Patient Privacy Notice

OutcomeMD provides a patient outcome tracking and management platform to help patients and clinicians understand treatment results in order to enhance care and communication.

This Patient Privacy Notice explains how OutcomeMD may collect, use, disclose, and secure information obtained through our website, located at www.outcomemd.com (the “Site”); our cloud-based patient outcome tracking and management platform, located at www.portal.outcomemd.com (the “Platform”); and web-enabled emails sent as part of, in connection with, or relating to such software and information services (collectively, the “Service”).  The terms “OutcomeMD,” “we,” “us,” and/or “our” include OutcomeMD, Inc. and our affiliates and subsidiaries.  This Patient Privacy Notice is incorporated by reference into the Site Terms for the OutcomeMD Service (including our Site, mobile app, and any other product offering that we may make).  Any capitalized terms used and not defined in this Patient Privacy Notice shall have the meaning given to those capitalized terms in the Site Terms.

We act as a service provider to healthcare organizations and clinicians, and we receive, maintain, use, and disclose data on their behalf and limited by our agreements with them.  This Patient Privacy Notice does not reflect the privacy practices of the healthcare organizations or clinicians using our platform, and we are not responsible for their privacy practices.   We also do not review their instructions with respect to our processing of information to determine whether such instructions are in compliance or conflict with the terms of their applicable privacy notices.  Please contact your healthcare organization or clinician if you have questions about their privacy practices.

“Personal Information” means information that alone or when in combination with other information may be used to readily identify, contact, or locate you, such as: name, address, email address, or phone number.  Personal Information also includes any protected health information.  We collect Personal Information when you register to use the Service, use the Service, or communicate with us.  We may also receive Personal Information about you from your connected healthcare organizations and clinicians.  In addition, we collect information, such as anonymous usage statistics, by using cookies, server logs, and other similar technology as you use the Service.

HOW OUTCOMEMD USES YOUR INFORMATION

We use Personal Information to facilitate and improve our Services or to communicate with you on our behalf and on behalf of healthcare organizations and clinicians.

THE SERVICE COLLECTS YOUR INFORMATION

Registration and Account Information.  To use certain features of the Service, you must create a user account. To register, you need to provide Personal Information, such as your first and last name, birthdate, and email address or phone number.  We may also request optional information, including your gender and details about your income level or educational background.

Using the Service.  We collect information you provide when you use the Service, which may include information you submit about how you are feeling, which medications you are taking, and other health information related to treatment from a healthcare organization or clinician.

Communicate with Us.  We may collect Personal Information through your communications with our customer-support team or through other communications with us, including through social media.

Surveys, Clinical Trials, and Research Studies. We may contact you to ask if you would be willing to participate in a survey, clinical trial, or other research study. If you appear to meet the eligibility criteria for a clinical trial and have agreed to be contacted, we may share your Personal Information (for instance, your name and email address) with the clinical trial team so they can follow up with you directly. If you choose to participate, the research team will provide its own consent and privacy documentation. If you participate in surveys, OutcomeMD conducts, you may be asked to provide demographic details, feedback on your experience, or other information relevant to that survey. Participation is entirely voluntary, and your responses will be used only for the purposes described in this Patient Privacy Notice or clearly disclosed at the time of the request. Survey results may be published in aggregated, de-identified form.

User-Generated Content. Our Service allows you to voluntarily share a review of your clinician, including the option to post your review on the clinician’s website or your own social media channels. If you choose to share a review, we will collect any information you choose to include. Please use good judgement when writing reviews. While it’s expected that you may reference your health or care experience, try to avoid including sensitive personal details (such as specific diagnoses, medications, or test results). The information you share, including Personal Information such as your first name and last initial, age and gender, and/or social media username may be accessible to your clinician and to the general public.

Information and Content from Your Computer or Mobile Device.  The Service automatically collects information about your device, such as its model, operating system, device ID and browser type, so that we can provide and customize functionality, such as push notifications.  With your permission, the Service may access and collect information from your device’s contact list so you can add contact information of clinicians and other caregivers, and your device’s photo storage so you can upload profile pictures.

Automatic Data Collection: Cookies and Related Technologies.  When you visit our Service or open our emails, we and our third-party partners, such as analytics providers, may collect certain information by automated means, such as cookies, web beacons and web server logs. The information collected in this manner includes IP address, browser characteristics, device IDs and characteristics, operating system version, language preferences, referring URLs, and information about the usage of our Service. We may use this information, for example, to determine how many users have visited certain pages or opened messages or newsletters, or to prevent fraud.  We may link this data to your profile.  Our third-party partners may also collect information about your online activities over time, on other devices, and on other websites or apps, if those websites and apps also use the same partners.  When they provide such services, they are governed by their own privacy policies.  We may use Google Analytics to collect and process certain Service usage data.  Google provides additional privacy options regarding cookie use described at www.google.com/policies/privacy/partners/.

Clinicians Submit Information about Patients.  Clinicians may submit information, including Personal Information and health-related information, about patients through the Service.  This information helps us contact you and obtain information from you relevant to your treatment and medical condition.

Consent.  By using the Service, you are authorizing us to gather, process, analyze, and retain data related to the provision of the Service.  We may retain such information, including Personal Information, indefinitely.

Internal and Service-Related Usage.  We use information, including Personal Information, for internal and service-related purposes, such as to operate, evaluate, and improve our business or the Service and to identify and protect against fraud.  For example, we may provide you and your clinician with analyses and reports about your treatment and medical condition based on the information you provide through the Service.  Subject to potential limitations in our other agreements, we may use and retain any data we collect to provide and improve any of our Services.

In Compliance with Agreements with Healthcare Organizations and Clinicians.  We may use information we receive from you as permitted by our agreements with your healthcare organization and/or clinician using the Service.

Data Analysis. We analyze the information we collect to provide our Service, such as providing reports to you and clinicians. To the extent permitted by law and our partner agreements, we may de-identify and/or aggregate information, and use and disclose it for business purposes (for example, to perform research and provide statistical information and data regarding trends to our partners).

Our Communications.  We may send email to the email address you provide to us, push notifications to your mobile device if they are enabled, and/or text messages to your mobile device to verify your account and for informational and operational purposes, such as account management, reminders, customer service, system maintenance, and other Service-related purposes.

Marketing.  We may use information, including Personal Information, to send you information about our products and services we think you may be interested in, including promotional materials and information about events, programs, offers, surveys, and market research.  You may opt out of email marketing by using the unsubscribe link in a marketing email.

Communications from Clinicians.  We may facilitate communications from clinicians to patients for Service-related purposes, such as notifying patients about using the Service.  These messages may be sent by email, push notification, or text message.

We Use Third-Party Vendors and Service Providers.  We may share any information we receive with the third-party vendors and service providers we use to help us provide and improve the Service.  For example, we will provide Personal Information to service providers that provide web and database hosting services.  We will require any vendor or service provider receiving your Personal Information to respect the privacy of your Personal Information.

To Clinicians. Any information users submit on the Service may be accessible and exportable through the Service by their associated clinicians so the clinicians can use the information for treatment and healthcare-related purposes.  We are not responsible for how clinicians access and use such information.

With Third Parties at the Direction of Your Healthcare Organization or Clinician.  Healthcare organizations and clinicians may direct us to disclose information about their patients with third parties.

Marketing.  We do not rent, sell, or share Personal Information about you that we collect on the Service with other people or unaffiliated companies for their direct marketing purposes, unless we have your explicit permission.

Legal and Similar Disclosures.  We may access, preserve, and disclose collected information, if we believe doing so is required or appropriate to: comply with law enforcement requests and legal process, such as a court order or subpoena; respond to your requests; comply with the law; or protect your, our, or others’ rights, property, or safety.

Merger, Sale, or Other Asset Transfers.  If we are involved in a merger, acquisition, financing due diligence, reorganization, bankruptcy, receivership, sale of OutcomeMD assets, or transition of service to another provider, your information may be disclosed in connection with the negotiation of such transaction, and/or sold or transferred as part of such a transaction as permitted by law and/or contract.  We cannot control how such entities may use or disclose such information.

Companies Under Common Control. We may share information, including Personal Information, between and among any current or future parents, subsidiaries, affiliates, and other companies under common control and ownership with OutcomeMD.

With Your Permission.  We may also disclose your Personal Information with your permission.

De-identified Information. We may share aggregate or de-identified information, which cannot reasonably be used to identify you, for various purposes, including compliance with various reporting obligations; for business or marketing purposes; or to assist third parties in understanding our users’ habits and usage patterns for certain features, content, services, advertisements, promotions, and/or functionality available through the Service.

From time to time, we may sell or license de-identified patient data derived from protected health information (PHI) as that term is defined in the Health Insurance Portability and Accountability Act of 1996 and the regulations promulgated thereunder (HIPAA) for research, analytics, or other commercial purposes beyond your individual care. This data is de-identified in accordance with the HIPAA Safe Harbor method, which requires the removal of all individually identifiable information. We may share this de-identified data with third parties, such as research institutions, life science or biopharmaceutical companies, or analytics partners. We require that these parties agree that they will not attempt to re-identify the data and will not transfer the de-identified data to another party unless that party also agrees in writing not to attempt to re-identify the de-identified data.

In some cases, your clinician or OutcomeMD may receive financial or other benefits from the use or licensing of de-identified data, including data derived from your health information. While you cannot be individually identified from this data, we believe it’s important to be transparent about these practices.

We seek to use reasonable organizational, technical, and administrative measures to protect your information, including to secure protected health information in compliance with HIPAA. Unfortunately, no data transmission or storage system can be guaranteed to be 100% secure. If you have reason to believe that your interaction with us is no longer secure (for example, if you feel that the security of any account with us has been compromised), please immediately notify us of the problem by contacting us using the contact information below.

By using the Service or providing Personal Information to us, you agree that we may communicate with you electronically regarding security, privacy, and administrative issues relating to your use of the Service. If we learn of a security system’s breach, we may attempt to notify you electronically by posting a notice on the Service or sending an email to you.