Spacial Healthcare Professionals Notice of Privacy Practices

Effective Date: December 1^st, 2023

THIS NOTICE OF PRIVACY PRACTICES DESCRIBES HOW PERSONAL HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

If you have any questions about this Notice or want information about exercising any of your rights, you may contact us at privacy@spacialhealthcare.com.

Spacial Health Inc. (“Spacial”) is a wholly owned subsidiary of Hoberman Rockets LLC. Spacial offers online telehealth services enabling our registered members (“Members”) to report their health history and engage independent healthcare professionals (“Healthcare Professionals”) to obtain medical and healthcare services.

The Healthcare Professionals who deliver health care services through Spacial (“Services”) are independent professionals practicing within groups of independently owned professional practices. The practices that are subject to this Notice include, but are not limited to, Global Food Initiative LLC. The professional practices within which the Spacial Healthcare Professionals practice are collectively known as “Spacial Professionals” (“us”, “we”, “our”). 

This Notice of Privacy Practices or “Notice” describes how Spacial Professionals may use and disclose your PHI and how you can access this information. Spacial is a clinically integrated care setting in which our Members receive Services from more than one health care provider. The Spacial Professionals are part of an organized health care arrangement (OHCA), and jointly participate in numerous activities including quality assessment and improvement activities. Your PHI may be shared among the Spacial Professionals as necessary to carry out treatment, payment, and/or health care operations related to the OHCA. All participants in the OHCA arrangement are required to abide by this Notice.

We understand that information about you and your health is personal. By “PHI,” we mean protected health information as defined under federal law (the Health Insurance Portability and Accountability Act, or HIPAA, and its implementing regulations). Not only is it our legal obligation to provide and comply with this Notice to maintain the privacy of PHI in compliance with applicable law, but it is our business imperative to ensure the confidentiality of your PHI. We continuously seek to safeguard your PHI through administrative, physical, and technical means, and otherwise abide by applicable federal and state laws.

For information about our collection, use, and disclosure of personal information other than PHI, please see our privacy policy at https://www.spacialhealth.com/privacy-policy

Information We Collect About You

To provide you with the Services, we collect PHI about you from various sources.

PHI Collected From You

As you use the Services, you will need to provide us with information, including PHI, about you, including your medical history, past treatment, and potential future treatment options. As you communicate with us, your telephone calls, emails, and other communications between you and Spacial Professionals (including through Spacial) may be recorded and logged. As such, we will collect and maintain all information provided/discussed in such communications including your identity, the date and time of the communication, and the contents of the communications.

PHI Collected from Third Parties

In connection with the Services, we may collect information, including PHI, about you from third parties such as: past or current health care providers; health insurance and pharmacy benefit management companies; or your employer or other organization that may provide us with your name and demographic information.

‍PHI Collected Automatically

When you register and log in to Spacial’s secure websites and mobile apps, Spacial collects information about you, some of which may be PHI. Spacial must be able to link your activity back to your identity so that changes in its systems can be made and it can track the Services you used. As such, Spacial automatically collects the following types of information about you when you use its secure websites: IP address, device information, general geographic information, dates and times you accessed and used the secure websites/mobile apps, features you used, and how long you use the secure websites/mobile apps.

When We Use and Share Your Information

To Provide you with Treatment

We may use and disclose your PHI to provide you with medical treatment and services and share it with other professionals who treat you. We may use and disclose your PHI to coordinate your care between our doctors, nurses, or other personnel who are involved in your care.  We may use and disclose PHI to other healthcare providers who may be involved in your care at hospitals, clinics, or other locations to coordinate activities such as filling prescriptions, lab work, imaging, and other treatment activities.

Operational Purposes

PHI is used to improve the services we provide, to train staff, for business management activities, quality assessment and improvement, to contact you about the Services available to you and health benefits, to monitor the qualifications of providers, and for customer service.  For example, we may use your PHI to review our treatment and services and to evaluate the performance of our staff in caring for you. We may also use and disclose PHI to other individuals and organizations who help us with our business activities, such as consultants or attorneys. We may share PHI with other entities covered by HIPAA, such as health plans, for their business operations only if they also have or had a relationship with you.

Payment Activities

We may use and share your information to bill and receive payment from employers, health plans or other entities paying for your participation in full or in part.  For example, we may:

• Give information to your employer or group health plan so it will pay for all or part of our services.
• Disclose your information to additional vendors who provide services to your health plan to help you receive additional benefits.

Other Purposes

We may also use PHI to:

• Participate in health information exchanges (HIEs) so that we can share, request, and receive electronic health information from other health care organizations for treatment, payment, and healthcare operations purposes as described above.
• Engage third parties to assist us with our payment and healthcare operations. If any such third party needs access to PHI to perform its services on behalf of us, we will require that third party to enter a written agreement that protects the PHI. We provide only the minimal PHI to accomplish the intended purpose of the use and sharing of the PHI.
• Communicate with family and friends who are involved in your care and payment.
• Create deidentified and aggregate information.
• When using the Services, your information, including PHI, will be shared with Spacial, who is subject to a written agreement with us that protects your PHI as described in this Notice.

There are limited times when we may be permitted or required by law to use or disclose your PHI without your authorization, such as:

• To assist in public health and safety activities, such as tracking diseases and reporting potential disease exposure, reporting reactions to medications or problems with medical devices or products;
• To protect victims of abuse or neglect, such as child abuse and elder neglect;
• For judicial and administrative proceedings such as responding to subpoenas;
• For workers compensation claims;
• To prevent or lessen a serious and imminent threat of harm to a person or the public;
• When required by law or for law enforcement purposes;
• For state and federal health oversight activities such as physician licensing and disciplinary action;
• To coroners, medical examiners, and funeral directors in limited circumstances;
• For organ donation and transplantation;
• For research approved by an institutional review board; and 
• For specialized government functions such as national security, intelligence and protective services.

When We Obtain Your Authorization to Use or Share Your PHI

We will not share your PHI for other purposes not described above in this Notice unless you give us your written authorization. For instance, your written authorization is needed prior to us using and disclosing your PHI:

• For Marketing purposes
• For a sale of your PHI
• For fundraising purposes
• To your employer

Federal and state law requires special protections for certain highly confidential information about you (“Highly Confidential Information”). This Highly Confidential Information may include the subset of your PHI that: (1) is maintained in psychotherapy notes; (2) is about mental health and developmental disabilities services; (3) is about alcohol and drug abuse prevention, treatment and referral; (4) is about HIV/AIDS testing, diagnosis or treatment; (5) is about sexually-transmitted diseases; (6) is about genetic testing; (7) is about child abuse and neglect; (8) is about domestic abuse of an adult with a disability; or (9) is about sexual assault. In order for us to disclose your Highly Confidential Information for a purpose other than those permitted by law, we must have your authorization.

If we desire to use or disclose your PHI for the purposes listed above as requiring authorization or for any other purpose not described in this Notice, we will seek your authorization using a HIPAA Authorization to Disclose Protected Health Information Form conforming to applicable law. You have the right to revoke any authorization that you previously provided.

Your Rights Regarding Your PHI

You have the following rights regarding your PHI maintained by us. Additionally, your medical power of attorney or legal guardian can exercise these rights on your behalf and make choices about your PHI. To exercise any of the following rights, or for more information about our privacy practices, please contact Spacial as provided under the caption “Spacial Contact Information” below.

Right to access your information

You can ask to get a copy of your PHI. We will provide a copy or a summary of your information, usually within 30 days of your request. We may charge a reasonable, cost-based fee.  We may deny your request to access your PHI in certain limited circumstances. If that occurs, we will inform you of the reason for the denial.

‍Ask us to correct your information

You can ask us to correct information about you that you think is incorrect or incomplete. We may deny your request to amend your PHI in certain limited circumstances. If that occurs, we will inform you of the reason for the denial.  If we deny your request, you will be permitted to submit a statement of disagreement for inclusion in your records.

Request confidential communications

You can ask us to contact you in a specific way (for example, home or office phone) or to send mail or electronic communications to a different address.  We will accommodate all reasonable requests.

‍Right to Request Restrictions on Uses and Disclosures of PHI

You may request that we restrict how we use or disclose your PHI. However, we are not required to agree to your requests except in the case of a request that we restrict information provided to a payor, the disclosure would be for the payor’s payment or healthcare operations, and you have paid for the health care services completely out of pocket. If we do agree to your request, we will comply unless the information is needed to provide emergency treatment to you.

Right to Request an Accounting of Disclosures

You have a right to receive an accounting of disclosures we have made of your PHI. To request an accounting of disclosures, please submit your request in writing to Spacial at privacy@spacialhealthcare.com. Your right to an accounting of disclosures does not include disclosures made for treatment, payment or healthcare operations, disclosures made pursuant to an authorization, and certain other disclosures. Your first accounting will be free of charge.

You also have the right to:

• Obtain a paper copy of this Notice from us at any time upon request; 

• Obtain more information about our privacy practices by contacting Spacial in the following ways:

Spacial Contact Information:

By mail:

Spacial Health Inc.

3000 Royal Court, Unit 3308

North Hills, NY 11040

Attn: David Sullivan

By email:

privacy@spacialhealthcare.com

• If you believe your privacy rights have been violated, you may file a complaint about us to Spacial at the contact information above, or to file a complaint with the Office for Civil Rights U.S. Department of Health and Human Services write to 200 Independence Avenue, S.W., Room 509F, HHH, Washington, D.C. 20201, call 1-800-368-1019, or file an online complaint at: 

https://ocrportal.hhs.gov/ocr/smartscreen/main.jsf.

How We Keep Your PHI Safe

The security of your PHI is very important to us and all the PHI you provide to Spacial is protected by strict security safeguards. We use administrative, technical, and physical safeguards to keep your PHI from unauthorized access, and other threats and hazards to its security and integrity. We base our security program on complying with state and federal law, including the HIPAA Security Regulations, as well as industry best practices. We regularly validate the controls we have in place through annual assessment and audits. 

More specifically, we (including Spacial) protect the confidentiality of your PHI in many ways including the following:

• All your data are processed in secure and HIPAA-compliant cloud services.  This allows us to focus on creating solutions where high security and privacy are enabled by default. 
• We use industry-best security measures to prevent unauthorized access, disclosure, modification, or unauthorized destruction of all your data. 
• All data is encrypted in transit and at rest as well as within the database columns themselves.

• Access to our databases is tightly controlled and is only allowed to a small subset of technical administrators.
• Access reviews are performed periodically to certify staff roles are still appropriately assigned.
• Our employees are trained on an annual basis on how to maintain the privacy and security of our Members’ information.

If your unsecured PHI is disclosed to an unauthorized person, despite our security safeguards, we will notify you promptly if such disclosure may have compromised the privacy or security of your PHI.

Changes To this Notice

We reserve the right to change the terms of this Notice at any time, as long as the changes are in compliance with applicable laws. If we change the terms of this Notice, the new terms will apply to all PHI that we maintain, including any PHI created or received prior to issuing the new Notice. If we change this Notice, Spacial will post the new Notice on its website and will make the new Notice available upon request.