HIPAA Notice of Privacy Practices

Effective date: September 23, 2026 · Replaces the notice dated August 21, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

1. Who We Are and What This Notice Covers

Rely Telehealth Plus, Inc., d/b/a Row Telehealth (“Row Telehealth”, “we”, “our”, or “us”), is a covered entity under HIPAA. This notice describes the privacy practices of Row Telehealth, of our workforce, and of the business associates that handle PHI on our behalf under written Business Associate Agreements.

Protected health information (“PHI”) is information that identifies you, or could reasonably be used to identify you, and that relates to your past, present, or future physical or mental health, the health care we provide you, or payment for that care. For Row Telehealth this includes your intake and eligibility responses, medical and medication history, allergies, vitals and self-reported measurements, provider notes, diagnoses, treatment plans, prescriptions, lab or diagnostic results, appointment history, secure messages and video-visit records, and the billing records tied to your care.

Independent entities involved in your care, including the pharmacy that fills your prescription and any laboratory that runs your tests, are separate covered entities that maintain their own notices. This notice does not govern information they hold on their own behalf.

2. How We May Use and Disclose Your Protected Health Information

The following categories describe the ways we may use and disclose PHI. Not every use or disclosure in a category is listed, but every way we are permitted to use or disclose PHI falls within one of them.

2.1 Uses and disclosures that do not require your authorization

• Treatment. We use and disclose PHI to provide, coordinate, and manage your care. For example: sharing your intake responses and history with the licensed provider who evaluates you; transmitting a prescription to the pharmacy that fills it; sending records to a laboratory or to another clinician who is treating you; and sending you appointment reminders, refill reminders, and information about treatment alternatives and health-related services we offer.
• Payment. We use and disclose PHI to bill and collect payment for the care you receive. For example: processing your payment through our payment processor, issuing a refund, and, where you use insurance, submitting a claim with supporting documentation to your health plan and responding to its requests.
• Health care operations. We use and disclose PHI to run our practice and improve the quality of care. For example: reviewing clinical documentation for quality and safety; credentialing and verifying the licenses of our providers; training staff; auditing, compliance, and legal review; resolving complaints; and business planning and administration.

We may also use or disclose PHI without your authorization in the following circumstances, subject to the conditions HIPAA imposes on each:

• When required by law. When federal, state, or local law requires the disclosure.
• Public health. To public health authorities for preventing or controlling disease, injury, or disability; reporting births, deaths, and adverse events related to a medication or medical device; and to the U.S. Food and Drug Administration where required.
• Abuse, neglect, or domestic violence. To a government authority authorized to receive reports of suspected abuse, neglect, or domestic violence, as permitted or required by law.
• Health oversight. To agencies that oversee the health care system, such as licensing boards and government benefit programs, for audits, investigations, inspections, and licensure.
• Judicial and administrative proceedings. In response to a court or administrative order, or to a subpoena, discovery request, or other lawful process where the required assurances or a protective order are in place.
• Law enforcement. To a law enforcement official for the limited purposes HIPAA allows, such as complying with a warrant or court order, identifying or locating a suspect or missing person, or reporting a crime on our premises.
• Coroners, medical examiners, and funeral directors. As needed to identify a deceased person, determine a cause of death, or carry out their duties.
• Organ and tissue donation. To organizations that handle organ, eye, or tissue procurement, banking, or transplantation.
• Research. For research approved by an institutional review board or privacy board that has established protocols for the privacy of your information, or where the research uses de-identified or limited data as HIPAA permits.
• To avert a serious threat to health or safety. When necessary to prevent or lessen a serious and imminent threat to the health or safety of you, another person, or the public.
• Specialized government functions. For military, veterans, national security and intelligence, and protective-service activities, and to correctional institutions about inmates, as HIPAA permits.
• Workers’ compensation. As authorized by workers’ compensation laws.
• People involved in your care. To a family member, close friend, or other person you identify as involved in your care or in payment for it, limited to information relevant to that involvement, if you agree or, where you are unable to agree, where a provider determines it is in your best interest. This includes disclosures to a disaster-relief organization to notify family of your location or condition.
• Business associates. To contractors that perform services for us, such as secure hosting, video visits, payment processing, identity verification, and communications, under written agreements that require them to protect PHI as HIPAA requires.
• De-identified information. We may create and use information from which all identifiers have been removed as HIPAA specifies. De-identified information is no longer PHI.

2.2 Uses and disclosures that require your written authorization

Any use or disclosure of PHI not described in this notice requires your written authorization. In particular, we will obtain your written authorization before:

• using or disclosing PHI for marketing, except for face-to-face communications and promotional gifts of nominal value;
• any sale of PHI;
• disclosing psychotherapy notes, where any exist, except as HIPAA permits without authorization; and
• any other use or disclosure not listed in Section 2.1.

You may revoke an authorization at any time by writing to legal@rowtelehealth.com. The revocation stops further uses and disclosures under that authorization, except to the extent we have already acted in reliance on it.

2.3 Information with additional protection

Some state and federal laws give greater protection than HIPAA to particular categories of information, such as mental health, HIV and sexually transmitted infection, substance use disorder treatment records covered by 42 C.F.R. Part 2, genetic information, and reproductive or sexual health information. Where a more protective law applies to your care, we follow it, and we obtain any additional consent that law requires before using or disclosing the information.

3. Your Rights Regarding Your Health Information

You have the following rights over the PHI we hold about you. Section 4 explains how to exercise each of them.

• Right to inspect and obtain a copy. You may inspect and obtain a copy of the PHI in your designated record set, which includes your medical and billing records. You may ask for it in a particular electronic format, and we will provide it in that format if it is readily producible. You may direct us to send a copy to a person or entity you designate. We respond within 30 days and may extend that once by up to 30 days with written notice of the reason. We may charge a reasonable, cost-based fee for copies. In the limited circumstances HIPAA permits us to deny access, we tell you why in writing and explain how to have the denial reviewed.
• Right to amend. If you believe PHI we hold is inaccurate or incomplete, you may ask us to amend it for as long as we keep the record. Your request must be in writing and give a reason. We respond within 60 days and may extend that once by up to 30 days. We may deny the request if the information was not created by us, is not part of your designated record set, is not information you would be permitted to inspect, or is accurate and complete. If we deny it, we tell you why in writing, and you may file a written statement of disagreement that we keep with the record and include with any future disclosure of the disputed information.
• Right to an accounting of disclosures. You may request a list of the disclosures we made of your PHI during the six years before your request, other than disclosures for treatment, payment, and health care operations, disclosures to you or under your authorization, and certain other disclosures HIPAA excludes. The first accounting in any 12-month period is free. We tell you the cost of any further accounting in that period before we prepare it, and you may withdraw or modify the request.
• Right to request restrictions. You may ask us to restrict how we use or disclose your PHI for treatment, payment, or health care operations, or to people involved in your care. We are not required to agree to most restrictions, and if we do agree we may still disclose the information when needed for emergency treatment. We must agree to a request that we not disclose PHI to your health plan for an item or service that you, or someone on your behalf, paid for in full out of pocket, unless the disclosure is required by law.
• Right to confidential communications. You may ask us to communicate with you about your health information at a particular address, phone number, or email, or by a particular method. We accommodate reasonable requests and will not ask you the reason.
• Right to a paper copy of this notice. You may obtain a paper copy of this notice at any time, even if you agreed to receive it electronically.
• Right to be notified of a breach. You have the right to be notified, without unreasonable delay and no later than 60 days after discovery, if a breach of your unsecured PHI occurs.
• Right to choose someone to act for you. A person with legal authority to make health care decisions for you, such as a medical power of attorney or a legal guardian, may exercise these rights on your behalf. We verify that authority before acting.
• Right to file a complaint. You may complain to us and to the U.S. Department of Health and Human Services if you believe your privacy rights have been violated. Section 5 explains how.

4. How to Exercise These Rights

To exercise any right in Section 3, send a written request by either route:

• Email: legal@rowtelehealth.com, subject line “HIPAA request”.
• Mail: Rely Telehealth Plus, Inc., d/b/a Row Telehealth, Attn: Privacy Officer, 3905 Crescent Park Drive, First Floor, Riverview, FL 33578.

Include the following so that we can locate your record and act on the request:

• your full name, date of birth, and the email address and phone number on your Row Telehealth account;
• which right you are exercising (for example, “copy of my records”, “amendment”, “accounting of disclosures”, “restriction”, or “confidential communications”);
• for a copy request, the records or date range you want, the format you prefer, and where to send it;
• for an amendment request, the information you believe is wrong and the reason; and
• if you are acting for someone else, documentation of your authority.

We confirm receipt, verify your identity before releasing or changing any information, and respond within the time HIPAA allows for that right (see Section 3). There is no charge to make a request. The only fees we charge are reasonable, cost-based fees for copies and for a second accounting within 12 months, and we tell you the amount before we incur it. You may also ask any question about this notice or your rights at the same addresses.

5. How to File a Complaint

If you believe your privacy rights have been violated, or you disagree with a decision we made about your PHI, you may file a complaint with us, with the federal government, or with both.

• With Row Telehealth. Write to our Privacy Officer by email at legal@rowtelehealth.com, subject line “HIPAA complaint”, or by mail at Rely Telehealth Plus, Inc., d/b/a Row Telehealth, Attn: Privacy Officer, 3905 Crescent Park Drive, First Floor, Riverview, FL 33578. Describe what happened and when. We acknowledge every complaint, investigate it, and respond to you in writing.
• With the U.S. Department of Health and Human Services, Office for Civil Rights (OCR). By mail at Centralized Case Management Operations, U.S. Department of Health and Human Services, 200 Independence Avenue, S.W., Room 509F HHH Bldg., Washington, D.C. 20201; by phone at 1-800-368-1019 (TDD 1-800-537-7697); or online at hhs.gov/ocr/privacy/hipaa/complaints. OCR complaints are generally filed within 180 days of when you knew of the act or omission.

We will not retaliate against you for filing a complaint. Filing a complaint will not affect your care, your account, or your standing with us.

6. Our Legal Duties

We are required by law to:

• maintain the privacy and security of your protected health information, using administrative, physical, and technical safeguards consistent with the HIPAA Privacy and Security Rules;
• provide you with this notice of our legal duties and privacy practices with respect to PHI;
• follow the terms of the notice currently in effect;
• notify you promptly, and where required the U.S. Department of Health and Human Services and the media, if a breach occurs that may have compromised the privacy or security of your unsecured PHI;
• not use or disclose your PHI other than as described in this notice unless you authorize it in writing;
• honor a restriction we have agreed to, and honor your request not to disclose fully self-paid items or services to your health plan;
• require every business associate that handles PHI on our behalf to protect it under a written agreement; and
• train our workforce on these obligations and apply sanctions when they are not followed.

7. Changes to This Notice

We reserve the right to change our privacy practices and the terms of this notice, and to make the revised notice effective for all PHI we already hold as well as PHI we receive in the future. When we make a material change, we post the revised notice on this page with a new effective date, make it available in the patient portal, and provide a copy on request. The version in effect is always the one posted at rowtelehealth.com/notice-of-privacy-practices.

8. Contact

Questions about this notice, requests under Section 4, and complaints under Section 5 go to our Privacy Officer:

Rely Telehealth Plus, Inc., d/b/a Row Telehealth
Attn: Privacy Officer
3905 Crescent Park Drive, First Floor
Riverview, FL 33578
legal@rowtelehealth.com

Residents of Washington, Nevada, and Connecticut also have rights over consumer health data that is not PHI, described in our Consumer Health Data Privacy Notice.