CURA Medical Group LLC Privacy Policy

Last Updated: May 8, 2022

At CURA Medical Group, LLC (“CURA Medical Group,” “we,” or “us”), protecting your privacy is a priority. This Privacy Policy (“Policy”) explains how we collect, use, disclose, and safeguard your Personal Information, as defined below, whenever we provide our Services to you or communicate with you in writing or electronically. Your Protected Health Information, as defined under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), is handled differently and is addressed separately in our Notice of HIPAA Privacy Practices (“HIPAA Notice”) rather than in this Policy. In short: for questions about how we handle your Protected Health Information, refer to the HIPAA Notice; for everything else, this Policy applies. Using our Services means you accept the privacy practices described here. If any part of this Policy is unacceptable to you, please refrain from accessing or using our Services.

This Policy is subject to change. Whenever we update it, the “Last Updated” date at the top of the page will reflect the most recent revision, so we recommend checking back periodically to stay informed of our current privacy practices. For material changes, we will notify you in advance by emailing the address linked to your account before the update takes effect. Continuing to use the Services after a revised Policy takes effect constitutes your acceptance of the changes. If you’re not comfortable with an update, you’re free to discontinue use of our Services at any time.

1) Personal Information We Collect

We gather Personal Information whenever you use our Services — including any COVID-related offerings — open an account with us, or otherwise share information with us directly. For purposes of this Policy, Personal Information means any data that identifies, relates to, describes, or could reasonably be linked (directly or indirectly) to a specific individual. This includes, without limitation, a person’s first and last name, a unique identifier, an email address, a home, postal, or other physical address, and a phone number. Below are the categories of Personal Information we may collect about you:

a. Information You Provide to Us

This category covers information you supply directly — for example, when registering with us, using our Services, taking part in a survey or promotion, sharing feedback, or otherwise choosing to give us your details.

• When you register for our services, we may collect data such as your name, address, phone number, email address, race, ethnicity, title, date of birth, sex, gender identity, credit card details, occupation, and personal interests.
• As you use our Services — for instance, logging into your account or speaking with CURA Medical Group administrative staff — we may collect your name, address, email address, phone number, date of birth, credit card details, audio recordings (with your consent), and photos or videos (with your consent), and we may request microphone or camera access to confirm your identity and deliver Services to you.
• We occasionally invite users to take part in surveys, promotions, or feedback requests. Participants may be asked for certain Personal Information, such as name and email address, which we may use to follow up with them.

b. Communications from You

Whenever you interact with our Services — such as on https://curaveindoctors.com/ — fill out an electronic form, or reach us through online chat, email, phone, or text, we may automatically collect and retain details about you and that interaction. This can include your name and contact details, information you’ve chosen to share, the substance of your communication, the reason for the interaction, and how we responded to your request.

c. Information Related to Your Use of the Services

We also collect information automatically as you use our Services — referred to here as “Usage Data” — including data transmitted by your device. Examples include:

• Device details, such as hardware model, IP address (your computer’s internet address), unique device identifiers, browser type, and operating system.
• Traffic and usage data for https://curaveindoctors.com/, which may include the page you visited immediately before arriving at https://curaveindoctors.com/ or our mobile application, along with which pages or features of https://curaveindoctors.com/ or the app you browsed — helping us understand which parts of our site, app, and Services you use and for how long.
• Preference data, gathered via cookies, that helps make your experience on https://curaveindoctors.com/ more seamless.

d. Information Sent by Your Mobile Devices

Your mobile device also transmits certain information to us as you use our Services — such as a unique identifier, your device’s user settings and operating system, and data about how you use our services from that device.

e. Information from Our Clients and Partners

We may also receive your Personal Information through our business clients and partners — your employer, for instance — for one or more business purposes, including making our Services available to you.

2) Cookies and Other Tracking Technologies

a. Cookies

A “cookie” is a small file that certain websites place on your computer or smart device upon your visit. Cookies cannot read data from your hard disk, nor can they access cookie files placed by other websites. Two types are in use here: session cookies, which are erased once you close your browser and leave https://curaveindoctors.com/, and persistent cookies, which remain in place after you’ve left. A cookie file may hold information — such as a user ID — that https://curaveindoctors.com/ relies on to track which pages you’ve visited. Cookies set through https://curaveindoctors.com/ do not carry directly identifying details, such as your name, or sensitive data, such as a credit card number. We rely on cookies to:

• keep our Services running properly;
• support a secure browsing experience;
• gather passive data about your use of our Services;
• support our marketing efforts, including measuring engagement with our campaigns;
• help us refine and improve our Services; and
• remember your preferences for a smoother experience.

Categories of Cookies We Use. Our Services rely on the following cookie types:

• Strictly Necessary Cookies – These are required for our Services to function — for instance, granting access to secure areas. Without them, we simply cannot provide the Services. They are not used to gather marketing information about you, and because they’re essential to how our Services operate, they cannot be turned off.
• Functional Cookies – These remember your selections so we can personalize your experience and offer enhanced features — remembering your name or location, for example. They are not used for online marketing targeting. You may disable them, though doing so could reduce functionality.
• Performance or Analytics Cookies – These passively track how you use our Services, including which pages you visit and which links you click, helping us better understand and optimize the user experience. They are not used for marketing targeting, and you’re free to disable them.
• Third-Party Cookies – Placed by third-party service providers, these fall within one of the categories above. Any such provider processes your Personal Information on our behalf, under our instructions and consistent with this Policy.

Managing Your Cookies. The steps for managing cookies depend on whether they’re first-party or third-party:

• First-Party Cookies – To avoid receiving cookies while browsing https://curaveindoctors.com/, configure your browser to warn you before a cookie is accepted, and decline it when prompted. You can also block all cookies through your browser settings. Cookies aren’t required to browse most of https://curaveindoctors.com/, though disabling them may limit your access to certain portions or features of https://curaveindoctors.com/ and the Services. Instructions for disabling first-party cookies are typically found under your browser’s “Help,” “Tools,” or “Edit” menu, and more detail on adjusting cookie settings is available there as well.
• Third-Party Cookies – Certain third-party providers we work with, including advertisers, may set their own cookies on your device. This Policy addresses only our own cookie practices, not those of outside parties. Most modern browsers let you block third-party cookies as well; see the instructions referenced above.

b. Web Beacons

Web Beacons — sometimes called web bugs, pixel tags, or clear GIFs — are small, uniquely tagged graphics that may appear on https://curaveindoctors.com/ to interact with cookies. We use them to gauge how https://curaveindoctors.com/ and our Services are performing, track visitor volume, and assess how well our advertising is working. Unlike cookies, which live on your device, Web Beacons are usually invisible elements embedded within a web page or an email.

c. Analytics Technologies

If you have JavaScript enabled, your use of our Services is tracked through analytics tools, including Google Analytics and Mixpanel. Unless you’ve blocked the Analytics feature, it captures information such as: your user agent (browser) type, software manufacturer and version; operating system; network location and IP address; geographic data such as country, city, state, region, or county; hostname; bandwidth (connection speed); time spent on each page of https://curaveindoctors.com/; statistics on the referring site; the website (URL) you came from before arriving at https://curaveindoctors.com/; and any search engine query you used to find us (for example, a phrase typed into a search engine that led you to click through to our site). We use this data primarily to enhance the Service experience, and also for our own business purposes — for instance, to gauge how many users we have, where they come from, and how they engage with us.

d. Social Media

We may also obtain your Personal Information through your social media accounts, depending on the permissions you’ve granted. You can adjust or revoke these permissions at any time via your social media account’s privacy settings. For platform-specific instructions on modifying or removing third-party access, see the links below:

• Twitter
• Facebook
• LinkedIn

3) How We Use Your Personal Information

We use your Personal Information only in the ways described in this Policy, or with your informed consent.

a. To Provide Services to You

Your Personal Information helps us deliver the information or Services you’ve requested. We may also use general location data to personalize and improve what we offer — for instance, tailoring location-relevant content and Services. To fulfill your request, we may share your information with third-party service providers, who are contractually bound to protect it in line with this Policy.

b. For the Operation and Administration of Our Business

We rely on your Personal Information to run and grow our business and that of our affiliated companies — including building, operating, delivering, maintaining, and refining our content, products, and Services. This may involve monitoring how users engage with our Services, such as time spent, pages visited, and content viewed. We may also use aggregated versions of this data for research and development, aimed at introducing new features, functionality, content, products, and services.

c. For Business Analytics Purposes

We analyze — and may have third parties analyze — your Personal Information and Usage Data to evaluate how useful https://curaveindoctors.com/, our mobile app, and other parts of the Services are to you. This analysis shows us how well our navigation helps users find what they’re looking for and complete their goals, and lets us adapt features and functionality to better match user needs and preferences.

d. For Our Own Marketing Purposes

Marketing helps us build our community and keep you informed of new products and services, including joint offerings with our affiliated companies. We process your contact details and information about how you interact with our Services in order to: send marketing communications and product/service updates; share informational content; and deliver marketing tailored to you. From time to time, we may send free newsletters or promotional emails covering our Services that we think you’ll find relevant. Every such communication gives you a way to opt out — either through your account settings or the unsubscribe instructions in the email. Certain administrative and transactional communications, however — such as updates to our Terms of Service, this Policy, or billing and renewal notices — are necessary to send and cannot be opted out of.

e. To Provide Customer Support or Respond to You

When you reach out with a question, concern, piece of feedback, dispute, or issue, we collect what you share so that we can respond appropriately and support your experience with our Services.

f. For Account and Network Security Purposes

Your safety while using our Services matters to us, and protecting it requires processing certain Personal Information — device data, log-in details, activity records, and similar information — to stay ahead of privacy and security risks. We put this information to work fighting spam, malware, and other malicious or security-threatening activity; strengthening and enforcing our security practices; and verifying your identity to keep unauthorized users out of your information.

g. To Maintain Legal and Regulatory Compliance

Our Services fall under various laws and regulations that sometimes require us to process your Personal Information — for example, to comply with privacy or employment laws, or to manage risk as applicable law requires. If you submit a CCPA rights request, we’ll ask you for information to confirm your identity and residency status before fulfilling it.

h. To Enforce Compliance with Our Terms and Agreements or Policies

Accessing or using our Services means you agree to our Terms of Service and this Policy. To help ensure compliance, we process your Personal Information to monitor, investigate, prevent, and address any activity — alleged or confirmed — that’s prohibited, unlawful, or illegal on our Services, as well as to investigate and address any violations of our terms, agreements, or policies.

As stated above, your Personal Information is used only as described in this Policy or with your informed consent.

4) Data Security & Social Media

We protect the information you share with us through a combination of physical, electronic, and administrative safeguards. Certain features of our Services use industry-standard SSL encryption to secure data in transit, and your account is password-protected for added privacy and security. That said, no method of transmission over the Internet can be guaranteed completely secure, and while we work hard to protect your information, we cannot promise absolute security.

Protecting your Personal Information is a shared responsibility. We encourage you to take precautions whenever you’re online or communicating with us and others over the Internet — change passwords regularly, use a mix of letters and numbers, and browse using a secure connection. If you believe your account or interactions with us may have been compromised, or you suspect unauthorized use of your account, contact us right away. Should your payment details, username, or password be lost, stolen, or misused, please update your account promptly or notify us so we can help.

Certain parts of our Services — our social media presence, for instance — let users post comments, reviews, ratings, or other content visible to others. Avoid sharing anything through the Services that you wouldn’t want available to the public or other users; anything you post publicly is at your own risk regarding loss of privacy or other consequences.

We maintain accounts on various social media platforms, which we may use to share information or run promotions. Following or interacting with us there may result in our collecting Personal Information you’ve chosen to share. Keep in mind that using social media platforms can also mean those platforms collect or share your information independently of us — something over which we have no control and for which we accept no responsibility. Your engagement with social media, including with us, is entirely up to you, and we encourage reviewing each platform’s own privacy policies and settings to understand how your information is handled there.

5) Responding to Do Not Track Signals

At this time, we do not respond to browser-based “do not track” signals or similar opt-out mechanisms for cross-site and cross-service data collection, since no consistent industry standard exists for how online services should handle them. Should such standards emerge, we may adopt a formal response policy and reflect it here.

6) Communications & Disclaimers

a. Security Risks

Standard email providers — Gmail, Yahoo, Hotmail, and similar services — along with most cellular carriers, generally don’t offer secure or encrypted communication. This creates a real risk that protected health information sent by email or text could be disclosed to, or intercepted by, unauthorized third parties. Email and text messages accessed via personal computers, laptops, or phones also carry inherent privacy risks — particularly when the account is employer-provided, lacks password protection, or is shared with others. More secure alternatives, such as phone, fax, or mail, remain preferred and are always available.

b. Responsibility

By agreeing to communicate via unsecured or unencrypted email or text, you accept responsibility for any unauthorized access to, or disclosure of, protected health information contained in those messages. The Practice bears no responsibility for unauthorized access occurring during transmission, nor for safeguarding information once it has been delivered. That said, the Practice will take reasonable steps to protect any protected health information before sending it to the requested address, and will limit each communication to the minimum necessary amount of protected health information.

c. Additional Information

Understand that email and text are not substitutes for direct communication with your physician and should not be treated as private channels. The Practice cannot guarantee that inboxes are monitored continuously, so replies may take hours or even days, and messages can occasionally be missed or lost to transmission errors — the Practice is not liable for issues caused by such delays. For urgent or emergency matters, contact the Practice by phone, or call 9-1-1 if applicable. Staff will monitor incoming messages to route and respond to them appropriately, so avoid including sensitive information in anything you send. Emails or text messages, sent or received, may become part of your medical record at the Practice’s discretion. By signing this form, or by initiating contact with the Practice via email, text, or a web form, you’re agreeing that Vein Treatment Clinic may communicate with you at the contact information provided, and you acknowledge the limitations described above.

d. Communications

Messages sent through https://curaveindoctors.com/, social media, or email are neither encrypted nor guaranteed to be secure. Using the internet or email is offered strictly for your convenience, and doing so means accepting the risk of unauthorized access. Submitting your email address also means agreeing to receive news and special offers from Cura Medical Group, and you agree to release Cura Medical Group, its doctors, and its affiliates from liability for any hacking or unauthorized use of your personal information by outside parties.

e. Disclaimer

Any trademarks or names appearing on the site are used solely for identification and do not imply any affiliation.

Indemnity: No one affiliated with us is liable for damages arising from your use of https://curaveindoctors.com/ or from your failure to follow the terms of service.

Variation: Cura Medical Group LLC reserves the right to modify or remove any services or pages listed on https://curaveindoctors.com/, at any time and without prior notice.

Invalidity: If any part of these Terms of Service is found unenforceable, the remaining provisions stay in full effect. Wherever a clause or sub-clause can be partially severed to preserve its valid portion, it will be interpreted accordingly; where an unenforceable part of a clause can be removed while keeping the clause’s intended meaning intact, that part will be severed and the remainder enforced.

Complaints: We maintain a complaints process to resolve disputes as soon as they arise — please let us know of any complaints or comments.

Waiver: Not acting on a violation of these terms doesn’t waive our right to act on a future violation.

Disclaimer of Liability: We don’t warrant the accuracy of information on this site. Except where explicitly stated otherwise, we accept no responsibility for damages of any kind, and we are not liable for personal harm resulting from our negligence or misrepresentation.

Notice of HIPAA Privacy Practices

Last Updated: May 8, 2022

Under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), we’re required to ask every patient to acknowledge receipt of this Notice of HIPAA Privacy Practices, which is published on https://curaveindoctors.com/ and at our clinics. You can acknowledge receipt by clicking the “I Acknowledge Receipt of the Notice of HIPAA Privacy Practices” button, or through another written or digital method we provide. A copy of the Notice is available upon request at our clinic, or you may print one from https://curaveindoctors.com/ at any time.

HIPAA requires the Companies to take steps to protect the privacy of your “Protected Health Information” (“PHI”) — information we’ve created or received relating to your health or the payment for your healthcare. This includes both your medical records and personal details such as your name, Social Security number, financial information, address, and phone number.

Federal law obligates us to:

• Protect your PHI’s privacy — every employee and provider must maintain PHI confidentiality and complete appropriate privacy training.
• Provide this Notice of Privacy Practices, explaining our duties and practices concerning your PHI.
• Notify you if a breach of unsecured PHI occurs.
• Follow the practices and procedures described in this Notice.

The Companies use and disclose PHI in various ways tied to your treatment, payment for care, and our healthcare operations. Below are examples of how we may use or disclose your PHI without needing your authorization.

Treatment

• To physicians, nurses, and other staff involved in your healthcare or preventive care.
• Across our departments, to coordinate treatment-related activities such as prescriptions, lab work, and X-rays.
• To outside healthcare providers involved in your treatment who aren’t part of our staff — dentists, emergency room personnel, specialists, and others. For example, if you’re being treated for a knee injury, we may share your PHI among your primary care provider, a knee specialist, and a physical therapist so each can coordinate your care.

Payment

• To administer your health benefits policy or contract.
• To bill you for the healthcare we provide.
• To pay other providers who cared for you.
• To other organizations and providers for payment-related activities, except where disclosure is legally prohibited.

Healthcare Operations

• To administer and support our business operations, or those of other healthcare organizations as permitted by law, including providers and health plans — for example, using your PHI for quality analysis, data aggregation, reviewing and improving our services and your care, and staff training.
• To individuals such as consultants and attorneys, and to other companies and organizations that assist with our business operations. Any organization we share your PHI with for this purpose must agree to protect your privacy.

Other

We may use or disclose your PHI without authorization for legal or governmental purposes in the circumstances below:

• As required by law – When mandated by law, including workers’ compensation statutes.
• Public health and safety – To an authorized public health authority or individual, in order to:
  • Protect public health and safety.
  • Prevent or control disease, injury, or disability.
  • Report vital statistics, such as births or deaths.
  • Investigate or monitor issues involving prescription drugs and medical devices.
• Abuse or neglect – To government entities authorized to receive reports of abuse, neglect, or domestic violence.
• Minors – Parents and legal guardians generally act as legal representatives for minor patients, though state law sometimes allows minors to consent to their own treatment in certain circumstances. As a rule, we share a minor patient’s PHI with their parents or guardians unless the minor could have consented to that care themselves — except where applicable law requires parental disclosure regardless.
• Oversight agencies – To health oversight agencies for activities such as audits, examinations, investigations, inspections, and licensing.
• Legal proceedings – During legal proceedings, or in response to a court or administrative agency order, subpoena, discovery request, or other lawful process.
• Law enforcement – To law enforcement in certain circumstances — for example, to identify or locate a suspect, witness, or missing person; report a crime; or provide information about crime victims.
• Health Information Exchanges – We may participate in health information exchanges (HIEs), sharing your medical information electronically with other HIE participants for treatment, payment, and healthcare operations purposes. HIEs let us and your other healthcare providers share and use information more efficiently for your treatment and other lawful purposes. In states where HIE inclusion is voluntary, we’ll honor your right to opt in or out; where you opt in or don’t opt out, we may share your medical information with the HIEs we participate in, consistent with applicable law.
• Financial information – We may request income or other financial information to determine your eligibility for a low-income membership fee waiver or similar accommodations, and may use that information for operations, marketing, administrative purposes, and improving our services.
• Research – We may disclose your health information for research, subject to state and federal confidentiality protections. Typically we’ll seek your written authorization first; however, in some cases, an Institutional Review Board (IRB) may determine — applying specific criteria — that a research protocol poses minimal privacy risk, allowing use or disclosure without written authorization. We will never allow researchers to publicly identify you by name without your authorization. We may also release PHI, without written authorization, to individuals preparing a future research project, provided no information identifying you leaves Cura Medical Group. Participation in any research study is entirely voluntary, has no bearing on your treatment or welfare, and your PHI remains protected throughout.
• Military activity and national security – To the military and authorized federal officials for national security and intelligence purposes, to the Department of Veterans Affairs as military authorities require, or in connection with protective services for the President of the United States.

We may also use or disclose your PHI without authorization in these additional circumstances:

• Contacting you directly – Using your email address or phone number, we may reach out with appointment reminders, other care-related communications, or information about treatment alternatives and health-related services or benefits that might interest you — via email, phone call, or text.
• Your patient account – Certain PHI, such as care and treatment details, appointment history, and medication records, may be made accessible to you through online tools like email.
• Family and friends – To a family member, relative, close friend, or another person you’ve identified as involved in your healthcare, when you’re not present or unable to make a healthcare decision and we judge disclosure to be in your best interest. We’ll also assume we can discuss your PHI with anyone you allow to be physically present during that discussion — for instance, a friend who brings you to the emergency room, someone other than you picking up a prescription, or a companion at an in-office appointment.
• Unless you tell us otherwise, your name, general location within our facility, and general health condition may be shared with people who ask for you by name, and clergy will be told your religious affiliation if they inquire — this helps family, friends, and clergy visit and check on you.
• In our waiting area – We may call your name aloud in the waiting room. If you’d rather we didn’t, let the front desk know and we’ll accommodate that.
• Treatment alternatives and plan description – To discuss treatment services, options, or alternatives with you, share health-related benefits or services that may interest you, or describe our health plan and providers.
• De-identified information – Once information is stripped of anything that could identify you, we may use or disclose it freely, except where the law says otherwise.
• Coroners, funeral directors, and organ donation – To coroners, funeral directors, and organ donation organizations, as the law authorizes.
• Disaster relief – To an authorized public or private disaster relief organization — for example, to help notify family of your location or condition.
• Threat to health or safety – To prevent a serious threat to your health or safety, or that of others.

Except in the situations listed in the sections above, we will use and disclose your PHI only with your written authorization. This means we will not use your PHI in the following cases, unless you give us written permission:

• Marketing purposes, except as allowed by HIPAA or applicable law (by way of example, marketing communications allowed by HIPAA without authorization include communications pertaining to care or treatment and/or our products or services).
• Sale of your information.
• Sharing your PHI with your employer or school.
• Most sharing of psychotherapy notes.

In some situations, federal and state laws provide special protections for specific kinds of PHI and require authorization from you before we can disclose that specially protected PHI. For example, additional protections may apply in some states to genetic, mental health, drug and alcohol abuse, rape and sexual assault, sexually transmitted disease and/or HIV/AIDS-related information, and/or to the use of your PHI in certain review and disciplinary proceedings of healthcare professionals by state authorities. In these situations, we will comply with the more stringent state laws pertaining to such use or disclosure.

We may also use PHI to send appointment reminders and other care-related communications, or to inform you about treatment alternatives or health-related services and benefits of interest, via email, phone call, or text message. Choosing to communicate with us by email, text, or chat means acknowledging that PHI may be exchanged through those channels, that email, text, and some chat functions may not be secure, and that you accept the associated security risks. If you’d rather not exchange PHI this way, you can simply choose not to communicate with us through those channels, and let us know accordingly.

This Notice may be updated periodically, with any revised version applying to all PHI we maintain. We’ll publish changes by posting the updated Notice on https://curaveindoctors.com/, and the “Last Updated” date at the top will reflect the most recent revision. We recommend reviewing this Notice from time to time to stay current on our HIPAA privacy practices.