Notice of Privacy Practices

Our duties

• We are required by law to keep your protected health information ("health information") private and to give you this notice of our legal duties and privacy practices.
• We must follow the terms of the notice currently in effect.
• We will tell you promptly if a breach occurs that may have compromised the privacy or security of your information.
• We will not use or share your information other than as described here unless you tell us we can in writing. You may change your mind at any time by letting us know in writing.

How we use and share your health information

• Treatment. When you order a test online, we use and share your information so a licensed provider can review and order your test, so the laboratory can perform it, and so results can be reported to you and that provider. Example: the reviewing provider sees your questionnaire answers before approving your order.
• Payment. We use your order information to process the payment you make directly for your test. Card payments are handled by our payment providers, and we do not store your full card number. We do not bill health plans or insurance.
• Health care operations. We use and share your information to run our services, improve quality and meet laboratory, accreditation and regulatory requirements. Example: we review records for quality control.
• Business associates. We share information with companies that perform services for us, such as portal operation and hosting, kit shipping and message delivery. They must sign agreements to protect your information. Our online store receives only the order, contact and payment details needed to complete your purchase. It does not receive your questionnaire answers, consents, sample details or test results; those are collected only in the patient portal.
• Order messages. We may contact you about your order, such as reminders to finish your questionnaire, sign a consent or return your kit.
• Research. Unless you opt out, we may use your samples and related information for research. You are offered the choice to opt out when your order is created and again when you sign your order. You can change your choice at any time by emailing cybersecurity001@clinlgx.xyz.

Other ways we may use or share your information

We are allowed or required to share your information in other ways, usually to contribute to the public good. We must meet many conditions in the law before we can share it for these purposes:

• As required by federal, state or local law.
• Public health and safety: reporting certain diseases or test results to public health authorities, reporting suspected abuse, neglect or domestic violence, and preventing a serious threat to health or safety.
• Health oversight: audits, inspections and licensing by agencies such as those that oversee laboratories.
• Lawsuits and legal actions: in response to a court or administrative order, or a subpoena.
• Law enforcement purposes, as the law allows.
• Coroners, medical examiners and funeral directors, and organ and tissue donation organizations.
• Workers' compensation, and special government functions such as military, national security and protective services.

Uses that need your written permission

• Marketing purposes. Signing up for promotional emails from our store is a separate choice, and we never use your health information for marketing without your written authorization.
• Sale of your information. We do not sell your information.
• Most sharing of psychotherapy notes.
• Any other use not described in this notice.

Your choices

You can tell us whether to share information with family, close friends or others involved in your care or payment. If you cannot tell us, we may share it if we believe it is in your best interest. We test patients of all ages, including newborns. Tests for anyone under 18 must be ordered by a parent or legal guardian, who generally acts for the patient as state law allows.

Your rights

• Get a copy of your health information. You can ask to see or get an electronic or paper copy of your test results and other health information. You can get completed test reports directly from the laboratory. We will usually provide them within 30 days of your request and may charge a reasonable, cost-based fee.
• Ask us to correct your health information if you think it is incorrect or incomplete. We may say no, but we will tell you why in writing within 60 days.
• Ask for confidential communications, such as contacting you at a different address or phone number. We will say yes to all reasonable requests.
• Ask us to limit what we use or share. We are not required to agree, except that if you pay for a service in full out of pocket, you can ask us not to share that information with a health plan for payment or operations, and we will say yes unless the law requires us to share it.
• Get a list of those with whom we have shared your information for the six years before your request, except for treatment, payment, operations and certain other disclosures. One list a year is free.
• Get a paper copy of this notice at any time, even if you agreed to get it electronically.
• Choose someone to act for you. If someone is your legal guardian or has medical power of attorney, that person can exercise your rights.
• File a complaint if you believe your rights were violated. Contact our Privacy Officer above, or the U.S. Department of Health and Human Services Office for Civil Rights, 200 Independence Avenue SW, Washington, DC 20201, 1-877-696-6775, www.hhs.gov/ocr/privacy/hipaa/complaints/. We will not retaliate against you for filing a complaint.

Record retention

We keep order and test records indefinitely, and in every case for at least as long as laboratory, medical record, tax and legal rules require.

State law

Some state laws give more protection than HIPAA for certain information, such as genetic, HIV or mental health information. Where they do, we follow the stricter law, including for customers who order from other states.

Changes to this notice

We can change the terms of this notice, and the changes will apply to all information we have about you. The new notice will be available on request, in the patient portal and at mypinnacleallergy.online/privacy-notice.