Prevention
Genetic TestingNotice of Privacy Practices
Rx ReLeaf Clinic LLC
Management support provided by Rx ReLeaf LLC
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
Who this notice covers
Rx ReLeaf Clinic LLC provides clinical care under the Rx ReLeaf brand. In this notice, "we" and "the clinic" mean that clinical entity and the workforce acting for it. This notice covers protected health information the clinic creates, receives, keeps, or sends, including records held on its behalf.
Rx ReLeaf LLC provides management and administrative support. When handling the clinic's protected health information as its business associate, it must follow applicable law and the business associate agreement, protect the information, and limit its use to permitted work. Its inclusion here does not make it a second clinical provider or authorize unrestricted sharing between the companies.
Independent treating providers, laboratories, pharmacies, imaging centers, and virtual-care providers may issue their own notices. This is not a joint notice for every provider you may use.
Our responsibilities
We are legally responsible for protecting the privacy of your health information, giving you this notice, following the notice currently in effect, and notifying you when a breach of unsecured protected health information requires notification. We must follow more protective laws when they apply. No acknowledgment or optional consent waives those responsibilities.
Contact for privacy questions and requests
Executive staff handling privacy requests, Rx ReLeaf Clinic LLC
158 First Avenue, Suite 1, Atlantic Highlands, NJ 07716
Telephone: (732) 291-0000
General contact: info@rxreleaf.com
Website: https://rxreleaf.com
Ask executive staff for the person responsible for privacy requests. Call for secure instructions before sending medical details, identification documents, or payment-card information by ordinary email or a general website form. You do not need an app account to exercise your medical-information rights.
How we use and share health information
The following are permitted purposes, not permission to share every record with anyone who asks. Each disclosure must satisfy applicable legal conditions, agreed restrictions, and any extra protection described in the following sections. Where required, we limit information to what is reasonably necessary.
Treatment
We may use your history, medications, test results, and other information to evaluate and treat you and coordinate care. For example, a clinician may send relevant results to a specialist or pharmacist involved in your treatment.
Payment
We may use relevant information to bill for care, collect an amount owed, or address a claim. For example, we may give an insurer the information needed to evaluate a covered claim. This does not mean every service is insurance-covered. See your right to restrict health-plan disclosures for a fully paid service.
Clinic operations
We may use information to check quality and safety, train staff, resolve complaints, manage records, and administer services. For example, a clinician may review records to investigate a medication issue. Management and service providers may assist only within their permitted roles.
People helping with your care
We may share information relevant to a family member's, friend's, or other person's involvement in your care or payment when you agree, have an opportunity to object and do not, or the law otherwise allows. If you cannot express a choice, a professional may use judgment about your best interests. Disaster-relief disclosures are subject to similar safeguards.
Public health and safety
Law may permit or require reports of disease, product defects or recalls, medication reactions, abuse, neglect, or domestic violence. We may share information to address a serious and imminent threat under applicable legal conditions.
Oversight and legal duties
We may provide information for authorized audits, licensing, inspections, and legally required reporting, including federal privacy enforcement. Legal duties do not erase protections for specially protected records.
Courts and law enforcement
We may respond to a valid court or administrative order, qualifying subpoena, or permitted law-enforcement request only when the applicable requirements are satisfied. A request or subpoena alone does not automatically authorize release of every record.
Other legally permitted purposes
Information may be shared for qualifying workers' compensation purposes; organ, eye, or tissue donation; authorized work of a coroner, medical examiner, or funeral director; and limited military, national-security, protective-service, or lawful-custody purposes. If research is involved, we need your authorization or a legally permitted research basis, such as an approved waiver.
Information with additional protections
When written authorization is needed
We make uses or disclosures not described in this notice only with your written authorization. We must obtain a valid authorization for uses or disclosures that HIPAA defines as marketing, sales of protected health information, and most uses or sharing of separately maintained psychotherapy notes, except for the specific legal exceptions to those categories.
When required by law, a marketing authorization states that we receive financial remuneration from a third party. An authorization for a sale of protected health information states that the disclosure will result in remuneration to us. An ordinary promotional-text or email opt-in is not a substitute for a required HIPAA authorization. Ordinary care is not conditioned on optional marketing or Ashley permission.
You may revoke an authorization in writing through executive staff handling privacy requests. Revocation stops future reliance on it but does not undo action already taken in reliance on it; applicable insurance-related exceptions may also apply. Ask us if you need help identifying the authorization you want to revoke.
Substance use disorder treatment records
Some records from federally assisted substance use disorder programs are protected by 42 CFR Part 2. If we receive or maintain these records, their additional protections apply. Receiving a protected record does not by itself mean Rx ReLeaf operates a Part 2 treatment program, and not every mention of substance use is a Part 2 record.
We need a permitted Part 2 basis, such as an appropriate written consent or a specific exception, before using or sharing those records. When a valid consent permits treatment, payment, and health care operations, a HIPAA-covered recipient may use and redisclose the records as the law allows, subject to Part 2's restrictions on proceedings against you. A general acknowledgment of this notice is not that consent.
Part 2 records, or testimony describing their contents, may not be used or disclosed in civil, criminal, administrative, or legislative investigations or proceedings against you without the required written consent or a qualifying court order following notice and an opportunity to be heard for you or the record holder. Such an order must also be accompanied by a subpoena or other legal requirement compelling disclosure. A subpoena alone is not enough. Consent for a proceeding must be separate from consent for another purpose.
New Jersey and other confidentiality rules
New Jersey laws may add limits for HIV-related information and genetic testing or information, requiring specific informed written permission unless a statutory exception applies. Certain mental-health and legally confidential minor-care records also have extra protections. We apply the rule that governs the record, provider, and disclosure; a general treatment, payment, or operations purpose does not override a stricter rule.
New Jersey also restricts disclosure of information about reproductive health care lawful in this state in specified civil, probate, legislative, and administrative proceedings. You have a right to withhold the written consent required for such disclosure, subject to the statute's exceptions. We explain that right when the law requires, including when relevant care is provided or prior care is disclosed.
If your care crosses state lines or another protective law applies, we evaluate that law as well. Ask executive staff for the privacy contact about a particular record or requested disclosure.
Your rights over health information
Contact executive staff handling privacy requests using the contact information above to make any request below. We may verify your identity and your representative's authority without creating unreasonable obstacles. We explain any required written request and provide assistance. A legally shorter deadline or stronger protection controls.
See or obtain records
You may inspect or request a paper or electronic copy of health and billing records in the record sets used to make decisions about you. Request your preferred format; we provide it if readily producible, or agree on an available alternative. We provide copies within 30 days where New Jersey's professional-record rule applies, or sooner when law requires. A HIPAA extension does not override a stricter rule. Fees must be lawful and reasonable, with applicable fee waivers. We cannot charge for search or retrieval for your HIPAA access request or withhold access because you owe for care. A lawful denial explains the reason and any available review or complaint rights.
Request a correction
Ask in writing for an amendment and explain what is incorrect or incomplete. HIPAA generally requires a decision within 60 days, with one additional 30-day extension after written notice. A correction need not erase the original record. If we deny the request, we explain why and how you may submit a disagreement or request that the request and denial accompany relevant later disclosures.
Choose confidential contact
We accommodate reasonable requests for an alternate contact method or location, such as a different phone number or mailing address. You do not have to explain why to the clinic. Tell us the alternate method and, where relevant, how payment communication will be handled.
Ask for limits on sharing
You may request limits on treatment, payment, operations, or sharing with people involved in your care. We generally need not agree, but we honor an accepted restriction subject to legal exceptions, including necessary emergency treatment. For a service or item paid in full by you or someone other than the health plan, we must honor a request not to disclose information solely about that service to the plan for payment or operations, unless disclosure is required by law.
Obtain an accounting
You may request a list of disclosures covered by HIPAA's accounting rule for up to the previous six years. The rule excludes certain disclosures, including ordinary treatment, payment, operations, and disclosures made under your authorization. We ordinarily respond within 60 days, with one permitted 30-day extension after written notice. The first accounting in a 12-month period is free; we explain any permitted fee for an additional request before you proceed.
Receive this notice and use a representative
You may obtain a paper notice at any time, even after choosing electronic delivery. A person with legal authority may exercise rights for you after we verify that authority, subject to limits protecting minors and people at risk of abuse or harm. You may complain without retaliation, as described in the following sections.
Communication choices and privacy questions
Systems and optional services
We may use scheduling, recordkeeping, payment, communications, and administrative providers for permitted work. Appropriate privacy agreements and eligible settings are required when a business associate handles protected health information. Naming a vendor does not certify that all its products are suitable for medical information.
The Privacy Policy explains website and app-specific data handling, including Boulevard scheduling and HubSpot relationship tools when eligible and enabled. It supplements this clinical notice. A HIPAA notice acknowledgment alone does not grant those tools unrestricted access or authorize health-data advertising.
For app-based Ashley assistance through Retell AI and OpenAI, a separate disclosure identifying the recipients, data, and purpose and your express permission are required before conversation information is sent. You may decline or withdraw that permission and use other app features. An AI permission does not replace an applicable HIPAA or Part 2 authorization, a required agreement, or a security safeguard.
Service messages and marketing
We may communicate about appointments, account security, requested care, treatment alternatives, or administration when permitted. Optional service texts and promotional texts have separate choices; declining marketing does not prevent care. Use the unsubscribe link in promotional email or contact us to change preferences. Reply STOP to texts to stop messages from that sender; this may also stop optional service texts. Contact us for another way to receive service information. Replying START alone does not establish marketing permission. Message and data rates may apply.
If we send fundraising communications, you can opt out without affecting care. Before using Part 2 records for fundraising, we must give you a clear and conspicuous opportunity to elect not to receive those messages. This notice does not itself authorize fundraising, health-data marketing, or sharing patient information with advertising platforms.
Notice receipt and future changes
We provide this notice at first service as required and ask for acknowledgment of receipt. Signing is voluntary; declining does not affect care or grant optional permissions. We document an unsuccessful good-faith effort and the reason. In an emergency, we provide the notice as soon as reasonably practicable; an acknowledgment effort is not required for emergency treatment. A current notice is available in the clinic and electronically, with paper copies on request. Required medical and privacy records may remain after an app account is deleted.
We may revise this notice when lawful and apply the revised terms to information already held, as well as new information. We make the new notice available in the clinic, on our website, and through the app when available, with its actual effective date. A revision does not override stricter law or retroactively create an authorization.
Complaints without retaliation
Call (732) 291-0000 and ask executive staff for the privacy contact, or mail a complaint to the address above. You may also contact the U.S. Department of Health and Human Services Office for Civil Rights at 200 Independence Avenue SW, Washington, DC 20201; call 1-800-368-1019; or use HHS Office for Civil Rights complaint information. We will not retaliate against you for a privacy complaint. You do not have to complain to us first.
