TEFCA Privacy and Security Notice
1. PURPOSE AND SCOPE
This TEFCA Privacy and Security Notice ("TEFCA Notice") explains how Doctronic, Inc. ("Doctronic," "we," "us," or "our") collects, uses, and shares health information when you use our Individual Access Services ("IAS") through our Trusted Exchange Framework and Common Agreement ("TEFCA") connection.
This TEFCA Notice is provided as required by the Trusted Exchange Framework and Common Agreement, the Participant/Subparticipant Terms of Participation, and the RCE Standard Operating Procedure for IAS Provider Requirements.
This TEFCA Notice supplements the Doctronic Privacy Policy (https://www.doctronic.ai/privacy-policy) and the HIPAA Notice of Privacy Practices. If this TEFCA Notice conflicts with the general Privacy Policy, this TEFCA Notice controls with respect to Individually Identifiable Information collected through our TEFCA connection. "Individually Identifiable Information" is information that identifies you or for which there is a reasonable basis to believe that the information could identify you.
This TEFCA Notice applies only when you initiate a telehealth visit through the Doctronic platform and authorize us to retrieve your health records through TEFCA.
2. ABOUT TEFCA AND DOCTRONIC INDIVIDUAL ACCESS SERVICES (IAS)
About TEFCA
TEFCA operates in the United States as a nationwide framework for health information sharing and allows individuals to more easily access their own health information. Organizations like Doctronic that offer IAS are IAS Providers.
About Doctronic's IAS
Doctronic offers access to telehealth consultations with licensed physicians through its affiliated professional entities (Doctronic Physicians Group, P.C.; Doctronic Physicians Group KS, P.A.; Doctronic Physicians Group WY, P.C.; Doctronic Physicians Group, P.A.; Doctronic Physicians Group NJ Professional Corporation; Summer Health Medical Group, P.A.; J.M. Medical Practice, P.C.) (collectively, "DPG" and "DPG Physicians"). When you book a telehealth video visit, you authorize DPG and your treating DPG Physician to retrieve relevant medical records through health information exchange networks, including TEFCA, for treatment and care coordination.
Doctronic does not provide bidirectional services. You will have the ability to request access to your health information via TEFCA exchange, but you will not be able to use Doctronic to share your health information with other participants in TEFCA.
3. OUR PRIVACY COMMITMENTS
We are committed to the following principles in connection with your Individually Identifiable Information obtained through our TEFCA connection:
-
Confidentiality: We use commercially reasonable efforts to protect your Individually Identifiable Information from unauthorized or illegal access, modification, use, or destruction.
-
Individual Rights: You can revoke your consent and access, export, or request deletion of your Individually Identifiable Information.
-
Exchange Purpose: Individually Identifiable Information is accessed, used, or disclosed through our TEFCA connection for treatment and care coordination purposes.
-
IAS Consent: Before we engage in patient-directed data access or sharing through our TEFCA connection, we will ask you for your informed consent first ("IAS Consent"). We will collect this IAS Consent electronically, and we keep all consents in a secure, auditable log. You may revoke your IAS Consent at any time through the following method:
- By Email: Send a revocation request to privacy@doctronic.ai with your name, email address associated with your Doctronic account, and a statement that you wish to revoke your IAS Consent.
After you revoke your IAS Consent, you will no longer be able to access our Individual Access Services through TEFCA until you provide a new IAS Consent.
Doctronic is required to act in conformance with this TEFCA Notice and must protect the security of the information it holds in accordance with the Trusted Exchange Framework and Common Agreement.
4. HOW WE USE AND SHARE YOUR INFORMATION
All disclosures through TEFCA are in accordance with the permitted and required uses specified by TEFCA and applicable U.S. Department of Health and Human Services guidance.
-
Purpose of Use: We use your Individually Identifiable Information obtained through our TEFCA connection solely to provide you with Individual Access Services -- specifically, to retrieve, compile, and make your health records available to you and your treating DPG Physician in connection with your telehealth visits for treatment and care coordination.
-
No Claims Against You: We will not use your health information to make any type of claim against you, except to collect applicable fees.
-
No Sale: We do not sell the Individually Identifiable Information we maintain as an IAS Provider.
-
Additional Disclosures: Doctronic may disclose Individually Identifiable Information to you and third parties you designate; to service providers working on our behalf (under privacy and security obligations); to law enforcement or regulatory authorities when required by law; and to additional third parties you have explicitly authorized.
-
De-Identification: We may de-identify Individually Identifiable Information in connection with our services; once de-identified, information is no longer Individually Identifiable Information.
5. RETENTION OF INFORMATION
We retain Individually Identifiable Information obtained through our TEFCA connection for the minimum duration necessary. After this period, your Individually Identifiable Information is securely deleted in accordance with industry standards.
6. GOVERNMENT AND LAW ENFORCEMENT REQUESTS
We may share your Individually Identifiable Information when the law requires or permits it, including in response to valid legal processes such as subpoenas, court orders, search warrants, or lawful demands from government authorities or law enforcement agencies. Unless the law prohibits it, we will notify you in writing or electronically within three (3) business days of receiving such a demand.
7. SECURITY MEASURES AND HOW WE PROTECT YOUR INFORMATION
We take reasonable and appropriate steps to protect your Individually Identifiable Information including encryption of all Individually Identifiable Information in transit and at rest, regardless of whether such data qualifies as TEFCA Information. We require our service providers who access your Individually Identifiable Information to maintain privacy and security protections similar to ours.
8. YOUR RIGHTS
As an IAS user, you have the following rights with respect to your Individually Identifiable Information:
-
Right to Access: You may access and view the Individually Identifiable Information we maintain in connection with your use of IAS.
-
Right to Export: You may request an export of your Individually Identifiable Information.
-
Right to Deletion: You may request that we delete your Individually Identifiable Information to the extent technically feasible and not prohibited by law. If applicable law would prohibit us from honoring your request to delete your Individually Identifiable Information, we will inform you of such prohibition.
-
Right to Be Notified of Incidents: If your Individually Identifiable Information is reasonably believed to have been affected by a security incident, we will notify you without unreasonable delay.
-
Right to Revoke Consent: You may revoke your IAS Consent at any time by following the revocation instructions in Section 3 above. Revoking your consent does not affect actions already taken.
To exercise any of these rights, email privacy@doctronic.ai or contact us using the information in Section 12 below.
9. FEES AND CHARGES
As of the effective date of this TEFCA Notice, there are no fees charged for IAS or for exercising any of the rights described herein. Telehealth Services are subject to the availability and fee terms described in the Doctronic Terms of Service. If we charge fees for IAS in the future, those fees will be listed on our website with advance notice before they take effect.
10. DURATION OF DOCTRONIC'S OBLIGATIONS
Our obligations under this TEFCA Notice apply during and after your use of IAS. These obligations continue even after you stop using IAS and remain in effect for as long as we keep any of your Individually Identifiable Information collected through IAS, as required by TEFCA and applicable law.
11. CHANGES TO THIS TEFCA NOTICE
We may update this TEFCA Notice from time to time. We will show any updates in a revised effective date at the top. If we make material changes, we will update this TEFCA Notice, notify enrolled users, and obtain new IAS Consent as required. This TEFCA Notice will be posted on our website and any user-facing application that supports IAS.
12. CONTACT US
If you have questions, concerns, or complaints about this TEFCA Notice or our privacy practices, please contact us:
Doctronic, Inc.
1140 Avenue of the Americas, 9th Floor, 5008, New York, NY 10036
Email: privacy@doctronic.ai
Phone: (415) 340-2274
Website: https://www.doctronic.ai/
We maintain a process for documenting privacy-related complaints and our responses, including the final disposition of such complaints.