LEGAL & PRIVACY

Privacy Policy

Technology platform and administrative-services privacy practices

This Privacy Policy explains how A Plus Assist LLC, doing business as Omni Vita Medical (“Omni Vita Medical,” “Omni Vita,” “Company,” “we,” “us,” or “our”), collects, uses, discloses, and protects personal information when you visit https://omnivita.codvikscribe.org, use links or features made available through that website, access services through our technology platform, communicate with us, or otherwise interact with us (collectively, the “Platform”).

Please read this Privacy Policy carefully. This Privacy Policy is a notice of our privacy practices; it is not a consent to medical treatment, a HIPAA authorization, or a Notice of Privacy Practices issued by a healthcare provider.

1. Our Role and the Scope of This Policy

        Omni Vita Medical operates a technology and administrative-services platform that enables adults to access services offered by independent licensed healthcare providers and products or services furnished by independent pharmacies, laboratories, and other third parties.

        Omni Vita Medical is not a medical group, healthcare provider, pharmacy, or laboratory. Omni Vita does not diagnose medical conditions, prescribe or dispense medications, order laboratory testing, or control the independent professional judgment of healthcare providers, pharmacists, or laboratories.

        Clinical services accessed through the Platform are furnished by an independent professional medical practice (the “Medical Group”) and its licensed healthcare professionals. The Medical Group and its clinicians are solely responsible for clinical evaluations, diagnoses, treatment decisions, prescribing decisions, medical-record obligations, and other aspects of clinical care. Pharmacies are solely responsible for dispensing decisions and pharmacy services. Laboratories are solely responsible for laboratory services.

        This Privacy Policy describes the privacy practices of Omni Vita Medical. The Medical Group, pharmacies, laboratories, and other independent organizations may collect, use, maintain, and disclose information under their own privacy notices, terms, and, when applicable, HIPAA Notices of Privacy Practices. Their practices are not governed solely by this Privacy Policy.

        Omni Vita Medical has entered into a Business Associate Agreement with the Medical Group. When Omni Vita Medical creates, receives, maintains, or transmits Protected Health Information (“PHI”) on behalf of the Medical Group, Omni Vita acts as a business associate and handles that PHI as permitted by the Business Associate Agreement, the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), and other applicable law. This Privacy Policy does not replace the Medical Group’s Notice of Privacy Practices. If this Privacy Policy conflicts with an applicable Notice of Privacy Practices concerning PHI, the Notice of Privacy Practices and applicable law control.

        Our separate Consumer Health Data Privacy Policy supplements this Privacy Policy and applies to consumer health data covered by Washington’s My Health My Data Act, Nevada’s consumer health data law, and similar state laws.

2. Eligibility and Geographic Scope

        The Platform and services available through it are intended only for individuals who are at least eighteen (18) years old. The Platform is intended for use in the United States. Services, providers, tests, pharmacies, and treatment options may not be available in every state or to every person.

3. Personal Information We Collect

        The information we collect depends on how you interact with the Platform and which services you request.

3.1 Information You Provide

        We may collect the following information directly from you:

• Identifiers and contact information, such as your name, date of birth, email address, telephone number, mailing address, billing address, and account identifiers.
• Account and authentication information, such as login credentials, security questions, verification information, and information used to maintain or secure an account.
• Identity and location information, such as your state of residence, physical location at the time of a telehealth encounter, and identity-verification information. This information may be needed to verify eligibility and provider licensure.
• Demographic and profile information, such as age, sex, gender, height, weight, and other profile details.
• Health and treatment information, such as symptoms, health history, diagnoses, allergies, medications, treatment interests, health goals, photographs, laboratory information, vital signs, and answers submitted through health assessments or intake forms.
• Communications and medical-record information, including messages exchanged with providers or support personnel, provider communications, care-coordination information, and records or documents you upload or transmit through the Platform.
• Transaction and billing information, such as products or services requested, order history, charges, refunds, payment status, billing contact information, and transaction identifiers. Payment-card information is collected and processed through Prescribery’s payment workflow using Braintree. Omni Vita may receive limited transaction information but does not intentionally store complete payment-card numbers on its public website.
• Customer-support information, including the content of emails, telephone calls, text messages, portal messages, complaints, requests, and other communications with us.
• Marketing preferences and consent records, including whether you have asked to receive or stop receiving promotional email or text messages.
• Other information you choose to provide, such as survey responses, feedback, testimonials, or documents submitted in connection with a request.

Please do not send sensitive medical information through ordinary email or text message when the secure patient portal is available.

3.2 Information Collected Automatically

        When you use the Platform, we and service providers supporting the Platform may automatically collect:

• Internet Protocol (IP) address;
• browser type, device type, operating system, and device identifiers;
• approximate location derived from IP address;
• pages or features viewed, links selected, dates and times of access, referring pages, and error logs;
• session, authentication, fraud-prevention, and security information; and
• cookie and similar technology information.

This information is not necessarily anonymous and may be considered personal information under applicable law.

3.3 Information Received from Other Sources

        We may receive information from:

• the Medical Group and its licensed providers;
• Prescribery, which supports the patient portal, workflow, customer-support, billing, and administrative technology used in connection with the Platform;
• Labcorp and its affiliated laboratories;
• pharmacies involved in fulfilling a prescription or order;
• Braintree and other entities involved in payment processing through Prescribery;
• SiteGround and other website-hosting, security, telecommunications, or infrastructure providers;
• persons you authorize to communicate with us; and
• government agencies, public sources, or fraud-prevention services when permitted by law.

4. Cookies and Similar Technologies

        We and our service providers may use cookies and similar technologies that are reasonably necessary to operate the website, maintain sessions, remember preferences, protect accounts, prevent fraud, diagnose errors, and understand basic Platform performance.

Omni Vita Medical does not sell personal information or consumer health data and does not use consumer health data for targeted advertising. We do not permit information collected from authenticated patient areas to be used for targeted advertising.

You may be able to manage cookies through your browser or device settings. Disabling necessary cookies may prevent parts of the Platform from functioning properly. Where required by law, we honor legally recognized browser-based opt-out preference signals, such as Global Privacy Control.

If we materially change our use of analytics, advertising, or tracking technologies, we will update this Privacy Policy and obtain consent where required before applying the new practice.

5. How We Use Personal Information

We may use personal information to:

• operate, maintain, secure, and improve the Platform;
• create and administer accounts;
• connect users with the Medical Group and licensed healthcare providers;
• transmit health assessments, intake information, messages, and other information to providers for independent evaluation;
• support scheduling, billing, customer service, technical troubleshooting, and care coordination;
• coordinate provider-authorized prescriptions, laboratory services, pharmacy fulfillment, shipping, and order status;
• process payments, refunds, and related transactions;
• verify identity, age, location, eligibility, and account security;
• communicate about accounts, appointments, orders, laboratory services, prescriptions, safety information, policy changes, and other requested or operational matters;
• respond to questions, complaints, privacy requests, and support inquiries;
• detect, investigate, and prevent fraud, misuse, security incidents, illegal activity, or violations of our terms;
• comply with legal, regulatory, contractual, audit, tax, accounting, reporting, and recordkeeping requirements;
• establish, exercise, or defend legal claims;
• create aggregate or de-identified information where permitted by law; and
• send promotional communications only as described in Section 10 and as permitted by applicable law.

Omni Vita Medical does not use personal information to make clinical decisions. Clinical eligibility and treatment decisions are made solely by licensed healthcare providers.

6. How We Disclose Personal Information

        We may disclose personal information as follows:

6.1 Medical Group and Licensed Providers

        We disclose personal information to the applicable Medical Group and its licensed providers so they can conduct independent medical evaluations, communicate with patients, provide treatment, maintain medical records, and perform other legally permitted healthcare activities.

6.2 Prescribery

        Prescribery supports the patient portal, intake and workflow technology, customer-support functions, billing workflow, and related administrative services. Information entered into or transmitted through those systems may be processed by Prescribery as necessary to provide those functions and in accordance with applicable contractual and legal requirements.

6.3 Laboratories

        We may facilitate disclosures to Labcorp and its affiliated laboratories when laboratory testing is requested or ordered. Laboratory information may include identifying information, provider orders, diagnosis or billing codes when applicable, specimen information, and test results.

6.4 Pharmacies and Fulfillment Organizations

        When a licensed provider issues a prescription or a user requests fulfillment services, information may be disclosed to an appropriate pharmacy or fulfillment organization. Current pharmacy relationships may include Strive Pharmacy, Belmar Pharmacy, The Pharmacy Hub, and Empower Pharmacy. The particular pharmacy used may depend on the prescription, patient location, availability, provider direction, and other factors.

Pharmacies may receive identifying and contact information, prescription information, provider information, relevant clinical information, allergy information, payment or order information, and shipping details needed to evaluate, dispense, and deliver a prescription.

6.5 Payment Processing

        Payments currently are processed through Prescribery’s payment workflow using Braintree. Payment processors may collect payment-card and billing information directly and may provide us or Prescribery with transaction identifiers, status, amount, and fraud-prevention information. Payment processors maintain information under their own privacy and security practices.

6.6 Technology and Business Service Providers

        We may disclose information to vendors that perform services for us, such as SiteGround for public website hosting and related infrastructure, as well as vendors supporting security, communications, data storage, customer service, professional advice, auditing, accounting, and legal compliance. These vendors may use information only to perform services for us or as otherwise permitted by their contracts and applicable law.

        When a vendor will create, receive, maintain, or transmit PHI on behalf of Omni Vita in its role as a business associate, we require an appropriate Business Associate Agreement when required by HIPAA.

6.7 At Your Direction or With Your Consent

        We may disclose information to a caregiver, representative, provider, pharmacy, laboratory, or other person when you direct or authorize us to do so.

6.8 Legal, Safety, and Security Purposes

        We may disclose information when we reasonably believe disclosure is necessary to comply with law or valid legal process; respond to lawful government requests; protect the rights, safety, or property of users, providers, the Company, or others; investigate fraud or security incidents; or enforce agreements and policies. PHI will be disclosed only as permitted by the applicable Business Associate Agreement and law.

6.9 Business Transactions

        Information may be reviewed or transferred in connection with a proposed or completed merger, financing, acquisition, reorganization, sale of assets, bankruptcy, or similar transaction, subject to applicable confidentiality, HIPAA, consumer health data, and other legal restrictions.

6.10 Aggregate and De-Identified Information

        We may use or disclose information that has been aggregated or de-identified in accordance with applicable law and contractual requirements. We do not attempt to re-identify lawfully de-identified information except as permitted to test or validate the de-identification process or as otherwise required by law.

7. No Sale of Personal or Consumer Health Data

        Omni Vita Medical does not sell personal information or consumer health data for money or other valuable consideration. We do not share personal information for cross-context behavioral advertising and do not use consumer health data for targeted advertising.

        If our practices change, we will update this Privacy Policy and obtain consent or authorization before the change when required by law. We will not sell consumer health data without a separate, valid authorization that satisfies applicable law.

8. Health Information and HIPAA

        Not every piece of health-related information is PHI under HIPAA. HIPAA generally applies to individually identifiable health information maintained by or on behalf of a HIPAA-covered healthcare provider, health plan, or healthcare clearinghouse. Health-related information not covered by HIPAA may nevertheless be protected by state consumer health data and general privacy laws.

        When acting on behalf of the Medical Group under our Business Associate Agreement, authorized Omni Vita personnel may access medical intake information, demographic and contact information, treatment and order status, provider messages or medical-record information, and other PHI as reasonably necessary to perform contracted administrative functions. Those functions may include customer-support troubleshooting, billing support, care coordination, provider and pharmacy coordination, security, and other services permitted by the Business Associate Agreement.

        Omni Vita Medical limits its use and disclosure of PHI to the purposes permitted by the Business Associate Agreement and applicable law. We do not use acceptance of this Privacy Policy as a HIPAA authorization.

        Requests concerning access to, amendment of, restrictions on, or an accounting of disclosures of the Medical Group’s designated medical record should be directed to the Medical Group through the patient portal or the contact method identified in its Notice of Privacy Practices. We may assist in routing a request but do not replace the Medical Group’s legal responsibilities.

        Pharmacies and laboratories may be HIPAA-covered entities with their own Notices of Privacy Practices. Questions about records maintained independently by a pharmacy or laboratory should be directed to that organization.

9. Cash-Pay Services and Payment Information

        Services accessed through the Platform currently are offered on a cash-pay basis. Omni Vita Medical does not submit insurance claims or collect insurance information for insurance reimbursement as part of its ordinary Platform operations.

        Payment-card information is processed through Prescribery’s workflow using Braintree. Please review any privacy notice presented by the payment processor. We retain transaction and accounting information as reasonably necessary for orders, refunds, fraud prevention, legal compliance, and business records.

10. Email, Telephone, and Text Communications

10.1 Operational Communications

        We may send communications that are necessary or useful to administer an account or requested service, including appointment reminders, provider-message notifications, order and shipping updates, laboratory notifications, security alerts, billing notices, and responses to support requests. Opting out of promotional messages does not stop these operational communications.

10.2 Promotional Email

        We may send promotional email when you have requested it or when otherwise permitted by law. Promotional email will provide a method to unsubscribe. You may also ask to stop promotional email by contacting info@omnivitamedical.com. We may retain your email address on a suppression list to honor the request.

10.3 Promotional Text Messages

        Omni Vita Medical will send promotional text messages only after obtaining any separate consent required by law. Consent to promotional texts is not a condition of purchasing or receiving services. Message frequency may vary, and message and data rates may apply. You may revoke consent by replying STOP or by contacting us. For assistance, reply HELP or call 443-690-2622.

        Ordinary email and text messaging may not be secure. Do not use those channels for urgent medical concerns or detailed medical information. Use the secure patient portal for clinical communications. If you believe you are experiencing a medical emergency, call 911.

10.4 Health Information in Marketing

        We do not use or disclose PHI to send marketing communications unless the Medical Group has determined that the communication is permitted by HIPAA and the Business Associate Agreement or a valid HIPAA authorization has been obtained when required. We do not disclose mobile telephone numbers or consent records to third parties for their independent marketing.

11. Data Retention

        We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide requested services, maintain accounts, support care coordination, complete transactions, comply with the Business Associate Agreement, satisfy legal and regulatory obligations, resolve disputes, enforce agreements, prevent fraud, and protect security.

        Retention periods vary according to the type of information, the relationship in which it was collected, legal requirements, contractual obligations, and technical considerations. For example:

• medical records are retained by the Medical Group according to healthcare record-retention requirements and its Notice of Privacy Practices;
• PHI maintained by Omni Vita on behalf of the Medical Group is retained or returned according to the Business Associate Agreement and applicable law;
• transaction, accounting, tax, and fraud-prevention records may be retained for legally required or reasonably necessary periods;
• marketing preferences and suppression records may be retained to honor opt-out requests; and
• backups may retain information for a limited period until they are overwritten or securely deleted in the ordinary course.

When information is no longer required, we take reasonable steps to delete, de-identify, or securely dispose of it, subject to applicable legal and contractual exceptions.

12. Data Security

        We use reasonable administrative, technical, and physical safeguards designed to protect personal information. Depending on the information and system, safeguards may include access controls, authentication, encryption in transit or at rest where appropriate, vendor oversight, workforce training, monitoring, incident response, and contractual confidentiality and security requirements.

        No method of transmission or storage is completely secure. We cannot guarantee absolute security. You are responsible for protecting account credentials, using a strong and unique password, securing devices, and notifying us promptly if you believe an account or communication has been compromised.

13. Your Privacy Rights and Choices

        Depending on where you live and subject to applicable exceptions, you may have the right to:

• confirm whether we process personal information about you;
• access or obtain a copy of personal information;
• correct inaccurate personal information;
• delete personal information;
• obtain certain information in a portable format;
• obtain information about categories of third parties or specific third parties to whom information was disclosed;
• withdraw consent for processing based on consent;
• opt out of the sale of personal information, targeted advertising, or certain profiling;
• limit certain uses or disclosures of sensitive personal information;
• appeal a decision concerning a privacy request; and
• receive equal service without unlawful discrimination for exercising privacy rights.

        Because we do not sell personal information or use it for targeted advertising, there is no sale or targeted-advertising activity to opt out of under our current practices.

        To exercise a privacy right, email info@omnivitamedical.com with the subject line “Privacy Request,” call 443-690-2622, or write to the address in Section 19. Please describe the request and the state in which you reside. You do not need to create a new account solely to submit a request.

        We may take reasonable steps to verify your identity and authority. An authorized agent may submit a request when permitted by law, but we may request proof of authorization and may verify the request directly with you. We will respond within the period required by applicable law. If we deny a request, you may appeal by emailing info@omnivitamedical.com with the subject line “Privacy Appeal.”

        Certain information may be exempt from a request, including information we or another organization must retain to comply with healthcare, tax, fraud-prevention, security, legal, or contractual obligations. Requests concerning the Medical Group’s designated medical record are handled under the Medical Group’s Notice of Privacy Practices, although we may help route the request.

        Consumer health data rights and request procedures are described further in our Consumer Health Data Privacy Policy.

14. Supplemental State Privacy Disclosures

        State privacy laws may require additional disclosures concerning categories of personal information. During the preceding twelve months, we may have collected and disclosed for business purposes the following categories, depending on how a person used the Platform:

• Identifiers: name, address, email, phone number, date of birth, IP address, account identifiers, and similar information.
• Customer and transaction records: contact, billing, order, payment-status, and customer-service information.
• Internet or electronic activity: device, browser, cookie, access, session, security, and interaction information.
• Commercial information: products or services considered, requested, purchased, or fulfilled.
• Sensitive personal information: health information, account credentials, payment information handled by the payment processor, precise identity-verification information when collected, and information concerning sexual or reproductive health when relevant to requested services.
• Professional or medical information: health history, provider communications, prescriptions, laboratory information, and treatment-related information.
• Audio, electronic, or communications information: emails, texts, portal messages, support communications, and telephone communications.
• Inferences: limited inferences about service interests or eligibility drawn from information you provide or your interactions with the Platform.

        The sources, purposes, and recipients of these categories are described in Sections 3, 5, and 6. We do not sell these categories or share them for cross-context behavioral advertising. We do not offer financial incentives in exchange for personal information. The Platform is not intended for minors, and we do not knowingly sell or share personal information of individuals under sixteen years old.

        We process sensitive personal information only as reasonably necessary to provide requested services, maintain security and integrity, comply with law, and perform other legally permitted purposes, or with consent when required.

15. Consumer Health Data

        Health information may be protected even when HIPAA does not apply. Our Consumer Health Data Privacy Policy describes the health-related information we collect, the sources and purposes of that information, the categories of entities with which it is shared, and the rights available under consumer health data laws.

We do not sell consumer health data, use it for targeted advertising, or use geofencing technology to identify or track individuals seeking healthcare services at a specific healthcare location.

16. Third-Party Websites and Services

        The Platform may link to or integrate with websites, portals, payment services, pharmacies, laboratories, delivery services, or other services operated by third parties. Those third parties may collect information directly and apply their own privacy notices and terms. We encourage you to review their notices. Omni Vita Medical is not responsible for the independent privacy practices of organizations it does not control, except to the extent applicable law or a contract assigns responsibility to Omni Vita.

17. Children and Minors

        The Platform is intended only for adults age eighteen or older. We do not knowingly collect personal information from a person under eighteen through the Platform for the purpose of providing the services described here. If you believe a minor has provided information to us, contact us so we can review and take appropriate action. Medical-record retention or other legal obligations may affect whether and how particular information can be deleted.

18. Changes to This Privacy Policy

        We may update this Privacy Policy to reflect changes in law, technology, vendors, services, or our information practices. We will post the revised version and update the “Last Updated” date. If a change is material, we will provide additional notice or obtain consent before applying the change when required by law.

        We will not collect additional categories of consumer health data or use consumer health data for materially different purposes without providing the notice and obtaining the consent required by applicable law.

19. Contact Us

        Questions, complaints, or privacy requests may be directed to:

A Plus Assist LLC d/b/a Omni Vita Medical
Attn: Privacy
7901 4th Street North, Suite 300
St. Petersburg, Florida 33702
Email: info@omnivitamedical.com
Phone: 443-690-2622

Please do not use these contact methods for a medical emergency. Call 911 for emergencies. Clinical questions and medical-record requests should be submitted through the patient portal or directed to the Medical Group as described in its Notice of Privacy Practices.