Health Data Privacy Policy

1 Scope and responsibilities

CallMed USA (“we,” “our,” or “us”) connects patients with clinical services and collects patient payments. This Policy describes consumer health data that we collect or control and can be read independently. Our Privacy Policy addresses our broader information practices; this Policy controls any conflict concerning consumer health data. Consumer health data includes information linked or reasonably linkable to an individual that identifies health status or efforts to obtain healthcare, as defined by applicable law.

Brazilian Clinic LLC is currently our only participating clinical provider. Its licensed clinicians provide care through its clinical systems. CallMed USA does not perform consultations. Current services are routine primary care consultations and annual check-up scheduling for patients physically located in Florida, excluding urgent and emergency care.

Brazilian Clinic maintains clinical records in NextGen and uses Doxy for telehealth. This Policy is not its HIPAA Notice of Privacy Practices. Our handling of protected health information on its behalf is governed by applicable HIPAA requirements and our business associate agreement. Other consumer health privacy laws apply according to their coverage and exemptions.

2 Categories and sources

Healthcare access and service data: membership or consultation selection, eligibility, enrollment, scheduling, activation or use of a consultation, cancellation status, and associated dates or identifiers. Sources are you, your authorized representative, our systems, and Brazilian Clinic's administrative communications.

Linked identifying and transaction data: name, contact details, address, age or date of birth, preferred language, account identifiers, billing and payment status, and purchase or renewal details when linked to healthcare access. Sources are you, authorized representatives, our account systems, payment processors, and service vendors.

Technical data: IP addresses, device or browser information, session identifiers, access times, and interactions with healthcare-access features when they reveal or are linked to healthcare activity. Sources are your device, our website, and vendors processing information for us.

Incidental health information: medical details you choose to include in support communications. We use these to address or route the request as legally permitted. Clinical questionnaires, diagnoses, prescriptions, treatment notes, and results should be submitted through Brazilian Clinic's clinical channels. We do not ordinarily maintain a separate clinical chart.

3 Purposes of collection and use

We collect and use the categories above to administer accounts, purchases, eligibility, consultation access and scheduling; process payments and billing inquiries; provide support; communicate about requested services; secure accounts; prevent fraud and misuse; maintain necessary records; and comply with legal obligations or establish, exercise, or defend legal rights.

We process health data only to the extent permitted by applicable law, including when necessary to provide a service you request or with required consent. We do not use it to infer diagnoses or build health-based advertising profiles.

4 Categories shared and recipients

Brazilian Clinic LLC receives identifying, contact, age or date-of-birth, eligibility, scheduling, and service-access information needed to arrange requested care. Incidental clinical information may be routed to it when necessary and legally permitted. It independently collects the clinical information needed for care. Brazilian Clinic is the only current clinical recipient identified under this arrangement.

Processors and service vendors may receive limited identifying, transaction, access, technical, or support data needed for hosting, storage, payment administration, communications, account support, security, fraud prevention, limited analytics, or professional services. Required contractual protections restrict their processing to authorized purposes. We do not intentionally include diagnoses or clinical notes in payment descriptions or metadata.

Governmental or legal recipients may receive information when disclosure is required or permitted by applicable law. Transaction parties may receive information in a merger, restructuring, or asset transfer only as legally permitted and subject to applicable safeguards and privacy commitments.

We do not share consumer health data with affiliated companies for their own marketing. Brazilian Clinic and other affiliated providers may have their own policies for data they independently collect or control. Those policies do not expand our permission to share data or reduce our obligations under this Policy.

5 Sale advertising and geofencing

We do not sell consumer health data or exchange it for consideration in a manner that constitutes a sale under applicable law. We do not share it with data brokers or advertising networks for targeted or cross-context behavioral advertising.

We do not use geofencing around healthcare facilities to identify or track people seeking healthcare, collect health data, or send health-based advertising. Limited operational analytics must comply with these restrictions.

6 Consent and withdrawal

Where required, we obtain consent before collection or sharing and obtain separate sharing consent when the law requires it. The request identifies the categories, purposes, recipients, and withdrawal method. Acceptance of a privacy policy or unrelated terms does not substitute for required affirmative consent.

You may withdraw consent by email at contact@callmed.com or by WhatsApp at the number displayed on https://callmedusa.com/. Withdrawal applies to future processing and does not invalidate prior lawful processing. If processing is necessary for a requested service, withdrawal may prevent that service to the extent permitted by law; declining optional marketing does not prevent access to core purchased services.

7 Rights requests and appeals

Depending on applicable law, you may confirm whether we collect, share, or sell consumer health data; access or obtain a copy; obtain a list of relevant third parties and affiliates and their contact details; correct inaccuracies; withdraw consent; request deletion or cessation of covered processing; and appeal a refusal. We will not unlawfully discriminate against you for exercising these rights.

Submit a Consumer Health Data Privacy Request by email at contact@callmed.com or by WhatsApp at the number displayed on https://callmedusa.com/. No purchase or new account is required. We may reasonably verify identity and an agent's or representative's authority. We respond within the applicable legal deadline.

If we deny a request and an appeal right applies, submit a Consumer Health Data Privacy Appeal through the same channel, identifying the decision. We review it within the legally required period and provide applicable regulatory complaint information.

8 Deletion retention and security

We retain health data only as reasonably necessary for authorized service administration, security, billing, legal obligations, or other lawful purposes, subject to applicable retention limits. For a valid deletion request, we delete covered data and notify processors and other recipients as required. Backup deletion and permitted retention follow applicable law.

Deletion of CallMed USA data does not automatically delete Brazilian Clinic's clinical records. Direct medical-record requests to Brazilian Clinic through its patient platform. You may also contact us by email at contact@callmed.com or by WhatsApp at the number displayed on https://callmedusa.com/ for help routing requests concerning information we handle on its behalf.

We maintain reasonable administrative, technical, and physical safeguards and restrict access to authorized purposes. We apply required HIPAA protections where applicable. No system guarantees absolute security. Properly deidentified data is maintained in that form and is not reidentified except as legally permitted to test deidentification. It may be used for lawful internal analysis and improvement.

9 Minors changes and contact

Adults manage accounts. If a purchased service is available to a minor, we may process the limited administrative data needed to arrange it. Parents, guardians, minors, and authorized representatives may exercise rights as provided by law. Brazilian Clinic separately handles clinical consent and records.

We will update this Policy as practices change, including changes in health-data categories, purposes, or recipients, and give notice and obtain consent before new processing when required. A policy update alone does not supply required consent.

For questions or requests, contact CallMed USA by email at contact@callmed.com or by WhatsApp at the number displayed on https://callmedusa.com/ and identify the inquiry as concerning consumer health data. For clinical privacy matters, use Brazilian Clinic's patient channels.