PRIVACY POLICY

LabDispatch™ Privacy Policy

This Privacy Policy explains how Lab Angelus, Inc. (“Lab Angelus,” “we,” “us,” or “our”) collects, uses, discloses, and protects information in connection with the LabDispatch™ platform, our websites at labdispatch.com and labangelus.com, and related services (collectively, the “Services”). It applies to information that is not Protected Health Information. Protected Health Information is handled separately, as described in Section 2.

Please read this Policy together with the LabDispatch Terms of Use and the LabDispatch Disclaimer. Capitalized terms not defined here have the meanings given in the Terms of Use.

Contents

1. Scope of This Policy
2. Our Role Under HIPAA; Protected Health Information
3. Information We Collect
4. Sources of Information
5. How We Use Information
6. Cookies and Similar Technologies
7. How We Disclose Information
8. De-Identified and Aggregated Data
9. How We Protect Information
10. Data Retention
11. Your Choices
12. State Privacy Rights
13. Consumer Health Data
14. Children’s Privacy
15. Electronic Communications
16. United States Processing
17. Third-Party Links and Services
18. Changes to This Policy
19. How to Contact Us

1. Scope of This Policy

This Policy applies to information we collect through the Services from and about the individuals and entities that use the Services, including healthcare professionals, laboratory personnel, and administrative and other authorized Users, and visitors to our websites. This Policy governs information that is not Protected Health Information. Where the same category of data is regulated both as Protected Health Information under HIPAA and as personal information under a state privacy law, the HIPAA-regulated data is governed by Section 2 and the Business Associate Agreement, and this Policy governs only the remainder.

2. Our Role Under HIPAA; Protected Health Information

When we create, receive, maintain, or transmit Protected Health Information on behalf of a covered-entity customer, we act as a business associate, and, where applicable, as a subcontractor business associate, within the meaning of the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (“HIPAA”). Our handling of Protected Health Information is governed by the Business Associate Agreement between us and the applicable covered entity, and by HIPAA, and not by this Policy.

If you are a patient and have a question about how your Protected Health Information is used or disclosed, please contact your treating provider or laboratory, which is the covered entity responsible for your Protected Health Information and for its own Notice of Privacy Practices. This Policy does not modify any rights you may have under HIPAA or under your provider’s Notice of Privacy Practices.

3. Information We Collect

We collect the following categories of information that are not Protected Health Information:

Registration and professional information

Name, professional title and role, employer or affiliated entity, work contact information, professional identifiers such as license or NPI number where applicable, credentials, and Account settings and permissions.

Account and authentication information

Login credentials, authentication tokens, security questions, multi-factor authentication data, and role-based access assignments.

Usage and device information

Log data, actions taken within the Services, feature usage, timestamps, Internet Protocol address, browser and device type, operating system, and similar technical information, collected in part through the technologies described in Section 6.

Communications

The content of messages, support requests, and other communications you send to us, and records of your interactions with us.

Acknowledgement records

Records evidencing your acknowledgement of, and assent to, our Terms of Use, Disclaimer, and this Policy, including your identity, the date and time of assent, the Internet Protocol address associated with the assent, and the version of each document assented to, as further described in the LabDispatch Acknowledgement. As described in Section 10, we retain these records on a long-term basis to establish the existence and scope of your assent.

We do not seek to collect Protected Health Information through the Services except through the functions provided for that purpose and in accordance with the applicable Business Associate Agreement.

4. Sources of Information

We collect information directly from you when you register, configure your Account, use the Services, or communicate with us; automatically through your use of the Services and the technologies described in Section 6; and from your employer or affiliated entity, or its administrators, when they provision or manage your Account.

5. How We Use Information

We use information that is not Protected Health Information to: provide, operate, maintain, and support the Services; authenticate Users and administer role-based access; secure the Services and detect, investigate, and prevent fraud, abuse, and security incidents; communicate with you, including regarding service, security, and administrative matters; personalize and improve the Services and develop new features; maintain audit logs and records, including acknowledgement records; comply with Applicable Law and enforce our agreements; and carry out any other purpose described to you at the point of collection. Our use of Protected Health Information is governed by the Business Associate Agreement.

6. Cookies and Similar Technologies

We and our service providers use cookies, local storage, and similar technologies to operate and secure the Services, to remember your preferences, to authenticate your session, and to understand and improve how the Services are used. We use strictly necessary technologies to deliver the Services and may use analytics technologies to measure performance. You can manage certain cookies through your browser settings, though disabling some technologies may impair the functioning of the Services. Where required by Applicable Law, we provide additional controls and honor recognized opt-out preference signals as described in Section 12.

7. How We Disclose Information

We disclose information that is not Protected Health Information as follows:

• Service providers and sub-processors. To vendors that perform services on our behalf, such as cloud hosting and infrastructure, security, analytics, communications, and customer support, under contracts that require them to protect the information and to use it only to provide services to us.
• Logistics and integration partners. To couriers, laboratory information systems, electronic health record systems, and eligibility-verification services, as necessary to coordinate the workflow you initiate, and only to the extent the information is not Protected Health Information governed by the Business Associate Agreement.
• Your organization. To the employer or affiliated entity that provisions or administers your Account, consistent with that entity’s administrative rights.
• Legal and safety. To comply with Applicable Law, legal process, or governmental request; to enforce our agreements; and to protect the rights, property, or safety of Lab Angelus, our Users, or others.
• Business transfers. In connection with, or in contemplation of, a merger, acquisition, financing, reorganization, or sale of all or a portion of our assets or equity, information may be disclosed to, and transferred to, the counterparty and its advisors, subject to appropriate confidentiality protections and, with respect to Protected Health Information, the Business Associate Agreement and Applicable Law.
• With your direction or consent. As you direct or otherwise consent.

We do not sell information that is not Protected Health Information in exchange for money, and our disclosures for cross-context behavioral advertising are addressed in Section 12.

8. De-Identified and Aggregated Data

We may create de-identified data and aggregated data from information we hold, including from Protected Health Information, in accordance with HIPAA and the Business Associate Agreement. We de-identify data in conformance with 45 C.F.R. § 164.514(b), using either the expert-determination method or the safe-harbor method. Once data has been de-identified in accordance with those standards, it is no longer Protected Health Information and is no longer subject to HIPAA.

As permitted by the Business Associate Agreement and Applicable Law, we may use, retain, reproduce, prepare derivative works from, and otherwise commercialize de-identified data and aggregated data for any lawful purpose, including operating, securing, analyzing, and improving the Services; developing analytics, benchmarking, quality-measurement, and research products; and supporting industry, payor, and life-sciences use cases. We own the de-identified data, aggregated data, and derived insights that we create, and all associated intellectual property. We maintain reasonable controls designed to prevent re-identification, and we do not attempt to re-identify de-identified data except as permitted by Applicable Law and the Business Associate Agreement. We will maintain and use consumer health data that is subject to a state consumer-health-data law in accordance with that law, as described in Section 13.

9. How We Protect Information

We maintain administrative, technical, and physical safeguards designed to protect information against unauthorized access, use, disclosure, alteration, and destruction. These safeguards include encryption in transit and at rest, role-based access controls, authentication controls, audit logging, network security controls, and personnel training. Our platform is hosted on infrastructure that supports HIPAA compliance. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Our obligations with respect to safeguarding Protected Health Information, and with respect to breach notification, are set forth in the Business Associate Agreement and in HIPAA.

10. Data Retention

We retain information for as long as necessary to provide the Services, to comply with our legal, regulatory, tax, accounting, and recordkeeping obligations, to resolve disputes, and to enforce our agreements. Retention of Protected Health Information is governed by the Business Associate Agreement. We retain acknowledgement records described in Section 3 on a long-term basis, and, where permitted by Applicable Law, indefinitely, in order to preserve reliable evidence of Users’ assent to our Terms of Use, Disclaimer, and this Policy across successive versions. When information is no longer needed for a permitted purpose, we take reasonable steps to delete, destroy, or de-identify it.

11. Your Choices

You may review and update certain Account information through the Services or by contacting your organization’s administrator. You may manage certain cookies through your browser and may opt out of non-essential communications as described in Section 15. Additional rights that may be available under state privacy laws are described in Sections 12 and 13. Because much of the information processed through the Services is Protected Health Information or is provisioned and controlled by your organization, some choices may be exercised through your provider or your organization rather than directly with us.

12. State Privacy Rights

This Section applies to the extent a state comprehensive privacy law applies to our processing of your personal information and to the extent that information is not exempt. Information regulated by HIPAA, and de-identified data, are generally exempt from these laws, and this Section applies only to non-exempt personal information.

Rights that may be available

Depending on your state of residence and subject to exemptions and verification, you may have the right to: confirm whether we process your personal information and access it; obtain a portable copy; correct inaccuracies; request deletion; obtain information about our processing and disclosures; and opt out of the sale of personal information, the sharing of personal information for cross-context behavioral advertising, and certain profiling. We do not use personal information for such profiling in furtherance of decisions that produce legal or similarly significant effects.

Sensitive information

Where we process information that a state law defines as sensitive, we limit our use and disclosure of that information to purposes permitted by that law, and, where required, we process it only with your consent or subject to your right to limit its use.

No sale; opt-out preference signals

We do not sell personal information for money, and we do not share personal information for cross-context behavioral advertising in a manner that would require an opt out under applicable law. Where required, we honor recognized opt-out preference signals, such as the Global Privacy Control, transmitted by your browser.

How to exercise rights; appeals

To exercise a right, contact us at privacy@labdispatch.com. We will verify your request as required by Applicable Law and respond within the timeframe that the law requires. We will not discriminate against you for exercising a right. If we decline your request, you may appeal by replying to our response or by contacting us at privacy@labdispatch.com, and, if you remain dissatisfied, you may contact your state attorney general.

Authorized agents

Where permitted, you may use an authorized agent to submit a request, subject to our verification of the agent’s authority and your identity.

13. Consumer Health Data

Certain states, including Washington under the My Health My Data Act, Nevada, and others, regulate “consumer health data” that is not otherwise governed by HIPAA. To the extent we process consumer health data subject to such a law and not exempt from it, we collect and process that data only as necessary to provide a product or service you have requested, or with your consent where the law requires consent; we do not sell consumer health data without valid authorization; we restrict access to consumer health data to personnel and service providers who need it to provide the Services; and we honor the rights those laws provide, including rights to access and to request deletion of consumer health data, subject to the exemptions and limitations in the applicable law. Requests may be submitted to privacy@labdispatch.com. Much of the health-related data processed through the Services is Protected Health Information governed by HIPAA and the Business Associate Agreement, and is therefore exempt from these consumer-health-data laws.

14. Children’s Privacy

The Services are intended for healthcare professionals, laboratories, and authorized entities, and are not directed to children under the age of thirteen, and we do not knowingly collect personal information directly from children through the Services. To the extent the Services are used in connection with the care of a patient who is a minor, information about that patient is Protected Health Information handled under the Business Associate Agreement and HIPAA, and is provided by, and controlled by, the treating covered entity, not collected directly from the minor by us. If you believe a child has provided personal information to us directly, please contact us at the following: privacy@labdispatch.com.

15. Electronic Communications

We may communicate with you electronically regarding the Services, including service, security, and administrative messages, which are part of the Services and which you may not be able to opt out of while you maintain an Account. Where we offer optional communications, including any text-message notifications, we will obtain consent where required, and you may opt out by following the instructions in the communication or by contacting us. Message and data rates may apply to text messages. Your consent to electronic records and signatures is described in the Terms of Use and the Acknowledgement.

16. United States Processing

The Services are intended for use in the United States, and we process and store information in the United States. We do not offer the Services to individuals located outside the United States, and if you access the Services from outside the United States, you do so at your own initiative and are responsible for compliance with local law.

17. Third-Party Links and Services

The Services may contain links to, or interoperate with, third-party websites and services that we do not control. This Policy does not apply to those third parties, and we are not responsible for their privacy practices. We encourage you to review the privacy notices of any third party before providing information to it.

18. Changes to This Policy

We may update this Policy from time to time. We will post the revised Policy and update the “Effective Date,” and, for material changes, we will provide additional notice as required by Applicable Law and may request renewed acknowledgement. Your continued use of the Services after the effective date of a revision constitutes acceptance of the revised Policy to the extent permitted by Applicable Law.

19. How to Contact Us

If you have questions or requests regarding this Policy or our privacy practices, please contact:

Lab Angelus, Inc.

Attention: Privacy
Email: privacy@labdispatch.com
Mailing address: 6740 Antioch Rd., Ste. 200, Merriam, KS 66204 For questions concerning Protected Health Information, please contact your treating provider or laboratory, which is the covered entity responsible for that information.