NOTICE OF PRIVACY PRACTICES
Paloma Health (PH)
Who this notice covers. This is a joint notice of Butterfly Health, Inc. d/b/a Paloma Health ("Paloma Health"), which operates the Paloma Health platform, and [Medical Group legal name(s)] (the "Medical Group"), whose licensed providers deliver medical care through the platform. Paloma Health and the Medical Group share health information with each other as needed for your treatment, payment, and health care operations, and each follows this notice. In this notice, "we" and "us" refer to both.
Guillaume Cohen-Skalli, HIPAA Privacy Official
(434) 248 7508 · privacy@palomahealth.com · 386 Park Avenue South, 5th Floor, New York, NY 10016
Effective Date: September 14th, 2026
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
We understand the importance of privacy and are committed to maintaining the confidentiality of your medical and health information. We maintain records of your health services we cover (claims), and we also maintain information about your health status that we have used for enrollment processing and may receive such records from others. We use these records to administer your health plan benefits and coverage; we may also use these records to coordinate benefits with other health plans, ensure appropriate quality of services provided to you and to enhance the overall quality of our services, and to meet our obligations as a health plan. We consider this health information, and the records we maintain, to be protected health information. We are required by law to maintain the privacy of protected health information and to provide individuals such as health plan participants with notice of our legal duties and privacy practices with respect to protected health information. This notice describes how we may use and disclose your protected health information. It also describes your rights and our legal obligations with respect to your protected health information. If you have any questions about this Notice, please contact our Privacy Official listed above.
A. How We May Use or Disclose Your Health Information
We collect health information about you as your health care provider and as the platform that supports your care, and store it in paper or electronic records. This is your medical record. The record itself is the property of the Medical Group and Paloma Health, but the information in it belongs to you. The law permits us to use or disclose your health information for the following purposes:
1. Treatment. We use and disclose your health information to provide, coordinate, and manage your care. For example: a Medical Group provider reviews your questionnaire responses, medical history, and any photographs you upload — including in asynchronous visits, where the review happens without a live video or telephone visit; your provider records your visit in your medical record, which is maintained in an electronic health record system; if your provider issues a prescription, we transmit it, together with your name, date of birth, contact information, shipping address, and allergy information, to the pharmacy you choose (such as Honeybee Health) so it can fill and ship your medication; and we may share information with a laboratory, a specialist, or another health care provider involved in your care, including to coordinate your care among different providers or to refer you for services we do not provide.
2. Payment. We use and disclose your health information to bill and collect payment for services and medications you order. Most services on the platform are self-pay: we charge the payment method you provide, send you payment and refill notices, and process refunds. Our payment processor receives the information needed to process the charge but not your medical information. If you use a service that is billed to a health plan, we may share information with that plan to obtain payment, unless you have paid in full out of pocket and asked us not to (see Your Health Information Rights, below). We always take care to use or disclose only the minimum necessary protected health information to accomplish these purposes.
3. Health Care Operations. We may use and disclose your health information to run our practice and platform and to improve the quality of care. For example, we may use and disclose it to: review the quality and safety of care provided by the health care professionals who treat you, including reviewing providers' clinical decisions; train providers and staff; evaluate provider performance and credentials; audit who has accessed your record; investigate and respond to complaints and incidents; resolve payment, order, or shipping problems with a medication you ordered; obtain legal, accounting, and audit services, including fraud and abuse detection and compliance programs; conduct business planning and management; and, if our practice or platform is sold, merged, or transferred, share information with the prospective buyer as permitted by law. We may also de-identify your information so that it no longer identifies you, and use the de-identified information for analysis, research, and product improvement.
We may share your protected health information with our "business associates" — companies that perform services for us, such as our cloud hosting and storage provider, electronic health record system, secure messaging platform, email and text-message delivery providers, and payment processor. We have a written contract with each business associate that requires it to protect the confidentiality and security of your protected health information and to use it only for the services it provides to us. See Business Associates, below.
4. Communications with You. We may contact you by email, text message, telephone, mail, or through the patient portal about your care and your account. For example, we may send you: your provider's decision after a visit, including an asynchronous visit; follow-up questions or requests for more information from your provider; appointment reminders; prescription, refill, and shipping notices; check-ins your provider requires before a refill; payment notices and receipts; one-time verification codes; reminders to complete a visit you started; and safety information about a medication you are taking.
Standard email and text messages are not encrypted. A message could be read by someone with access to your email account or your phone, and text messages may appear on your phone's lock screen. By giving us your email address and mobile phone number, you agree that we may use them for the communications described here. You may change how we contact you at any time: you may ask us to send communications about your care only through the secure patient portal, to use a different email address or phone number, or to stop sending text messages by replying STOP to any message (we will then send those notices by email instead). We will accommodate reasonable requests; see Right to Request Confidential Communications, below.
Some communications are sent through service providers who act as our business associates, such as our messaging, email, and text-message delivery providers; they may not use your information for any other purpose. We will not use the contact information you give us for care communications to send you marketing unless you have agreed to receive marketing (see Marketing, below).
5. Breach Notification. In the case of a breach of unsecured protected health information, we will notify you as required by law. If you have provided us with a current email address, we may use email to communicate information related to the breach. In some circumstances our business associate may provide the notification. We may also provide notification by other methods as appropriate.
6. Notification and Communication with Family. We may disclose your health information to notify or assist in notifying a family member, your personal representative, or another person responsible for your care about your location, your general condition, or in the event of your death. In the event of a disaster, we may disclose information to a relief organization so that they may coordinate these notification efforts. We may also disclose information to someone who is involved with your care or helps pay for your care. If you are able and available to agree or object, we will give you the opportunity to object prior to making these disclosures, although we may disclose this information in a disaster even over your objection if we believe it is necessary to respond to the emergency circumstances. If you are unable or unavailable to agree or object, our health professionals will use their best judgment in communicating with your family and others.
7. Marketing. We may contact you to give you information about products or services related to your treatment, case management, or care coordination, or to direct or recommend other treatments or health-related services that may be of interest to you. We may also communicate with you about health-related products and services that Paloma Health or the Medical Group offers, such as new treatments, visit types, or programs; about alternative treatment options, settings of care, or providers; and about a drug or biologic that is currently being prescribed to you, including refill reminders and check-ins your provider requires. Our representatives may communicate with you face to face or provide a promotional gift of nominal value. These activities do not require your authorization.
For any other marketing activity, including any for which we receive remuneration from a third party, we will not use or disclose your protected health information without your written authorization, which you may revoke at any time. We will never sell your health information. We do not share your health information with advertising platforms or analytics companies, and we do not use information about the conditions you are treated for or the medications you are prescribed to target advertising to you. Where state law (for example, California's Confidentiality of Medical Information Act) requires authorization for a marketing use that HIPAA would permit, we follow state law.
You may opt out of marketing communications at any time using the unsubscribe link in any marketing email or by notifying the Privacy Official listed above. Opting out does not affect communications about your care, such as visit results, prescription and refill notices, or safety information.
8. Required by Law. As required by law, we will use and disclose your health information, but we will limit our use or disclosure to the relevant requirements of the law. When the law requires us to report abuse, neglect, or domestic violence, or to respond to judicial or administrative proceedings or to law enforcement officials, we will further comply with the requirements set forth below concerning those activities.
9. Public Health. We may, and are sometimes required by law to, disclose your health information to public health authorities for purposes related to: preventing or controlling disease, injury, or disability; reporting child, elder, or dependent adult abuse or neglect; reporting domestic violence; reporting to the Food and Drug Administration problems with products and reactions to medications; and reporting disease or infection exposure. When we report suspected elder or dependent adult abuse or domestic violence, we will inform you or your personal representative promptly unless, in our best professional judgment, we believe the notification would place you at risk of serious harm or would require informing a personal representative we believe is responsible for the abuse or harm.
10. Health Oversight Activities. We may, and are sometimes required by law to, disclose your health information to health oversight agencies during the course of audits, investigations, inspections, licensure, and other proceedings, subject to the limitations imposed by applicable law.
11. Judicial and Administrative Proceedings. We may, and are sometimes required by law to, disclose your health information in the course of any administrative or judicial proceeding to the extent expressly authorized by a court or administrative order. We may also disclose information about you in response to a subpoena, discovery request, or other lawful process if reasonable efforts have been made to notify you of the request and you have not objected, or if your objections have been resolved by a court or administrative order.
12. Law Enforcement. We may, and are sometimes required by law to, disclose your health information to a law enforcement official for purposes such as identifying or locating a suspect, fugitive, material witness, or missing person; complying with a court order, warrant, or grand jury subpoena; and for other law enforcement purposes.
13. Coroners. We may, and are often required by law to, disclose your health information to coroners in connection with their investigations of deaths.
14. Organ or Tissue Donation. We may disclose your health information to organizations involved in procuring, banking, or transplanting organs and tissues.
15. Public Safety. We may, and are sometimes required by law to, disclose your health information to appropriate persons in order to prevent or lessen a serious and imminent threat to the health or safety of a particular person or the general public.
16. Specialized Government Functions. We may disclose your health information for military or national security purposes or to correctional institutions or law enforcement officers that have you in their lawful custody.
17. Worker's Compensation. We may disclose your health information as necessary to comply with worker's compensation laws. For example, if you receive care for a work-related injury or illness, a worker's compensation carrier may request records to determine benefits.
18. Business Associates. We share your health information with companies that perform services for us under written agreements that require them to protect it and to use it only for the services they provide. These currently include our cloud hosting and storage provider (Google Cloud), our electronic health record system (athenahealth), our secure messaging platform (Help Scout), our email and text-message delivery providers (Mailgun, Twilio), and our payment processor (Stripe) to the extent it receives health information. Our business associates may change; a current list is available from the Privacy Official.
19. Telehealth, Asynchronous Visits, and Photographs. We provide care through telehealth, including live video or telephone visits and asynchronous visits. In an asynchronous visit, the questionnaire you complete and any photographs you upload are stored and reviewed later by a provider. Photographs become part of your medical record. We use them only for your care and as otherwise permitted by this notice, and we do not use them for marketing or to train automated systems. Health information transmitted electronically is protected by safeguards such as encryption and access controls, but no electronic system is completely secure.
20. Automated Tools. We use automated tools to support your care. When you submit an asynchronous visit, rules set by our clinicians screen your answers for safety criteria (for example, a medication interaction or a condition that requires a live visit); these rules may determine that a request cannot proceed, but every prescribing decision is made by a licensed provider. We also use automated tools, including AI-based text analysis within our HIPAA-covered systems, to read prescription instructions and calculate refill timing; staff review the results. We do not use your health information to train AI models.
B. When We May Not Use or Disclose Your Health Information
Except as described in this Notice of Privacy Practices, we will not use or disclose health information which identifies you without your written authorization. In particular, we will obtain your written authorization before: using or disclosing your health information for marketing purposes (other than face-to-face communications or promotional gifts of nominal value); selling your health information; or using or disclosing psychotherapy notes, if any. If you authorize us, you may revoke that authorization in writing at any time, except to the extent we have already acted on it.
C. Your Health Information Rights
1. Right to Request Restrictions. You have the right to request restrictions on certain uses and disclosures of your health information, by a written request to the Privacy Official specifying what information you want to limit and what limitations on our use or disclosure of that information you wish to have imposed. We are not required to agree to most requests; if we do agree, we will honor the restriction except in an emergency, and we will notify you of our decision either way. There is one request we must agree to: if you pay for a service or medication in full out of pocket, you may ask us not to disclose information about that service or medication to your health plan for payment or health care operations, and we will comply unless the disclosure is required by law.
2. Right to Request Confidential Communications. You have the right to request that we communicate with you about your health information in a specific way or at a specific location. For example, you may ask that we contact you only through the patient portal, only at a particular email address or phone number, or only by mail at a particular address. We will accommodate all reasonable requests submitted in writing to the Privacy Official that specify how or where you wish to receive communications. You do not need to tell us why you are making the request. If a requested method involves additional cost, we may ask you to cover that cost.
3. Right to Inspect and Copy. You have the right to inspect and obtain a copy of your health information, with limited exceptions. To access your protected health information, submit a written request to the Privacy Official describing what information you want and whether you want to inspect it or receive a paper or electronic copy. If we maintain the information electronically, you may request it in an electronic form and format, and you may direct us to send a copy to a person or entity you designate. We will respond within 30 days and may charge a reasonable, cost-based fee as allowed by law. We may deny your request in limited circumstances; if we do, we will tell you why in writing, and in certain cases you have the right to have the denial reviewed.
4. Right to Amend or Supplement. You have the right to request that we amend health information in our possession that you believe is incorrect or incomplete. You must make the request in writing to the Privacy Official and include the reasons you believe the information is inaccurate or incomplete. We are not required to change your health information, and if we deny your request we will tell you why and how you can disagree with the denial and have your statement of disagreement added to your record. We may deny your request if, for example: we do not have the information; we did not create the information (unless the person or entity that created it is no longer available to make the amendment); you would not be permitted to inspect or copy the information at issue; or the information is accurate and complete as is.
5. Right to an Accounting of Disclosures. You have the right to receive a list of certain disclosures of your health information that we have made in the six years before your request. The list will not include disclosures made to you or under your written authorization; disclosures for treatment, payment, or health care operations (paragraphs 1, 2, and 3 of Section A); disclosures to family members and others involved in your care (paragraph 6); disclosures for specialized government functions (paragraph 16); disclosures for research or public health that exclude direct identifiers; disclosures that are incidental to a use or disclosure otherwise permitted or authorized by law; or disclosures to a health oversight agency or law enforcement official when that agency or official has told us that providing the accounting would be reasonably likely to impede its activities. The first accounting you request in any 12-month period is free; we may charge a reasonable, cost-based fee for additional requests in the same period, and we will tell you the fee in advance so you can withdraw or modify your request.
6. Right to Be Notified of a Breach. You have the right to be notified if a breach of your unsecured protected health information occurs, as described in paragraph 5 of Section A.
7. Right to Choose Someone to Act for You. If you have given someone medical power of attorney or someone is your legal guardian, that person may exercise your rights and make choices about your health information. We will confirm that the person has this authority and can act for you before we take any action.
8. Right to a Paper Copy of This Notice. You have the right to a paper copy of this Notice of Privacy Practices at any time, even if you have agreed to receive it electronically. This Notice is also available on our website and in the patient portal.
9. Right to File a Complaint. You have the right to complain to us and to the U.S. Department of Health and Human Services if you believe your privacy rights have been violated, as described in Section E. We will not retaliate against you for filing a complaint.
If you would like a more detailed explanation of these rights or wish to exercise any of them, contact our Privacy Official listed at the top of this Notice of Privacy Practices.
D. Changes to this Notice of Privacy Practices
We reserve the right to change this Notice of Privacy Practices and our privacy practices at any time. Until we do, we are required by law to comply with the Notice currently in effect. Any revised Notice will apply to all protected health information we maintain, regardless of when it was created or received. When we make a material change, we will post the revised Notice, with its new effective date, on our website at palomahealth.com and in the patient portal before the change takes effect, and we will notify you of the change through the portal or by email if you have agreed to receive information by email. You may obtain a copy of the current Notice at any time on our website, in the patient portal, or by contacting the Privacy Official.
E. Complaints
If you believe your privacy rights have been violated, or you have a concern about this Notice of Privacy Practices or how we handle your health information, you may file a complaint with us by contacting our Privacy Official listed at the top of this Notice by email at privacy@palomahealth.com, by phone, or by mail. You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, at any time, whether or not you have first complained to us:
U.S. Department of Health and Human Services
Office for Civil Rights
200 Independence Avenue, S.W.
Room 509F, HHH Building
Washington, D.C. 20201
1-800-368-1019 · www.hhs.gov/ocr/complaints
F. Our duties
We are required by law to maintain the privacy and security of your protected health information, to give you this notice of our legal duties and privacy practices, to notify you if a breach occurs that may have compromised the privacy or security of your information, and to follow the terms of the notice currently in effect.
G. State Law
Where state law gives you greater protection than HIPAA, we follow state law. For example, California's Confidentiality of Medical Information Act restricts use or disclosure of your medical information for marketing without your authorization, and California, Washington, and other states provide additional confidentiality protections for sensitive services such as sexual and reproductive health care. Information about sexual health services you receive from us is disclosed only to the Medical Group, the pharmacy filling your prescription, and the business associates that must handle it to deliver the service.
