HIPAA Notice of Privacy Practices

3.1 Uses to Provide You the Peroya Service

• Retrieve and display your health records in plain language in your preferred language
• Track prior authorization status and notify you of changes
• Help you understand your options after a prior authorization decision, including your right to appeal
• Prepare advocacy documents you review and authorize us to send on your behalf under your recorded authorization, such as data access requests, appeal letters, and grievance submissions
• Enable caregivers or family members you have authorized to support your healthcare management

3.2 Patient-Authorized Communications with Health Plans

When you ask Peroya to reach out to your health plan, your authorization is recorded before any action is taken. These communications are made as your representative, carrying out your explicit instruction. You may revoke any authorization at any time within the app.

3.3 Uses and Disclosures Requiring Your Written Authorization

Peroya will not use or disclose psychotherapy notes obtained from your health plan without your separate written authorization, beyond what is necessary to provide you the Peroya service.

3.4 Special Categories of Health Information

Certain categories of health information receive additional protection under federal and Puerto Rico law. Peroya's sensitive service filters ensure these categories are never displayed to parents, caregivers, or other authorized representatives without the patient's explicit consent, regardless of the permissions otherwise granted to that representative.

• Mental health and substance use records: protected under 42 CFR Part 2 and applicable Puerto Rico law
• Reproductive health information: protected under minor consent laws; not accessible to parents through Peroya
• HIV and STI records: subject to additional state and federal restrictions

3.5 Uses Permitted Without Authorization

• As required by law (court orders, legal process)
• Public health reporting as required by applicable authorities
• To avert a serious and imminent threat to health or safety

4.1 Right to Access Your PHI

You may inspect and obtain a copy of your PHI that Peroya holds. Use the data export feature in the app or contact [email protected]. We will respond within 30 days.

4.2 Right to Request Amendment

If you believe health information Peroya has retrieved on your behalf is inaccurate or incomplete, Peroya will submit a formal correction request to your health plan on your behalf, under your recorded authorization. Your health plan, as the covered entity responsible for your records, will evaluate and respond to the request. Peroya will track the status of your correction request and notify you of the plan's response. To initiate a correction request, use the correction request feature in the app or contact [email protected].

4.3 Right to an Accounting of Disclosures

You may request a list of disclosures of your PHI other than those you authorized. Contact [email protected].

4.4 Right to Request Restrictions

You may request restrictions on how Peroya uses or discloses your PHI. Contact us via email at [email protected].

4.5 Right to Opt Out of the Provider Access API

You may opt out of the Provider Access API feature at any time in Peroya's privacy settings, as established under CMS-0057-F.

4.6 Right to Communications in Your Language

You have the right to receive communications about your health information in a language you understand. Peroya provides Spanish and English as primary languages with professional review. For other languages, contact [email protected] to request a translation.

4.7 Right to Request Archived Records

You have the right to access records of actions taken on your behalf that have been transferred to the archive. If you wish to obtain records that no longer appear in your active history, you may submit a request directly from the app. Go to your profile, select "Privacy and Data," and follow the instructions to submit your archive request.

Peroya will process your request within the thirty-day window required by HIPAA. Requested records will be displayed inside the Peroya app using the screens you already know. The fulfilled request content will remain available for thirty days. Seven days before the expiration date, you will receive a reminder notification. Once thirty days have passed, the delivery content will clear from the server. The underlying records remain permanently in the archive and can be requested again at any time.