Notice of Privacy Practices

Our commitment to your protected health information

This notice describes how medical information about you may be used and disclosed, and how you can get access to this information. Please review it carefully.

Your protected health information (PHI) — the health details you share during intake, your visit records, prescriptions, and lab results — is created and maintained by the independent clinical, laboratory, and pharmacy partners who deliver your care. Those partners, and Oravix where it acts on their behalf, are required by law to maintain the privacy of your PHI, to give you this notice of legal duties and privacy practices, and to follow the terms of the notice currently in effect.

How we may use and disclose your PHI

For treatment. Your PHI is used to provide your care. For example, the provider reviewing your intake reads your health history to decide whether a treatment is appropriate, and a pharmacy receives your prescription so it can fill and ship your medication.

For payment. Your PHI may be used to bill and collect payment for your care. For example, confirming that a consultation occurred so the consultation fee can be processed.

For healthcare operations. Your PHI may be used to run and improve clinical services — for example, quality review of provider care, licensing compliance, and care coordination between your provider, the lab, and the pharmacy.

Other permitted disclosures. We may use or disclose PHI when required by law; for public health activities; to report suspected abuse or neglect as required; for health oversight activities such as audits; in response to valid legal process; to avert a serious threat to health or safety; and to a coroner, medical examiner, or funeral director as permitted by law.

Uses requiring your written authorization

Uses and disclosures of PHI not described in this notice will be made only with your written authorization, and you may revoke an authorization at any time in writing (except to the extent action has already been taken in reliance on it).

Marketing never uses your PHI. Oravix's marketing and analytics tools are architecturally separated from clinical systems: your health answers, records, and messages do not flow into them. We will never sell your PHI, and we will never use it for marketing without your explicit written authorization.

Your rights regarding your PHI

Right to inspect and copy. You may request an electronic or paper copy of your medical record. We must respond within the time HIPAA allows, and a reasonable, cost-based fee may apply for copies.

Right to amend. If you believe information in your record is incorrect or incomplete, you may request an amendment. A request may be denied in certain cases, and you have the right to submit a statement of disagreement.

Right to an accounting of disclosures. You may request a list of certain disclosures of your PHI made in the six years prior to your request (excluding disclosures for treatment, payment, and healthcare operations, among other exceptions).

Right to request restrictions. You may ask for limits on how your PHI is used or disclosed. We are not required to agree to all restrictions, but we must comply with a request to restrict disclosure to a health plan when the disclosure is for payment or operations and you paid for the item or service in full out of pocket.

Right to confidential communications. You may ask that we contact you in a specific way (for example, only by email, or only at a certain phone number), and we will accommodate reasonable requests.

Right to a paper copy of this notice. You may request a paper copy at any time, even if you agreed to receive it electronically.

Right to complain without retaliation. If you believe your privacy rights have been violated, you may file a complaint with us or with the U.S. Department of Health and Human Services, Office for Civil Rights. You will never be retaliated against for filing a complaint.

Our duties

We are required by law to maintain the privacy and security of your PHI, to provide you this notice of our legal duties and privacy practices, to abide by the terms of the notice currently in effect, and to notify you if a breach occurs that may have compromised the privacy or security of your information.

We reserve the right to change this notice and to make the revised notice effective for PHI we already hold as well as information we receive in the future. The current notice, with its effective date and version, will always be available on this page.

Breach notification

If a breach of unsecured PHI affecting you occurs, you will be notified without unreasonable delay and within the timeframes required by law, with a description of what happened, what information was involved, the steps being taken, and what you can do to protect yourself.

Complaints and contact

To exercise any of the rights above, ask questions about this notice, or file a complaint, contact our privacy officer at care@oravixhealth.com. You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights — in writing, online, or by phone — and doing so will never affect your care.

Effective date and version

This notice is effective as of July 6, 2026 (draft pending counsel review). Document version: npp-v1.0-draft. When you accept this notice during intake, a record of the version, timestamp, and your user identifier is stored with your consent records.