured, machine-readable format
(JSON/CSV). Health records can be exported as a
Continuity of Care Document (CCD) compatible with any
EHR system for seamless provider transfer.
24.
Right to Restrict Processing
You may request
restriction of PHI disclosures for payment or operations
when you've paid out of pocket in full. We accommodate
reasonable requests as required by HIPAA.
25.
Right to Opt Out of Marketing
Opt out of
promotional emails, SMS, and push notifications anytime
without affecting healthcare access or transactional
communications. Use unsubscribe links, account
preferences, or contact us. Processing within 10
business days.
26.
HIPAA Notice of Privacy Practices
We provide a
separate HIPAA NPP detailing your rights under HIPAA,
PHI use and disclosure practices, and our legal duties.
Available in your patient portal and provided at first
service.
27.
State-Specific Privacy Rights
California
residents have additional CCPA/CPRA rights (know,
delete, correct, opt out). Residents of Virginia,
Colorado, Connecticut, and other states with privacy
laws have analogous rights under applicable
statutes.
28.
Children's Privacy
Our Services are not for
children under 13. We do not knowingly collect data from
children under 13. If discovered, it is deleted
immediately. Minors 13–17 require parental/guardian
consent for account creation.
29.
International Data Transfers
Data is stored
primarily in the US. Any international transfers use
Standard Contractual Clauses, adequacy determinations,
and supplementary measures per applicable law.
30.
Breach Notification
In a PHI breach, we notify
affected individuals without unreasonable delay and
within 60 days per HIPAA. Notifications include breach
description, data types involved, protective steps, and
mitigation measures via email or first-class mail.
31.
Policy Updates
We may update this policy
periodically. Material changes are communicated via
email 30 days before taking effect. Continued use after
changes constitutes acceptance.
32.
Privacy Officer Contact
For all privacy
inquiries: Healthy Pulse Care, Privacy Officer, 78-30 64th St, Flushing, NY 11385, USA. Email:
privacy@healthypulsecare.com. Phone: +1 914-217-6599, Option
4. Response within 30 days.
