Privacy Policy

1. Protected Health Information and HIPAA

1.1 What PHI Is

PHI is information that identifies you and relates to your physical or mental health, the health care services you receive, or payment for those services. Examples include your name when linked to your care, your date of birth, contact information, health history, intake answers, lab results, diagnoses, prescriptions, treatment plans, provider notes, and billing records. Health information you submit to us through our website, booking, or intake forms in order to receive care from Elenova is treated as PHI.

1.2 How We Use and Disclose PHI

We use and disclose PHI only as permitted or required by HIPAA and other applicable law. In general, we use and disclose PHI to:

• Provide your care, including sharing information with pharmacies that fill your prescriptions, laboratories that process your tests, and other providers involved in your treatment
• Process payment for our services
• Run our practice, including scheduling, appointment reminders, shipping updates, and quality review
• Work with business associates, such as our electronic health record and patient portal provider, who perform services for us and are bound by written business associate agreements to protect your PHI
• Comply with the law, including public health reporting, health oversight, and valid legal process, as described in our Notice of Privacy Practices

We will not sell your PHI. We will not use or disclose your PHI for marketing, or use testimonials, photos, or videos that identify you, without your written authorization. Any other use or disclosure not described in our Notice of Privacy Practices requires your written authorization, which you may revoke in writing at any time.

We limit the PHI we use, disclose, and request to the minimum necessary for the purpose, except where the law allows otherwise, such as for treatment.

1.3 How We Protect PHI

We maintain administrative, technical, and physical safeguards designed to protect PHI as required by the HIPAA Security Rule. These include:

• Storing PHI in our electronic health record system, which is accessed through our secure patient portal and requires a unique account and password for each user
• Encrypting information transmitted between your browser and our website and patient portal
• Limiting access to PHI to authorized members of our workforce who need it to perform their jobs
• Training our workforce on HIPAA privacy and security requirements, with sanctions for violations
• Requiring vendors that handle PHI on our behalf to sign business associate agreements
• Conducting periodic reviews of our security practices and system activity

Standard email and text messaging are not secure methods for sending health information. Please use the patient portal to send us health information or to view your records.

1.4 Your Rights Regarding PHI

Under HIPAA, you have the right to:

• See and get a copy of your health and billing records
• Ask us to correct your records
• Request that we contact you in a confidential way or at a different address
• Ask us to limit how we use or share your information
• Get a list of certain disclosures we have made
• Get a paper copy of our Notice of Privacy Practices
• Choose someone to act for you
• Be notified if a breach of your unsecured PHI occurs
• File a complaint if you believe your privacy rights have been violated

Our Notice of Privacy Practices explains each of these rights and how to exercise them. To make a request, contact our Privacy Officer using the information in Section 5 or message us through the patient portal.

1.5 Breach Notification

If a breach of your unsecured PHI occurs, we will notify you as required by HIPAA and applicable state law, without unreasonable delay and no later than 60 days after we discover the breach. We will also notify the U.S. Department of Health and Human Services and, where required, the media.

1.6 Privacy Officer and Complaints

Elenova has designated a Privacy Officer who is responsible for our privacy policies and for responding to questions, requests, and complaints about PHI:

Privacy Officer: Keisler Smith
Email: hello@elenova.health (please include "Privacy Officer" in the subject line)
Phone: (864) 920-7739
Mail: Elenova Health, Attn: Privacy Officer, P.O. Box 16351, Greenville, SC 29606

You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights at www.hhs.gov/ocr/privacy/hipaa/complaints/, by calling 1-877-696-6775, or by writing to 200 Independence Avenue, S.W., Washington, D.C. 20201. We will not retaliate against you for filing a complaint.

2. Information We Collect Through Our Website

2.1 Information You Provide

When you contact us, book a consultation, or complete intake questions on our website, you may provide your name, email address, phone number, date of birth, state of residence, health goals, health history, and other information you choose to share. If you submit this information to seek care from Elenova, we treat it as PHI and protect it as described in Section 1 and our Notice of Privacy Practices.

2.2 Information Collected Automatically

When you visit our website, our hosting and security providers automatically process limited technical information, such as your IP address, browser type, device type, pages requested, and the date and time of your visit. This information is used to deliver the website, keep it secure, and prevent abuse. Our website may use cookies or similar technologies that are strictly necessary for the site to function, such as maintaining a session or remembering your choices within a form.

We also use two analytics services to understand how visitors find and use our website and how quickly it loads:

• Cloudflare Web Analytics, a service of our hosting provider, records general information such as the page visited, the referring website, browser and device type, country, and page load times. It does not use cookies or similar technologies to identify or track you.
• Google Analytics, a service of Google LLC, uses cookies to recognize returning visitors and records information such as the pages visited, how you arrived at our website (for example, a search engine, another website, or a link or QR code in our printed materials), browser and device type, and approximate location, such as city and country. Google may use your IP address to determine approximate location.

Neither analytics service collects information you type into our forms. Google Analytics does not run on the pages of our website where you book a consultation, contact us, or provide information during a consultation, and we do not send Google your name, contact information, or health information. We have turned off Google's advertising features for our website, including ads personalization and Google signals.

To measure whether our advertising is working, Google Analytics counts a few actions on our website without recording anything you type: clicking a link to book a consultation, clicking a link to contact us, and signing up for our email list. If you arrived at our website by clicking one of our ads, Google Analytics shares these actions with our Google Ads account, along with an identifier for that ad click, so we can see which ads lead visitors to take these steps. We do not place Google Ads tags on our website, and we do not use this information or any other Google Analytics data to build advertising audiences or to target ads to you.

You can prevent Google Analytics from collecting information about your visits by blocking or deleting cookies in your browser settings or by installing the Google Analytics Opt-out Browser Add-on. To learn more about how Google uses information from websites that use its services, visit How Google uses information from sites or apps that use our services.

2.3 Tracking Technologies and Advertising

Elenova does not use third-party advertising pixels, social media tracking pixels, session recording tools, or similar tracking technologies on our website. We do not disclose PHI to advertising platforms, social media companies, or data brokers. Other than the analytics services described in Section 2.2, if we add analytics or other tracking technologies in the future, we will update this Policy first, and we will not use them in a way that discloses PHI unless the disclosure is permitted by HIPAA, such as under a business associate agreement, or you have given us written authorization.

2.4 How We Use Website Information

We use information collected through our website to respond to your inquiries, schedule consultations, provide and coordinate your care, operate and secure our website, and comply with applicable law. We do not sell your personal information.

2.5 Patient Portal and Links to Other Sites

The "Patient Login" link on our website opens our patient portal, which is operated for Elenova by our electronic health record provider under a business associate agreement. Your use of the portal is covered by this Policy and our Notice of Privacy Practices. Our website may also link to our social media pages or other third-party websites. Those sites are governed by their own privacy policies, and we are not responsible for their practices. Please do not share health information with us through social media.

3. Text Messaging

This section explains how Elenova uses text messaging (SMS/MMS) to communicate with you, what information is and is not shared through that channel, and what you should expect from our texting program.

3.1 Text Messages We Send

With your consent, Elenova may send you text messages for purposes such as:

• Shipping and delivery updates for products or supplies you have ordered through Elenova
• General administrative notices we identify to you at the time you opt in, such as changes to our office hours or contact information

Elenova does not use this texting program to send appointment reminders or marketing messages. Appointment reminders and scheduling updates are sent through the patient portal.

3.2 We Will Never Send You PHI by Text

Elenova will never send Protected Health Information ("PHI") or other sensitive personal information to you by text message. Our text messages are limited to general, non-sensitive notifications, for example, that "your order has shipped." Our text messages will never include appointment details, your diagnosis, treatment, medications, lab or test results, provider notes, health plan or account numbers, Social Security number, or other sensitive identifying or health information. If you need to view or discuss information like this, we will direct you to sign in to the patient portal or contact us through a secure channel.

3.3 Text Messaging Is Not a Substitute for the Patient Portal

Text messaging is a convenience notification channel, not a secure health information system, and it is not a replacement for the Elenova patient portal. The patient portal is the secure, authenticated channel where you should go to view your health records, message your care team about clinical matters, review test results, manage appointments in detail, and access other PHI or account-specific information. Standard SMS/MMS text messaging is not encrypted end to end in the way the patient portal is, and it may pass through your mobile carrier, your device, and any other person with access to your phone. For that reason, Elenova does not send PHI by text, limits text messages to general notifications, and directs all sensitive interactions to the patient portal.

3.4 Please Do Not Send PHI or Sensitive Information to Us by Text

At no time should you send PHI or other sensitive personal information to Elenova by text message. This includes, but is not limited to:

• Health information such as symptoms, diagnoses, medications, treatment details, or test results
• Identifying information such as your Social Security number, date of birth, driver's license number, or financial or insurance account numbers, including credit or debit card numbers
• Passwords, account credentials, or security codes

If you reply to a text message with this type of information, we will not use that channel to respond to the substance of your message, and we may direct you to the patient portal or another secure channel instead. Any health information you send us by text will still be protected as PHI once we receive it.

3.5 Your Consent to Receive Text Messages

By providing your mobile phone number and opting in verbally with our staff, you consent to receive text messages directly from Elenova related to shipping updates and general administrative notices. This consent is given directly to Elenova and is not shared with, or provided on behalf of, any third party. Consent to receive these text messages is not a condition of purchasing any goods or services from Elenova.

We do not share, sell, or provide your mobile phone number or messaging consent data to third parties or affiliates for marketing or promotional purposes, and we do not use your opt-in consent for any purpose beyond operating the Elenova texting program described in this section.

3.6 Message Frequency and Charges

Message frequency varies based on your orders and account activity. Message and data rates may apply, depending on your mobile carrier and plan. Elenova is not responsible for any charges from your wireless carrier related to text messages we send or that you send to us.

3.7 How to Opt Out

Opt out: You may opt out of receiving text messages from Elenova at any time by replying STOP to any text message you receive from us, or by contacting us using the information in Section 5. After you opt out, you may receive one final message confirming that your opt-out has been processed, and you will not receive further text messages from that program unless you opt back in.

Help: For help at any time, reply HELP to any text message you receive from us, or contact us using the information in Section 5.

Opting out of text messages does not affect your ability to use the patient portal, receive care, or communicate with us through other channels.

3.8 Information We Collect Through Our Texting Program

To operate our texting program, we and our text messaging service providers collect and retain limited information, such as your mobile phone number, opt-in and opt-out status and consent timestamp, delivery status, and the general content and timestamps of messages sent through this program (for example, that a shipping notice was sent). Because this program is not used to send PHI, message content is limited to general notifications.

3.9 How We Use and Share Texting Information

We use the information described in Section 3.8 to operate, maintain, and improve our texting program, to send you the notifications you have opted in to receive, and to comply with applicable law. We may share this information with service providers who help us deliver text messages on our behalf (such as messaging platforms and telecommunications carriers), who are permitted to use it only to provide these services to us and not for their own purposes. We do not share, sell, or provide your mobile phone number or messaging consent data to third parties or affiliates for marketing or promotional purposes.

Your use of our texting program is also governed by our Terms of Service, which describe your rights and obligations, including our opt-in and opt-out process.

3.10 Data Security and Retention

We use reasonable administrative, technical, and physical safeguards designed to protect the information associated with our texting program. However, standard SMS/MMS text messaging is not a fully secure or encrypted communication method, which is why we do not send PHI through this channel. We retain texting program records (such as consent and opt-out status) for as long as needed to operate the program, support your preferences, and meet our legal and recordkeeping obligations.

4. Where We Provide Services

Elenova currently provides telehealth services only to patients who are located in South Carolina at the time of their visit.

5. Contact Us

If you have questions about this Policy, our Notice of Privacy Practices, or how we handle your information, or if you wish to exercise your privacy rights or update your communication preferences, contact:

Elenova Health
Attn: Privacy Officer (Keisler Smith)
Email: hello@elenova.health
Phone: (864) 920-7739
Mail: P.O. Box 16351, Greenville, SC 29606

6. Changes to This Policy

We may update this Policy from time to time to reflect changes in our services, communication channels, or applicable law. The Effective Date at the top of this Policy shows when it was last revised. If we make material changes to how we handle PHI, we will also update our Notice of Privacy Practices and make the revised notice available on our website and in our patient portal.