Notice of Privacy Practices

Last update date: 15 April 2024

The original effective date of this notice is July 2023. This notice was last updated in April 2024.

Your personal data identifies you and is collected when you use our mental health services. We may collect, use, and share your data as described in this notice. THIS NOTICE DESCRIBES HOW HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED, AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Information that you provide to us, and information related to the services we provide to you is private. Personal information that identifies you and relates to our services is called protected health information (PHI). We may collect, use, and share your PHI as allowed or required by law, including the HIPAA Privacy Rule.

We can change the terms of this notice and the changes will apply to the information we have about you. The new notice will be available on our website and when you ask for it. Please contact us to request a copy of this notice in another languages or format.

This notice applies to services we provide in the United States when we act as a Business Associate to a Covered Entity.

If you have any questions about this notice, please contact our US Privacy Officer using the contact information listed at the bottom of this notice.

Our responsibilities

We are required by law to:

Keep your PHI private and secure.
Tell you promptly if a breach occurs that may involve the privacy and security of your PHI.
Tell you what the law says about privacy.
Make sure our business partners protect the privacy of data we share with them. They are not allowed to give your PHI to others without your written permission unless the law allows, or it is stated in this notice.
Do what we say we will do in this notice and give you a copy if you ask.
Not use or share your PHI other than described here unless you tell us we can in writing. If you tell us we can, you may change your mind at any time. Let us know in writing if you change your mind.

For more information see: https://www.hhs.gov/hipaa/for-individuals/index.html

Your information

We may use your information as described in this notice. We may collect:

Your name, age, email address, username, password, and other registration information;
Health information you provide to us. This may include medical or health history, health status, and other health-related information; and
Health information from our internal team members. Our team members include licensed therapists, behavioral health coaches, and support staff who provide you with services.

Your choice

You can tell us your choices about certain information we share. You have a right and a choice to tell us to share information with your family, friends, or others involved in your care. We will never use your PHI for marketing purposes (defined by HIPAA) or sell your information.

If you can’t tell us your preference, such as in an emergency, we may share your PHI if we believe it’s in your best interest. We can share your information to lessen a serious or likely threat to your or someone else’s health and safety.

Our uses and disclosures

When you use your service, you provide information to us. This includes entering information directly while using our services and sharing information with your support team. We typically use, collect, or share your PHI in the following ways:

Treatment: We use your information to provide you with our services. Examples of ways we use your information for treatment purposes:
- You may share your PHI with your licensed therapist, behavioral coach, or others involved in your care. We use this information to provide services to you.
- We may use PHI to review the quality of care and services you receive.
- We may collect and use data about you to support you and help you get local services.
- We may collect and use your PHI to create, use, or share de-identified data as allowed by HIPAA and contract requirements.
Health Care Operations: We use and share your information to run our organization and contact you when necessary. We may use, collect, or share your PHI for the following operations purposes:
- We use PHI to develop better services for you.
- We may share your information with contractors and agents who help run our program and provide you with services. We make sure these third parties sign contracts to protect your information and limit using your information to the minimum amount necessary.
Other reasons we may use or share your information: We are allowed or required to share your PHI in other ways. Usually these are ways that contribute to the public good, such as public health and research. We must meet many conditions in the law before we can share your information for these purposes:
- Helping with public health and safety issues. For example:
  - Reporting suspected abuse, neglect, or violence;
  - Preventing or reducing a serious threat to anyone’s health or safety;
  - Doing health research;
  - Responding to lawsuits and legal actions;
  - Preventing or reducing a serious threat to anyone’s health or safety;
  - Complying with state and federal law if it requires sharing your information;
  - As required by military authorities;
  - Health oversight activities; and
  - Complying with special laws when they are stricter than this notice.

Your rights

Federal law says you have certain rights when it comes to your health information. This section explains your rights and our responsibilities. Email privacy@kooth.com or call us toll-free at (844) 582-2111 to exercise any of these rights.

Get a copy of your health record.

You can ask to see or get a copy of your health record and other health information we have about you.
Some of your information is available directly to you through the service itself. Please contact thoughts@kooth.com if you need help using these features.
We will provide a copy or summary of your health records within 30 days. If we need more time, we will let you know.
We may deny a part or all of your request in limited situations. An example of this would be if we received information from someone other than you.

Ask us to correct your health record.

You can ask us to correct health information about you that you think is wrong or not complete. Your request must be in writing and include a reason for your request.
We can only correct information that we create and maintain. If someone else gave us the information, we will let you know so you can ask them to correct it. We will also let you know if we no longer have the information or if we determine the information is accurate or complete.
We may deny your request, but we will tell you why in writing within 60 days.

Request confidential communications.

You can ask us to contact you in a specific way (for example, home or office phone) or to send email to a different address.
We will consider all requests and must say “yes” if you tell us you would be in danger if we do not agree.

Ask us to limit what we use or share with others.

You can ask us not to use or share certain health information for treatment or operations.
We are not required to agree to your request, and we may say “no” if it would affect your care or the services we provide to you.

Get a list of those with whom we’ve shared information.

You can ask for a list (accounting) of the times we shared your PHI for up to six years before the date you ask. We will tell you who we shared it with and why.
We will include all the times we shared your PHI except for those about treatment, health care operations, and certain other disclosures (for example, any you asked us to make). We may charge a reasonable, cost-based fee for this.

Get a copy of this privacy notice.

You can ask for a paper copy of this notice at any time. We will provide you with a paper copy at the address you provide in your request.

Choose someone to act for you

If you have a medical power of attorney or legal guardian, that person can exercise your rights and make choices about your health information.
We will make sure the person can legally act for you before we take any action.

It’s important we treat you fairly.

You can file a complaint if you feel we have violated your rights by contacting the US Privacy Officer below.
You can also file a complaint with the US Department of Health and Human Services, Office of Civil Rights at 200 Independence Ave. SW; Room 509F HHH Bldg., Washington, DC 20201; by calling 1-877-696-6775; or visiting www.hhs.gov/ocr/privacy/hipaa/complaints/.
We will not retaliate against you for filing a complaint.

Contact Information

For more information, to exercise your rights, or to report a problem please contact the US Privacy Officer at:

Kooth USA LLC
Jessica Skura-Capone
US Privacy Officer
167 North Green St., Chicago, IL 60607
(844) 582-2111
privacy@kooth.com