Medical Privacy Policy

1. Our Commitment to Your Privacy

Clearpath Sober Companion ("Clearpath," "we," "us," or "our") is committed to protecting the privacy, dignity, and confidentiality of every client.

Because our services may involve sensitive information about recovery, substance use, treatment history, medications, mental health, living arrangements, or other personal circumstances, we take reasonable administrative, physical, and technical measures to protect the information entrusted to us.

Depending on the services provided and our relationship with healthcare professionals, treatment facilities, health plans, or other organizations, Clearpath may operate as a healthcare provider, a business associate, an independent support service, or another type of service provider.

When the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), the Health Information Technology for Economic and Clinical Health Act ("HITECH"), 42 C.F.R. Part 2, or another privacy law applies, we will handle protected information in accordance with the applicable requirements. When HIPAA does not legally apply, we will still seek to follow the privacy practices described in this policy unless another law, written authorization, or contractual requirement controls.

2. Information We May Collect

We may collect information that you, your authorized representative, a treatment provider, or another authorized person provides to us, including:

• Your name, contact information, date of birth, and emergency contacts
• Information about your recovery goals and support needs
• Treatment, discharge, or transition information
• Medication schedules and health-related instructions
• Substance-use or relapse history
• Mental or behavioral health information
• Safety plans and emergency-response information
• Appointment, transportation, travel, and scheduling information
• Information about family members, treatment professionals, or other members of your support network
• Payment, billing, and service-agreement information
• Notes concerning services, incidents, progress, or communications
• Website inquiries and information submitted through online forms

We will seek to collect only the information reasonably necessary to provide services, coordinate authorized care, protect safety, meet legal obligations, and operate our business.

3. How We May Use Your Information

Where permitted by applicable law, we may use your information for the following purposes:

4. Uses and Disclosures Requiring Authorization

Except where applicable law permits or requires otherwise, we will obtain your written authorization before:

• Sharing your information with family members, employers, attorneys, or other third parties not otherwise authorized to receive it
• Using identifiable health or recovery information for advertising, testimonials, or promotional purposes
• Selling your personal or protected health information
• Posting photographs, videos, success stories, or identifying information
• Disclosing information for purposes unrelated to your services, safety, payment, or lawful business operations

You may revoke an authorization in writing at any time. Revocation will not affect actions already taken in reasonable reliance on the authorization.

5. Substance-Use-Disorder Records

Certain records related to substance-use-disorder diagnosis, treatment, or referral may receive additional protection under 42 C.F.R. Part 2.

When those protections apply:

• We will use or disclose Part 2 records only as permitted by law or by a valid written consent.
• Part 2 records, or testimony describing their contents, generally may not be used or disclosed in civil, criminal, administrative, or legislative proceedings against you unless you provide specific written consent or an appropriate court order authorizes the use.
• A general authorization may not be sufficient for every use of protected substance-use-disorder information.
• You may have the right to file a complaint regarding an unlawful use or disclosure of Part 2 records.
• You will not be penalized or retaliated against for exercising your confidentiality rights.

Clearpath will comply with any stricter federal or state confidentiality protections that apply to substance-use-disorder information.

6. Sharing Information With Service Providers

We may use carefully selected vendors or service providers for functions such as secure communications, record storage, scheduling, payment processing, information technology, legal services, or accounting.

When required by HIPAA, we will enter into a Business Associate Agreement with a vendor that creates, receives, maintains, or transmits protected health information on our behalf.

Service providers are authorized to access information only as necessary to perform their assigned services and must protect it according to applicable agreements and laws.

7. Your Privacy Rights

Depending on the laws that apply to your information, you may have the following rights:

Requests should be submitted using the contact information at the end of this policy.

8. Our Responsibilities

Where required by applicable law, Clearpath will:

• Protect the privacy and security of protected health information
• Limit access to individuals who reasonably need the information
• Use reasonable safeguards against unauthorized access, use, loss, or disclosure
• Follow the privacy practices described in the version of this policy currently in effect
• Notify affected individuals when required following a breach of unsecured protected information
• Train applicable personnel regarding privacy and confidentiality responsibilities
• Investigate suspected privacy incidents and take appropriate corrective action

No storage or communication system is completely secure. However, we will use reasonable measures appropriate to the sensitivity of the information we maintain.

9. Electronic Communications and Website Forms

Ordinary email, text messaging, voicemail, and standard website contact forms may not provide the same level of security as a designated encrypted communication system.

Please avoid submitting detailed medical records, medication information, diagnoses, treatment documents, or highly sensitive recovery information through an ordinary contact form or unsecured email unless specifically instructed to do so.

Submitting a general website inquiry does not establish a client relationship or guarantee that HIPAA applies to the communication.

10. Information Security

Our security measures may include:

• Access controls and password protection
• Multi-factor authentication where appropriate
• Encryption of supported devices, records, or communications
• Secure disposal of records
• Limited workforce access
• Confidentiality agreements
• Security updates and device-management practices
• Incident-response and breach-notification procedures
• Vendor privacy and security requirements

Specific security practices may change as technology, operations, and legal requirements evolve.

11. Record Retention

We retain personal and health-related information only for as long as reasonably necessary to provide services, satisfy contractual responsibilities, comply with legal or insurance requirements, resolve disputes, and maintain appropriate business records. Records will be securely deleted or destroyed when they are no longer required, subject to applicable retention obligations.

12. Minors

Services involving a minor must be authorized by a parent, legal guardian, or another person legally permitted to make decisions for the minor, except where applicable law gives the minor independent confidentiality or consent rights. Privacy rights involving minors will be handled according to applicable federal and state law.

13. Changes to This Policy

We may revise this policy when our practices, services, technology, or legal obligations change. A revised policy may apply to information we already maintain as well as information received after the revision, where legally permitted. The current version will be posted on our website with its effective date. Material changes will be communicated when required by law.

14. Privacy Questions and Complaints

To ask a question, exercise a privacy right, or submit a complaint, contact:

Please do not include detailed medical or recovery information in an unsecured email. If HIPAA applies to your information, you may also submit a complaint to the U.S. Department of Health and Human Services, Office for Civil Rights. You will not be retaliated against or denied services solely because you submitted a privacy complaint.