Privacy Hub

MyCareX Mobile Application — Patient Privacy Policy

This policy explains how GHeIT collects, safeguards, and processes your information when you use the MyCareX mobile application.

I. Dual Regulatory Protection: Provider-Connected vs. Direct-to-Consumer

1. Provider-Connected Accounts (HIPAA & CMIA): When using MyCareX via an integration with your healthcare provider, the records constitute PHI under HIPAA and Medical Information under CMIA. GHeIT acts as a Business Associate. Your provider's Notice of Privacy Practices (NPP) governs clinical record usage.
2. Direct Consumer Features: If you enter wellness metrics independently, we protect that data with SOC 2 certified, clinical-grade encryption and adhere strictly to the CMIA and the FTC Health Breach Notification Rule (16 C.F.R. Part 318).

II. FHIR Interoperability & Data Access

MyCareX utilizes HL7® FHIR® (Fast Healthcare Interoperability Resources) standards. This ensures secure, standardized, and interoperable access to your medical records. Under the 21st Century Cures Act, FHIR APIs empower you to seamlessly and securely download your clinical data, transfer it to other apps, or share it with authorized caregivers without friction.

III. Information Collected Within the App

• Patient Identity & Authentication: Full name, DOB, medical record number (MRN), email, mobile number, and encrypted authentication tokens.
• Clinical & Health Records: Diagnoses, medications, immunizations, vital sign logs, and secure communications.
• Mobile Device Permissions (Opt-In): Biometric Authentication (FaceID/TouchID processed strictly locally), Camera/Photo Library (for telehealth/insurance cards), and Push Notifications.

IV. Apple HealthKit & Google Health Connect Disclosures

If you grant permission to read/write data via Apple HealthKit or Google Health Connect:

• Data is used exclusively to display health metrics within your care profile and share them with designated providers.
• Strict Prohibition: Information accessed through these APIs is never used for marketing, advertising, or data mining, and is never sold to data brokers.

V. Statutory Affirmative Commitment

Pursuant to Cal. Civ. Code § 56.10, GHeIT will never disclose, sell, or share your Medical Information for marketing purposes without a valid, signed HIPAA/CMIA-compliant authorization.

Enterprise Clinical BAA & HIPAA Notice

This Notice governs GHeIT's enterprise healthcare software platforms:

• NeoCareX: Electronic Health Records (EHR), clinical documentation, and practice management.
• VitalCareX: Continuous remote patient monitoring (RPM) and real-time physiological telemetry.
• SyncPaX: Prior authorization automation, EHR integration, and FHIR-based clinical workflow routing.

I. GHeIT as a HIPAA Business Associate

When Covered Entities utilize our platforms, GHeIT operates strictly as a Business Associate (under 45 C.F.R. § 160.103). All collection, processing, and storage of electronic PHI (ePHI) are governed by executed Business Associate Agreements (BAAs). Patients seeking to exercise HIPAA rights regarding clinical platform records must submit requests directly to their treating healthcare provider.

II. Interoperability & FHIR Compliance

SyncPaX and NeoCareX are engineered natively on HL7® FHIR® Release 4 standards. This ensures that electronic health information exchange, prior authorization routing, and diagnostic data synchronization between payers, providers, and patients comply with the CMS Interoperability and Patient Access mandates, utilizing OAuth 2.0 security profiles.

III. SOC 2 Type I & HIPAA Security Rule Safeguards

GHeIT maintains a rigorous security program aligned with 45 C.F.R. Part 164, Subpart C, NIST SP 800-66, and SOC 2 Type I criteria:

• Encryption & Hosting: All ePHI is encrypted in transit (TLS 1.2/1.3) and at rest (AES-256) within SOC 2 Type I certified cloud infrastructure.
• Access Controls: Role-Based Access Control (RBAC), multi-factor authentication (MFA), and immutable audit trails.
• Subcontractors: Any cloud sub-processor handling ePHI is bound by a downstream BAA and rigorous vendor risk assessments.
• Breach Notification: Unauthorized access to unsecured ePHI triggers prompt notification to the Covered Entity in strict compliance with HIPAA and CMIA reporting mandates.

RideOn Referral Management & Closed-Loop Privacy Notice

This notice explains how GHeIT collects, uses, and protects clinical and tracking data across the RideOn referral management platform, designed to ensure closed-loop verification for patient referrals.

I. Categories of Information Collected

• Patients / Referred Individuals: Account identity, clinical reason for referral, specialized care requirements, referral initiation timestamps, and masked SMS/call logs with care navigators.
• Providers / Coordinators: NPI, institutional affiliation, clinical scope/capacity, active referral routing status, appointment acceptance metrics, and diagnostic exchange records.

II. Closed-Loop Tracking, HIPAA & SOC 2 Security

When a RideOn referral is initiated by a healthcare network, the documentation and tracking telemetry are protected as PHI under HIPAA.

• SOC 2 Processing Integrity: To ensure accountability, RideOn tracks referral status across referring and receiving entities using SOC 2 compliant audit logging, preventing gaps in care and ensuring high system availability.
• Strict Purpose Limitation: GHeIT uses this data exclusively to execute care routing and verify quality metrics. We never sell referral tracking data.

III. Retention of Referral Logs

Identifiable active referral logs are retained for 90 days following verified loop closure for auditing and care continuity, after which they are aggregated or de-identified according to HIPAA Safe Harbor standards, unless longer retention is contractually mandated.

ShopRideOn Store, Orders & Payment Privacy Notice

This notice governs personal information collected when you browse, place orders, or register warranties on the ShopRideOn e-commerce storefront.

I. E-Commerce Data & Lawful Processing

1. Order & Fulfillment Information: Name, billing/shipping address, email, and SKUs. Processed to fulfill contractual obligations.
2. PCI-DSS Compliance: Credit/Debit/HSA card details are transmitted via encrypted tokenization to our PCI-DSS Level 1 certified payment processors. GHeIT does not store raw primary account numbers (PAN) or CVV codes.
3. Warranty & Customer Support: Serial numbers and correspondence, retained for consumer protection compliance (e.g., Cal. Song-Beverly Act).
4. Fraud Prevention: IP addresses and session logs are processed under Legitimate Interest to prevent automated bot attacks and financial fraud.

II. Disclosures & Data Retention

Order information is disclosed strictly to operational third parties (freight carriers, tax authorities, and payment engines) necessary to complete the transaction. Order invoices and tax records are retained for seven (7) years to comply with commercial and tax obligations.

VitalCareX Mobile Application — User Privacy Policy

This policy governs the VitalCareX mobile application, from everyday consumers proactively managing their personal wellness to healthcare professionals monitoring clinical telemetry. Whether you are tracking your own physiological data at home or connecting with a clinical care team, VitalCareX empowers all users to monitor vital signs and manage health alerts securely.

I. Dual Operational Framework & Clinical Platform Integration

Depending on how the solution is provisioned, VitalCareX functions under two operational configurations:

1. Clinical Enterprise Deployment: Integrated with a health organization's EHR or remote monitoring framework, VitalCareX serves as an enterprise telemetry conduit. Physiological metrics transmitted for clinical care constitute Protected Health Information (PHI) under HIPAA, CMIA, and applicable Business Associate Agreements (BAAs).
2. Standalone Consumer Option: A direct consumer tool enabling individuals to record diagnostic trends, connect personal health hardware, and optionally sync records into their MyCareX Personal Health Record (PHR).

II. Telemetry Capture & Interoperable Transmission

• User Provisioning & Identity: Standard personal account credentials (e.g., email, secure password) for everyday consumers, alongside NPI/Staff IDs, multi-factor authentication tokens, and patient pairing codes for clinical users.
• Physiological Datasets: Heart rate, SpO2, respiratory rate, blood pressure, and ECG/PPG waveforms, collected from consumer wearables or FDA approved clinical-grade biosensors.
• FHIR Interoperability: Telemetry data is standardized using secure HL7® FHIR® resources. For everyday consumers, this ensures seamless data portability and personal record-keeping. For clinical users, data is securely routed back to the host EHR (NeoCareX or third-party systems) to ensure data continuity and seamless provider review.

III. Hardware Access & Wireless Protocols

VitalCareX requests system permissions necessary to facilitate continuous data collection:

• Bluetooth Low Energy (BLE): Essential for linking and streaming biometric measurements from compatible medical hardware.
• Android Location Services: Required by the Android operating system exclusively for BLE peripheral discovery. GHeIT does not gather or track geographic position logs.
• Background App Refresh: Ensures uninterrupted streaming of vital signs and immediate delivery of personal health notifications or high-priority clinical alarms, even when your phone screen is locked.

IV. Local Storage & SOC 2 Certified Security Controls

• Encrypted Cache Management: Data held during connection interruptions is secured with AES-256 local encryption and erased once successfully synced to our SOC 2 compliant servers.
• Credential & Session Controls: User sign-outs or MDM remote wiping commands instantly purge cached patient parameters from the device.