Privacy Policy & HIPAA Notice of Privacy Practices

Effective Date: January 1, 2025

Last Updated: October 30, 2025

---

1. Information We Collect

Personal Information

• Account Information: Name, email address, password, phone number, date of birth
• Demographic Information: Biological sex, address, city, state, zip code
• Payment Information: Billing address, payment method details (processed securely by our payment processors)

Protected Health Information (PHI)

• Lab Test Orders: Tests ordered, test results, specimen collection dates
• Clinical Information: Physician review notes, test interpretations
• Health Records: Any health-related information you provide or that we receive from laboratory partners

Automatically Collected Information

• Technical Data: IP address, browser type, device information, operating system
• Usage Data: Pages visited, time spent on site, clickstream data
• Cookies: Session cookies, preference cookies (see our Cookie Policy below)

---

2. How We Use Your Information

Treatment, Payment, and Healthcare Operations

• Process and fulfill lab test orders
• Facilitate physician review and approval of orders
• Transmit orders to laboratory partners securely via HL7 messaging
• Receive and deliver test results to you
• Process payments and prevent fraud
• Provide customer support

Required by Law

• Comply with legal obligations, court orders, and regulatory requirements
• Report suspected child abuse or neglect as required by law
• Cooperate with law enforcement when legally required

With Your Consent

• Send you marketing communications (you may opt out at any time)
• Share information with third parties you authorize

---

3. How We Share Your Information

Laboratory Partners

We share your order information and demographic details with our certified laboratory partners (Quest Diagnostics, LabCorp) to process your lab tests. This is done securely using encrypted HL7 v2.5 messaging over SFTP connections.

Physicians

Licensed physicians review and approve your orders as part of our service. They have access to your test orders and health information necessary for clinical review.

Service Providers

We work with trusted service providers who assist with:

• Payment processing
• Email delivery
• Cloud hosting and data storage
• Security and fraud prevention

All service providers sign Business Associate Agreements (BAAs) as required by HIPAA.

We Do Not Sell Your Information

Labs4me does not sell, rent, or trade your personal information or health information to third parties for their marketing purposes.

---

4. Your Rights Under HIPAA

As a patient, you have the following rights regarding your health information:

Right to Access

You may request copies of your health information, including test results and medical records. You can access most of this information through your customer portal.

Right to Request Amendments

If you believe your health information is incorrect or incomplete, you may request that we amend it.

Right to an Accounting of Disclosures

You may request a list of certain disclosures we have made of your health information.

Right to Request Restrictions

You may request restrictions on how we use or disclose your health information for treatment, payment, or healthcare operations.

Right to Request Confidential Communications

You may request that we communicate with you in a specific way or at a specific location.

Right to a Paper Copy of This Notice

You have the right to receive a paper copy of this notice upon request.

---

5. Your California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act:

Right to Know

You have the right to request information about the personal information we have collected about you in the past 12 months, including:

• Categories and specific pieces of personal information collected
• Categories of sources from which information was collected
• Business or commercial purposes for collecting information
• Categories of third parties with whom we share information

Right to Delete

You have the right to request deletion of your personal information, subject to certain exceptions (e.g., legal retention requirements, completing transactions).

Right to Opt-Out of Sale

We do not sell your personal information. If our practices change, we will update this policy and provide you with opt-out options.

Right to Non-Discrimination

We will not discriminate against you for exercising your CCPA rights.

How to Exercise Your Rights

To submit a request under CCPA, please contact us at: privacy@labs4me.com

---

6. Data Security

We implement industry-standard security measures to protect your information:

• Encryption: All data transmitted over the internet is encrypted using TLS/SSL
• Secure Storage: Sensitive data is encrypted at rest in secure databases
• Access Controls: Role-based access controls limit who can view your information
• Audit Logging: All access to PHI is logged and monitored
• Two-Factor Authentication: Required for customer accounts and optional for staff
• Session Timeouts: Automatic logout after 15 minutes of inactivity
• Password Security: Strong password requirements with complexity enforcement

---

7. Data Retention

We retain your information as follows:

• Medical Records: Retained for 7 years as required by California law
• Account Information: Retained while your account is active, plus 7 years after closure
• Audit Logs: Retained for 6 years as required by HIPAA
• Payment Records: Retained for 7 years for tax and accounting purposes

---

8. Cookies and Tracking Technologies

Essential Cookies

Required for site functionality, including session management, authentication, and shopping cart.

Preference Cookies

Remember your settings and preferences for a better user experience.

Managing Cookies

You can control cookie preferences through our cookie consent banner or your browser settings. Note that disabling essential cookies may prevent you from using certain features of our service.

---

9. Breach Notification

In the event of a data breach involving your protected health information, we will notify you within 60 days as required by HIPAA breach notification rules. Notification will be sent to your email address on file.

---

10. Children's Privacy

Our services are not intended for individuals under 18 years of age. We do not knowingly collect personal information from minors. If you are under 18, you must have a parent or guardian create an account and order tests on your behalf.

---

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the updated policy on our website
• Updating the "Last Updated" date at the top of this page
• Sending an email notification for significant changes

---

12. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, please contact us:

For complaints about our privacy practices:

• You may file a complaint with our Privacy Officer using the contact information above
• You may file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights
• We will not retaliate against you for filing a complaint