How we protect your health information

1. Who holds your health record

Avellum sells prescription peptide protocols and a laboratory blood panel online. It is not a pharmacy, it does not employ the clinicians who evaluate you, and it does not dispense medication. The medical intake, the telehealth visit, prescribing and patient support for those protocols are run under our name by licensed clinicians in the medical groups affiliated with OpenLoop Health, our telehealth partner, and those medical groups keep the record of your care. Prescriptions are filled by Precision Pharma (Precision Pharma Corp, NPI 1770389629) in the states it is licensed in, and by a partner pharmacy network elsewhere. Which pharmacy fills your order depends on where you live and on which product was prescribed.

Under HIPAA, the federal health privacy law, those medical groups are covered entities: the health care providers responsible for your health record. Their own Notice of Privacy Practices describes how they use and share your health information and the rights HIPAA gives you over it, and that notice, not this page, governs your health record and your HIPAA rights. The pharmacy that fills your prescription keeps its own prescription records. A pharmacy that bills health insurance is a HIPAA covered entity and gives you its own Notice of Privacy Practices.

• The medical groups publish their notice on OpenLoop Health’s site: read their Notice of Privacy Practices (opens OpenLoop Health’s site in a new tab).
• The telehealth consent you agree to during your medical intake names the medical groups responsible for your care: read the telehealth consent (opens OpenLoop Health’s site in a new tab). Our Telehealth and your consent page explains the arrangement.
• The pharmacy that fills your prescription can tell you how it protects its prescription records, and gives you its own Notice of Privacy Practices if it bills health insurance. Ask the pharmacy, or write to our Privacy Officer under Section 7 and we will help you.

2. Our role: a business associate

Avellum handles health information about you on behalf of those medical groups, as their business associate under written business associate agreements. Those agreements and HIPAA decide what we may do with it: we use and share it to run this website and your account, to support the care and the orders those providers handle, and to meet our legal obligations, as Section 3 describes. We never sell your health information, and we do not use it for marketing as HIPAA defines it without your written authorization.

What we hold includes your account and contact details, the health goals you tell us, your order and subscription records, the outcome of your visit that comes back to us, what you write to the assistant in your signed-in account, and anything you send our Privacy Officer. The full record of your care, including your intake answers and your clinician’s notes, stays with the medical group and the pharmacy.

Avellum Health Co LLC, an affiliated company under common ownership that provides shared services to us, hosts and protects that information for us as a subcontractor business associate, under a written agreement with us that binds it to HIPAA’s business associate obligations. It holds the accounts and the business associate agreements for the vendors our companies share, including application hosting, our database, the service that sends our email, the phone service behind our privacy line, and the AI provider behind the assistant in your account. Every vendor that can reach your health information, including the workspace that runs our mailboxes, works under a business associate agreement that obliges it to protect your information and limits what it may do with it. Precision Pharma, which packs and ships blood panel collection kits for us, is also an affiliated company under common ownership and does that work under the same written agreement.

3. How we use and share health information

Within what our agreements with the covered entities allow, we use and share health information about you for purposes including:

• Supporting your care. To coordinate with the clinicians who evaluate you, the dispensing pharmacy, and any other health care provider involved in your care. Example: when you order a blood panel, we send the pharmacy that packs and ships your collection kit what it needs to get the box to you, including the recipient name and address, which kit to pack, our own order reference, and whether a prescription order is also on its way to the same person. No diagnosis, dose, laboratory marker or result goes with it.
• Payment. To arrange and account for payment for what you buy here, and to give a payment processor what it needs to take a charge. Avellum does not charge you for medication. Our telehealth partner takes that payment on its own processor, on completion of the medical intake, before clinician review, and bills again every 28 days; we never see or hold your card number, and the partner’s terms govern that charge. A blood panel is charged separately here at checkout, with Valdura rather than Avellum as the merchant of record, so someone buying both enters a card twice with two different merchants. The company charging you for the panel is named on the payment page. The processor handling that panel charge receives what it needs to take the payment, send you a receipt and get the kit to you, including your email address, the amount, a plain product name, our own order and patient references, and the name and shipping address you type on its payment page. We read that name and address back from it so the kit can reach you. No diagnosis, dose, laboratory marker or result goes to it. A payment processor is not a business associate, because HIPAA treats a payment transaction as outside that requirement (45 CFR §164.502(e)(1)(ii)), so ours has not signed a business associate agreement.
• Running our operations. Quality review, training, vendor management, audits, and security, including the safeguards in Section 4.
• With your written authorization. Any other use or disclosure needs your written HIPAA authorization. To give one, for example to have your health information sent to a family member, another provider or an attorney, email privacy@avellumhealth.com with the subject “HIPAA Authorization” and we will send back what it has to contain. You may revoke an authorization at any time by sending a written revocation to the same mailbox, or by post to Avellum Health, LLC, Attn: Privacy Officer, 2750 Taylor Ave, Suite A-84, Orlando, FL 32806. A revocation does not undo what was already done in reliance on the authorization.
• Where the law requires it. For example, in response to a court order or other lawful process, or to a government authority entitled by law to receive it, under the conditions HIPAA sets.

Some visitors reach this site through Amway, and an Amway account can unlock discounted pricing. Your health information is not part of that. When we check whether an account qualifies, what goes out is an obscured account reference, and what comes back is that account’s standing, meaning whether it is active and whether it qualifies for partner pricing, along with Amway’s own reference for the account and the time it answered. No order, no prescription and nothing about your care crosses that line in either direction.

We may contact you about refills and about the care you have already bought, about other products and services we offer, and about health-related benefits and services from companies we work with. You can tell us to stop at any time: change your contact preference in your account, or write to the contact in Section 7.

4. How we protect it

Health information we hold is stored in a database that runs in a HIPAA-enabled environment, encrypted at rest and in transit. Our internal admin console requires a sign-in, is open to named staff accounts, and writes what a member of staff opens there to an audit log that records who looked, at what, and when. Our rules keep health information out of our application logs, and we never see or hold your card number.

If a breach of unsecured health information about you happens while we hold it, we report it to the covered entity responsible for your record without unreasonable delay, as HIPAA and our agreements require, so that you can be told. HIPAA requires that you be notified without unreasonable delay and no later than 60 calendar days after the breach is discovered, with a description of what happened, the information involved, the steps you should take and what is being done about it.

5. Your rights and how to make a request

HIPAA gives you rights over your health record, including the right to see and get a copy of it, to ask for a correction, to receive an accounting of certain disclosures, to ask for restrictions on some uses, to ask to be contacted in a particular way, to a paper copy of a notice, and to be notified of a breach. You hold those rights with the covered entities in Section 1, and their notices explain how to use them.

You can also send any request about your health information to our Privacy Officer, by email at privacy@avellumhealth.com, by post to the address in Section 7, or by telephone at the number there. All three reach the same person. We answer for the information we hold, and we pass the rest of your request to whoever holds the record, as our agreements require. We work to the deadline HIPAA sets, which is 30 days from your request with a single 30-day extension where one is needed, and we do not charge you for a copy of what we hold. To prevent misuse, we may need to verify your identity before acting on a request, and anyone acting for someone else must provide written proof of authority.

6. Complaints and changes to this page

If you believe your health information has been mishandled, you may complain to our Privacy Officer under Section 7, to the covered entity through the contact in its own notice, or to the U.S. Department of Health and Human Services, Office for Civil Rights, by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1-877-696-6775, or visiting hhs.gov/ocr/privacy/hipaa/complaints. We will not retaliate against you for filing a complaint.

We may change this page. When we make a material change, we will post the updated page on avellumhealth.com and update the “Last updated” date at the top. You may request a paper copy of this page at any time, by email or by post, using the contact in Section 7.

7. Contact us

Requests, complaints, revocations, and any other matter described on this page go to our Privacy Officer, by email at privacy@avellumhealth.com, by telephone at (689) 220-7908, or by post at the address below.

That line and that mailbox are for privacy and legal matters. An order, a shipment, a delivery problem or a clinical question goes to support@avellumhealth.com, which reaches the care team that runs your care and can act on it. A question about a blood panel, its collection kit or your results goes to support@valdura.health instead, answered for Valdura, which sold the panel. Anything about your health information, your records, an authorization, or this page comes to the Privacy Officer above.