HIPAA Notice of Privacy Practices

For purposes of this page, "Surfbound," "Surfbound Health," "we," "us," and "our" refer to Open Water Rx LLC, doing business under the Surfbound and Surfbound Health trade names.

Surfbound provides platform and administrative services that connect patients with independent licensed healthcare providers and participating pharmacies. Healthcare providers and pharmacies that receive your health information may be HIPAA-covered entities, and their applicable HIPAA notices govern the protected health information maintained by those entities. Please review this notice carefully.

Your Health Information

When you use Surfbound's platform, you share health-related information — such as your name, contact details, date of birth, medical history, current medications, allergies, health conditions, treatment goals, lab results, provider notes, and prescription records — with independent licensed healthcare providers and participating pharmacies. When maintained by a HIPAA-covered provider or pharmacy, this information is protected under applicable privacy and healthcare laws. Not every piece of information submitted to surfbound.co is automatically subject to HIPAA protections; protections depend on the entity receiving and maintaining the information and the context in which it is collected.

How Health Information May Be Used

Healthcare providers and pharmacies that are HIPAA-covered entities may use and disclose protected health information as permitted or required by law. This includes uses and disclosures for treatment, payment, and healthcare operations. Surfbound, as a platform and administrative services provider, facilitates the secure transmission of information between you, your providers, and your pharmacies, and will make reasonable efforts to handle information in accordance with applicable privacy standards.

Treatment, Payment, and Healthcare Operations

Licensed providers and pharmacies may use your health information for treatment: reviewing your intake, determining medical appropriateness, issuing prescriptions, and coordinating care. Health information may be used for payment: processing charges, verifying coverage, and managing billing. It may also be used for healthcare operations: quality review, service improvement, compliance, and administrative activities.

Providers, Pharmacies, and Care Partners

Surfbound's platform facilitates the secure transmission of your health information to licensed providers who independently review your intake and determine treatment. Prescription and health information may be transmitted to licensed pharmacies that prepare and dispense medications. Information may also be shared with fulfillment partners, shipping carriers, laboratories, and other care partners involved in your treatment, as directed by your provider or pharmacy.

Required or Permitted Disclosures

Health information may be disclosed when required by law, including to public health authorities, government agencies, law enforcement, or in response to court orders, subpoenas, or other legal processes. Disclosures may also be made to prevent a serious threat to health or safety, to report adverse events, or as otherwise permitted or required by applicable law.

Your Rights

You have certain rights regarding your protected health information. These rights may vary based on applicable law and the entity holding your records. Surfbound and its provider and pharmacy partners will respond to requests in accordance with applicable legal requirements.

Right to Access Records

You have the right to request access to or a copy of your health records maintained by Surfbound or its provider and pharmacy partners. Requests must be made in writing. A reasonable fee may apply for copies. Responses will be provided within the timeframe required by applicable law.

Right to Request Corrections

If you believe your health information is incorrect or incomplete, you have the right to request a correction. Requests must be made in writing and include the reason for the correction. Surfbound or the relevant provider or pharmacy partner will review your request and respond in accordance with applicable law.

Right to Request Restrictions

You have the right to request restrictions on how your health information is used or disclosed for treatment, payment, or healthcare operations. Surfbound and its provider and pharmacy partners are not required to agree to all restriction requests but will consider them in accordance with applicable law.

Right to Confidential Communications

You have the right to request that Surfbound and its provider and pharmacy partners communicate with you about your health information in a specific way or at a specific location. Reasonable requests for confidential communications will be accommodated where practicable.

Right to Receive a Copy of This Notice

You have the right to receive a copy of this HIPAA Notice of Privacy Practices. This notice is available on the Surfbound website at all times. You may also request a paper or electronic copy by contacting Surfbound using the information below.

Data Safeguards

Surfbound implements administrative, technical, and physical safeguards designed to protect the privacy and security of information on its platform. This includes encryption, access controls, secure systems, and staff training. Independent healthcare providers and participating pharmacies that are HIPAA-covered entities maintain their own safeguards for protected health information in compliance with applicable law. Surfbound's service partners are also required to maintain appropriate security measures.

Complaints and Questions

If you believe your privacy rights have been violated, you may file a complaint with Surfbound or with the U.S. Department of Health and Human Services. Surfbound will not retaliate against you for filing a complaint. Complaints to Surfbound can be submitted using the contact information below.

Contact

Questions about this HIPAA Notice or your privacy rights can be sent to [email protected].