Privacy Policy

1. Scope

This Policy applies to information collected through anveahealth.com, including public pages, contact forms, appointment or inquiry tools, insurance pages, location features, downloads, and other online features that link to this Policy. It may also apply to information received through email, telephone, text, messaging, or other channels operated in connection with the website.

This Policy does not replace a HIPAA Notice of Privacy Practices, patient authorization, financial policy, terms of use, employment notice, or other legally required notice applicable to a specific relationship or service.

2. Information We Collect

Depending on how you interact with us, we may collect:

Information not appropriate for a general contact form

Unless a form specifically states that it is designed to receive protected health information, do not submit complete medical records, Social Security numbers, passwords, financial credentials, or other unnecessary highly sensitive information. A general website form is not an emergency service.

3. Health Information, HIPAA and California Medical Privacy

Anvea Health is a healthcare provider. Information created, received, maintained, or transmitted in connection with patient care may be protected by HIPAA and California medical privacy laws, including the Confidentiality of Medical Information Act (CMIA), where applicable.

Protected health information subject to HIPAA is handled according to the applicable Notice of Privacy Practices and legally required policies. HIPAA generally requires covered providers to explain permitted uses and disclosures, patient rights, provider duties, and complaint procedures. California law may impose additional protections; where a stricter applicable requirement applies, Anvea Health intends to follow it.

4. Sources of Information

• You, when you submit a form, call, email, message, or request information.
• Your authorized representative, caregiver, parent, guardian, or legally permitted agent.
• Healthcare providers, laboratories, hospitals, pharmacies and referral sources.
• Health plans, insurers, billing entities and payment participants.
• Browsers, devices, hosting, security and analytics systems.
• Public or third-party sources where permitted and reasonably necessary.

5. How We Use Information

We may use information, as permitted by law, to:

• Respond to inquiries, contact requests and appointment questions.
• Provide, coordinate, manage and document healthcare services.
• Communicate with patients, representatives, providers and health plans.
• Verify eligibility, benefits, coverage, authorization and payment information.
• Process billing, claims and payment-related activities.
• Operate, maintain, troubleshoot, secure and improve the website.
• Detect and prevent fraud, abuse, security incidents and unauthorized activity.
• Comply with legal, regulatory, professional, court and governmental requirements.
• Establish, exercise or defend legal claims and protect the rights, safety, property and operations of Anvea Health and others.
• Perform administrative, quality, compliance, auditing and operational functions permitted by law.
• Send service-related communications and, where permitted, marketing communications subject to applicable consent and opt-out requirements.

6. Disclosure and Sharing

We do not treat your information as an unrestricted commercial asset. We may disclose information when reasonably necessary for healthcare, payment, operations, legal compliance, security, or another purpose permitted by applicable law.

Healthcare, payment and operations

Depending on the information and applicable law, disclosures may be made to providers, laboratories, pharmacies, hospitals, health plans, billing companies, technology providers, professional advisors, contractors and other service providers performing services for or with Anvea Health.

Legal and regulatory requests

We may disclose information when required or permitted by law, including valid subpoenas, court orders, lawful governmental requests, regulatory requirements, public-health requirements, law-enforcement requests, professional licensing obligations, or other legally recognized processes.

Safety, fraud and legal protection

We may use or disclose information when reasonably necessary to detect or prevent fraud, abuse, security incidents, threats to safety, unlawful activity or misuse of our systems, or to establish, exercise or defend legal claims.

Business transactions

If permitted by law, information may be involved in a merger, acquisition, financing, restructuring, sale of assets, professional practice transition, or similar transaction, subject to applicable confidentiality and healthcare privacy requirements.

Authorization

Where applicable law requires written authorization or consent, we will seek it before the applicable use or disclosure unless another legal exception applies.

7. Cookies and Similar Technologies

The website may use cookies, pixels, local storage, tags, scripts, logs and similar technologies. Some may be necessary for functionality, security, sessions and preferences. Others may help us understand traffic and performance. Your browser may allow you to block or delete cookies, although functionality can be affected.

Where consent is legally required for a non-essential technology, the website should obtain and document the appropriate consent before using it.

8. Analytics, Advertising and Tracking

If Anvea Health uses analytics, advertising, social-media pixels, conversion tracking, session replay, heatmaps or similar technologies, those tools may receive technical and usage information according to their configuration.

Anvea Health should not configure advertising or analytics tools to transmit protected health information or other sensitive medical information unless the legal and contractual requirements have been reviewed and the disclosure is permitted. If a vendor receives HIPAA- or California-protected information, appropriate safeguards and agreements should be used where required.

9. California Privacy Rights

California privacy laws may provide rights concerning personal information collected by a business. The scope depends on the law, the information, the relationship with Anvea Health, and applicable healthcare exemptions. Information regulated by HIPAA, CMIA, or other healthcare laws may be exempt from some CCPA obligations.

To the extent the CCPA/CPRA applies, eligible California consumers may have the following rights:

• Know/Access: request information about categories and, where legally required, specific pieces of personal information.
• Delete: request deletion, subject to legal exceptions and record-retention requirements.
• Correct: request correction of inaccurate personal information, subject to applicable exceptions.
• Opt Out of Sale or Sharing: where applicable, opt out of a sale or sharing as defined by California law.
• Limit Certain Sensitive Personal Information: where applicable, limit certain uses or disclosures beyond legally permitted purposes.
• Non-Discrimination: exercise applicable rights without unlawful discriminatory treatment.
• Notice at Collection: receive required information about categories collected and purposes at or before collection.

Verification

We may need to verify identity and authority before processing a privacy request and may request information reasonably necessary for verification. We may deny or limit requests where permitted or required by law.

Medical-record requests

Medical-record access, amendments, restrictions, accounting of disclosures, and other patient rights may be governed by separate HIPAA/medical-record procedures and should not be submitted as ordinary website privacy requests.

How to submit a California privacy request

Use the Contact page at anveahealth.com/contact/ and clearly state California Privacy Request. You may also call 909.363.1258. If a dedicated privacy email or toll-free privacy-request channel is established, it should be added to this Policy.

Requests should identify the right being exercised and provide enough information to understand and process the request. We will respond within applicable legal deadlines and may request additional information where reasonably necessary.

Global Privacy Control

Where California law requires recognition of a qualifying opt-out preference signal, Anvea Health will process the signal according to applicable law and its technical capabilities. If the site engages in a legally defined sale or sharing of personal information, the required opt-out mechanism and notice should be provided.

10. Security

Anvea Health uses reasonable administrative, technical and physical safeguards designed to protect information against unauthorized access, use, alteration, disclosure or destruction. Depending on the system, safeguards may include access controls, authentication, encryption in transit, monitoring, backups, security updates, vendor controls and incident-response procedures.

No website, electronic transmission, cloud service, email system or storage system can be guaranteed completely secure. Anvea Health therefore cannot promise that information will never be accessed, disclosed, altered, lost or destroyed through circumstances beyond reasonable control.

11. Security Incidents and Breach Response

If Anvea Health determines that a security incident or breach has occurred, it will evaluate the event under laws applicable to the affected information and individuals. Where notification is legally required, notice will be provided in the manner and within the timeframe required by law.

Depending on the data and circumstances, requirements may include HIPAA's Breach Notification Rule, California breach-notification law, contractual requirements, or other federal/state rules. Certain non-HIPAA health-data services may also implicate the FTC Health Breach Notification Rule.

We may investigate incidents, preserve evidence, contain unauthorized access, engage security or legal professionals, notify affected individuals, and report to regulators or other parties where required.

12. Data Retention and Deletion

We retain information for as long as reasonably necessary for the purposes described here, patient care and recordkeeping, professional and legal obligations, dispute resolution, enforcement, fraud prevention, and protection of our rights.

Medical and billing records may be retained for periods established by federal law, California law, professional standards, payer requirements, litigation holds, or other applicable obligations. A request to delete website information does not necessarily require deletion of a medical record or information Anvea Health is legally required or permitted to retain.

13. Your Choices

• You may choose whether to provide optional website information, although some features may not work without it.
• You may adjust browser settings to manage certain cookies.
• You may request correction where a legal right applies.
• You may opt out of marketing communications through the unsubscribe mechanism or by contacting us.
• Service, appointment, healthcare, billing, security or legally required communications may continue after a marketing opt-out.

14. Children and Minors

The website is not intended to knowingly collect unnecessary personal information from children. When a minor receives healthcare services, information may be collected and processed as necessary for care and as permitted by applicable law, including through a parent, guardian, authorized representative or other legally permitted person.

15. Third-Party Services and Links

The website may link to or integrate with patient portals, maps, payment services, messaging services, insurers, scheduling systems, social-media platforms and other websites. Once you leave anveahealth.com or interact directly with a third-party service, that party's privacy policy and terms may apply. Anvea Health is not responsible for privacy, security, availability or content practices of third-party services it does not control.

16. No Medical Advice Through the Website

Website information is general information and is not a substitute for individualized medical evaluation, diagnosis or treatment. Website communications do not create a physician-patient relationship merely because someone visits the site or submits a general inquiry.

Do not use the website, email, text messaging or a general contact form for a medical emergency. Call 911 or seek immediate emergency medical care.

17. Changes to This Policy

Anvea Health may update this Policy to reflect changes in services, technology, vendors, law, privacy practices or security practices. The updated version will be posted here with a revised date. Where law requires additional notice or consent for a material change, Anvea Health will follow the required process.

18. Severability and Non-Waiver

If a provision is invalid or unenforceable, it will be interpreted or limited to the extent necessary to comply with applicable law and the remaining provisions will continue to apply to the extent permitted by law.

Nothing in this Policy is intended to waive, restrict or eliminate a privacy right, consumer right, patient right or remedy that cannot lawfully be waived. Nothing here limits obligations imposed on Anvea Health by applicable healthcare, privacy, consumer-protection or other laws.

19. Contact Anvea Health About Privacy

Questions, concerns and privacy requests may be directed to Anvea Health through the contact information below. For a California privacy request, identify it as a California Privacy Request.