Effective Date: October 2025
This Notice describes how your medical and personal health information (“Protected Health Information” or “PHI”) may be used and disclosed by Vaylen Health, Inc. (“Vaylen,” “we,” “our,” or “us”) and your rights regarding that information. Please review it carefully.
1. Who We Are
This Notice applies to the privacy practices of Vaylen, including its affiliated healthcare providers, medical professionals, and personnel (“we” or “us”). Vaylen provides telehealth services, including weight management programs and medication counseling.
Vaylen Health collaborates with trusted entities and affiliated professional organizations to deliver telehealth services across the United States. These affiliated entities may share your Protected Health Information (PHI) as needed to carry out treatment, payment, and healthcare operations (collectively, “TPO”) in accordance with HIPAA.
2. Our Privacy Obligations
We are required by law to maintain the privacy of your PHI and to provide you with this Notice describing our legal duties and privacy practices. We are also required to notify you in the event of a breach of unsecured PHI. When we use or disclose your PHI, we must abide by the terms of this Notice or other notice in effect at the time of the use or disclosure.
We will not use or share your information other than as described in this Notice unless you give us written permission. If you authorize us and later change your mind, you may revoke it at any time by contacting us in writing.
3. Permissible Uses and Disclosures Without Your Written Authorization
We may use or disclose your PHI without your written authorization in the following situations:
A. Treatment, Payment, and Healthcare Operations
● Treatment: We may use and disclose your PHI to provide, coordinate, or manage your healthcare services, including sharing information with other healthcare providers involved in your care.
● Payment: We may use and disclose PHI to obtain payment for services provided to you, including billing and collection activities.
● Healthcare Operations: We may use and disclose PHI for operations that improve care quality, assess provider competence, perform audits, resolve complaints, and detect fraud or abuse.
B. Disclosure to Relatives, Friends, and Caregivers
We may disclose your PHI to family members, close personal friends, or other individuals involved in your care or payment for your healthcare under certain circumstances. If you are present or otherwise available, we may disclose PHI if (1) you provide your agreement; (2) we offer you the opportunity to object and you do not object; or (3) we reasonably infer from the circumstances that you do not object.
If you are not present, or if providing the opportunity to agree or object is not practicable due to your incapacity, medical emergency, or other urgent situation, we may exercise professional judgment to determine whether the disclosure is in your best interest. In such cases, we will limit the PHI disclosed to only what is directly relevant to the person’s involvement in your care or payment. Disclosures under this provision may also include information necessary to notify (or assist in notifying) such persons of your location, general condition, or death.
We may also share your PHI with caregivers or family members to facilitate coordination of your care, provide updates on your treatment plan, or explain instructions for medication, diet, or other health-related instructions. Any disclosures will always be limited to the minimum necessary information required to achieve these purposes.
C. Public Health Activities
We may disclose your PHI to public health authorities or authorized government agencies for purposes related to public health and safety, without your written authorization, in accordance with applicable laws. These disclosures may include:
1. Reporting disease, injury, or disability to prevent or control public health threats;
2. Reporting suspected child abuse or neglect, or abuse or neglect of adults with disabilities, to public health authorities or other agencies authorized by law;
3. Reporting information regarding adverse events, product defects, or product recalls to the U.S. Food and Drug Administration (FDA) or other regulatory bodies;
4. Alerting individuals who may have been exposed to communicable diseases, or who may be at risk of contracting or spreading a disease or condition;
5. Reporting workplace-related illnesses, injuries, or medical surveillance information to an employer as required by occupational health and safety laws; and
6. Any other public health activities as required or permitted by law.
D. Victims of Abuse, Neglect, or Domestic Violence
If we reasonably believe you are a victim of abuse, neglect, or domestic violence, we may disclose your PHI to a governmental authority, including social services or protective services agencies, as authorized by law. Such disclosures are made to protect your safety or the safety of others. We may limit the PHI disclosed to only what is necessary to respond to the suspected abuse or neglect. In certain situations, we may also provide information to law enforcement, legal authorities, or other appropriate agencies, always in accordance with applicable federal and state laws and with the minimum necessary information principle.
E. Health Oversight Activities
We may disclose PHI to health oversight agencies responsible for monitoring and regulating the health care system, including agencies overseeing compliance with government health programs such as Medicare, Medicaid, or other state or federal programs. These disclosures may include audits, investigations, inspections, licensure or certification activities, and other regulatory functions necessary to ensure compliance with applicable laws, quality standards, and professional conduct requirements.
F. Judicial and Administrative Proceedings
We may disclose your PHI in the course of a judicial or administrative proceeding in response to a court order, subpoena, discovery request, or other lawful process. Such disclosures will be limited to the information expressly required by the order or request. We may also disclose PHI when required by law to defend against legal claims or when participating in administrative hearings related to your care or payment.
G. Law Enforcement Officers
We may disclose PHI to law enforcement officials when required by law, such as in response to a court order, warrant, subpoena, or other legal process. We may also disclose PHI when necessary to identify or locate a suspect, fugitive, material witness, or missing person, or to report certain types of wounds or injuries, suspected crimes, or threats to public safety, as permitted under applicable law. All disclosures will be made in compliance with federal and state regulations.
H. Decedents
We may disclose PHI to coroners, medical examiners, or funeral directors as authorized by law to allow them to carry out their duties regarding the identification, cause of death, or preparation of a body for burial or cremation. We will limit the disclosure to only the PHI necessary for these purposes.
I. Research
We may use or disclose your PHI for research purposes without your authorization if an Institutional Review Board (IRB) or Privacy Board approves a waiver of authorization, as permitted under HIPAA and other applicable laws. Disclosures for research will always follow strict regulatory standards, and PHI will only be used to the extent necessary to achieve the research objectives while maintaining confidentiality and privacy protections.
J. Health or Safety
We may disclose PHI to prevent or reduce a serious and imminent threat to your health and safety, the health and safety of the public, or the health and safety of a specific individual. Such disclosures are made only to parties reasonably able to prevent or lessen the threat, such as law enforcement, public health authorities, or other individuals at risk. The minimum necessary PHI will be disclosed to address the threat.
K. Specialized Government Functions
We may disclose PHI to government agencies or authorized entities performing specialized functions, including the U.S. military, national security, intelligence, or protective services, as required by law. These disclosures are limited to PHI necessary to carry out the agency’s legally authorized functions.
L. Workers’ Compensation
We may disclose PHI as required to comply with state workers’ compensation laws or other similar programs. These disclosures may include PHI needed to process claims, determine benefits, or comply with regulatory reporting requirements, and will always be limited to the minimum information necessary to satisfy the legal requirements.
M. As Required By Law
We may use or disclose PHI when required by other applicable federal, state, or local laws not specifically mentioned above. These disclosures include, but are not limited to, reporting obligations, regulatory compliance, or responding to lawful investigations or audits. All disclosures will be limited to the minimum PHI necessary for the legal purpose and will comply with applicable privacy and confidentiality standards.
4. Uses and Disclosures Requiring Your Written Authorization
A. Authorization Required
We must obtain your written authorization to use or disclose PHI for marketing purposes, the sale of PHI, or any other use not otherwise described in this Notice.
B. Highly Confidential Information
Certain PHI, such as mental health, substance abuse, HIV/AIDS status, genetic testing, sexual assault, and abuse records, require your written authorization for disclosure beyond what is allowed by law.
C. Revocation of Authorization
You may revoke any written authorization at any time, except to the extent we have already relied upon it, by submitting a written statement to our Privacy Officer.
5. Your Rights Regarding PHI
A. Complaints and Further Information
You may contact our Compliance and Privacy Officer for questions or complaints about your privacy rights. You may also file a complaint with the U.S. Department of Health and Human Services. Vaylen will not retaliate against you for filing a complaint.
B. Right to Request Additional Restrictions
You may request restrictions on how we use or disclose your PHI for treatment, payment, or healthcare operations, including restrictions for disclosures to your health plan if you pay out-of-pocket. We are required to honor certain requests and will attempt to accommodate reasonable requests for others.
C. Right to Confidential Communications
You may request that we communicate your PHI by alternative means or locations.
D. Right to Inspect and Copy
You may inspect and obtain copies of your medical records and billing records. Copies may be provided for a reasonable, cost-based fee.
E. Right to Amend Records
You may request amendments to your PHI, and we will comply unless the information is accurate and complete or other legal exceptions apply.
F. Right to an Accounting of Disclosures
You may request a list of certain PHI disclosures made within the prior six years. Additional requests within 12 months may incur a reasonable fee.
G. Right to a Copy of this Notice
You may obtain a copy of this Notice at any time via email or in paper format.
H. Choose Someone to Act for You
If you have appointed a medical power of attorney or legal guardian, that person may exercise your rights.
6. Effective Date and Duration of This Notice
This Notice is effective as of October 2025. We reserve the right to change this Notice and apply it to all PHI we maintain. Updated Notices will be posted on our website and available upon request.
7. Privacy Officer
Vaylen Health Service
317 6th Ave.
Des Moines, IA 50309
