Notice of Privacy Practices

1. Who this Notice applies to

HeydayMD LLC operates a technology platform. It is not the entity that provides your medical care. Care is delivered by independently licensed nurse practitioners and physician assistants, licensed in your state and supported by a collaborating physician of record — see how care works. Those clinicians are the HIPAA covered entities that hold your protected health information (PHI); HeydayMD supports them as a business associate and is bound by a business associate agreement to protect PHI on their behalf.

This Notice is published so you can read the privacy practices that apply to your care before you share anything with us. Your treating clinician will also provide you with their own Notice of Privacy Practices inside the care portal, together with their name and credentials, before anything is prescribed. Where that Notice differs from this one, your clinician's Notice governs your care.

Information you give HeydayMD outside a clinical encounter — marketing forms, quiz answers before you become a patient, account details — is governed by our Privacy PolicyNotice of Privacy Practices rather than by HIPAA.

2. How your health information may be used and disclosed

Without needing separate authorization from you, your clinician and the platform acting on their behalf may use and disclose your PHI for the following purposes:

• Treatment. To evaluate you, review your labs, prescribe, adjust and monitor your therapy, and to coordinate with the CLIA-certified laboratory that runs your tests and the licensed pharmacy that dispenses your medication.
• Payment. To charge you for the clinical service and, where applicable, medication, and to process refunds, chargebacks and billing disputes. HeydayMD does not bill insurance.
• Health care operations. Quality review of clinical documentation, clinician credentialing and oversight, and internal audits.
• As required by law. Including state prescription drug monitoring programs (PDMPs), which apply to controlled substances such as testosterone; public health reporting; mandated reporting of abuse or neglect; responses to lawful subpoenas, court orders and law enforcement requests; and reporting adverse drug events to the FDA.
• To avert a serious threat. To prevent a serious and imminent threat to your health or safety or that of another person, including emergency services in a medical emergency.
• Business associates. To vendors performing services on the clinician's behalf under written agreement — our platform, hosting, secure messaging, laboratory logistics, and payment processing. These vendors may use your information only for the services specified.

3. Uses that require your written authorization

Your written authorization is required before your PHI is used for marketing, before it is sold, and for most uses of psychotherapy notes. We do not sell your health information, and we do not share it with advertisers or use it for targeted advertising. If you give authorization, you may revoke it in writing at any time; revocation does not undo disclosures already made in reliance on it. Any use or disclosure not described in this Notice and not required by law will be made only with your written authorization.

4. Your rights regarding your health information

• Access and copies. You may inspect and obtain an electronic or paper copy of your medical and billing records, generally within 30 days of your request. A reasonable, cost-based fee may apply to paper copies.
• Amendment. You may ask that information you believe is incorrect or incomplete be amended. If the request is denied, you will receive a written explanation and may submit a statement of disagreement to be kept with your record.
• Accounting of disclosures. You may request a list of certain disclosures of your PHI made in the six years before your request.
• Restrictions. You may ask us to restrict certain uses or disclosures. We are not required to agree, except that we must honor a request to withhold information from a health plan for a service you paid for entirely out of pocket — which applies to essentially all care on this platform, since we do not bill insurance.
• Confidential communications. You may ask that we contact you at a specific phone number, email address or mailing address, or in a specific manner. We will accommodate reasonable requests.
• Paper copy of this Notice. You may request one at any time, even if you agreed to receive it electronically.
• Breach notification. You will be notified if a breach occurs that compromises the privacy or security of your PHI.
• Choice of someone to act for you. A personal representative with legal authority may exercise these rights on your behalf; we will verify that authority first.

To exercise any of these rights, contact us using the details in section 9. Exercising them will never affect the care you receive.

5. Our responsibilities

Your clinician, and HeydayMD acting on their behalf, are required by law to maintain the privacy and security of your PHI, to notify you promptly if a breach compromises it, to follow the practices described in this Notice, and not to use or disclose your information other than as described here unless you tell us in writing that we may. Administrative, technical and physical safeguards are in place, including encryption in transit and at rest, access controls limiting PHI to personnel who need it, and audit logging.

6. How to file a complaint

If you believe your privacy rights have been violated, you may complain to us at any time — by phone at (866) 485-3013, by email at team@heydaymd.com with the subject line "Privacy Complaint", or by mail at the address in section 9. We will acknowledge your complaint within five business days and respond substantively within 30 days.

You may also complain directly to the U.S. Department of Health and Human Services, Office for Civil Rights, at 200 Independence Avenue SW, Washington, DC 20201, by calling 1-877-696-6775, or at hhs.gov/ocr/privacy/hipaa/complaints. Complaints about a clinician's licensure or conduct may be directed to the licensing board of the state in which you were treated, and complaints about a dispensing pharmacy to that state's board of pharmacy.

We will not retaliate against you for filing a complaint.

7. Reporting a side effect or safety concern

If you are having a medical emergency, call 911 or go to the nearest emergency room. Do not use this website or the care portal to report an emergency.

For a non-emergency side effect, unexpected reaction, or a problem with a medication or lab kit: message your care team in the care portal, or call (866) 485-3013. Messages are reviewed by clinical staff, and we aim to respond to patient messages the same day. Stop the medication and seek in-person care if your symptoms are severe.

You may also report a suspected side effect directly to the FDA through MedWatch, independently of us, at fda.gov/medwatch or 1-800-FDA-1088 (1-800-332-1088). Reporting to the FDA does not replace telling your clinician.

8. Changes to this Notice

We may change this Notice, and any change applies to information we already hold as well as to information we receive in the future. The current version is always posted at heydaymd.com/notice-of-privacy-practices with its effective date, and material changes will be communicated by email or prominent notice on the website.

9. Contact

HeydayMD LLC
Attn: Privacy Officer
1209 Mountain Road Pl NE, Ste N
Albuquerque, NM 87110
United States

Phone: (866) 485-3013
Email: team@heydaymd.com

See also our Privacy Policy, Terms of Service and how care works.