Privacy Policy & Notice of Privacy Practices

1. Who this covers

This Notice applies to vaginalestrogencreamonline.com, a telehealth service operated by Midwest Mind & Body Healthcare LLC ("we", "us", "the practice"), a HIPAA-covered health care provider located at 131 N Washington St, Suite A, Papillion, NE 68046.

It covers two different groups of people, and the rules differ for each:

• Visitors to this website. Section 2 and Section 7 apply to you. This website does not collect health information from anyone.
• Patients. If you complete an intake and a clinician reviews it, Sections 3 through 5 apply to you. Your information becomes protected health information (PHI) under HIPAA.

2. This website collects no health information

We want to be exact about this, because it is unusual and it is the single most important privacy fact about this site.

There is no form on this website. There is no field for your name, date of birth, address, phone number, email address, pharmacy, symptoms, or medical history. Nothing you could type is transmitted to us, because there is nothing to type.

The only thing this website asks for is which state you are located in, selected from a dropdown menu, so we can tell you whether we are licensed where you live. A U.S. state is not protected health information. That selection is evaluated entirely inside your own browser and is never transmitted to us or to anyone else. Closing the page discards it.

When you select an eligible state, we show you a link to our secure intake form. That form is hosted by Hushmail, a HIPAA-compliant platform operating under a signed Business Associate Agreement, and it opens in a new browser tab. Every piece of health information you provide goes directly to Hushmail and then to the practice. It never touches this website.

3. HIPAA Notice of Privacy Practices

PHI is information we collect or create about you that identifies you and that relates to your past, present, or future physical or mental health, the health care we provide to you, or the payment for your health care.

Your PHI includes the information you submit through our secure intake form hosted by Hushmail, information we receive from pharmacies or other health care providers, and information we generate when a licensed provider reviews your intake and, if appropriate, issues a prescription.

Information you submit through our secure intake form before a clinical relationship exists is not technically "PHI" under HIPAA until a provider reviews it and a treatment relationship begins. We treat it with equivalent confidentiality from the moment it is submitted.

4. How we use and disclose PHI

4.1 Without your written authorization

We may use and disclose your PHI for the following purposes without asking your permission first:

• Treatment. To evaluate your intake, decide whether a prescription is appropriate, transmit that prescription to the pharmacy you choose, and coordinate with other clinicians involved in your care.
• Payment. To charge the $50 clinical fee and to maintain billing records. Note that we do not bill insurance for the clinical fee; your pharmacy handles any insurance claim for the medication itself.
• Health care operations. Quality review, clinical training, licensure and credentialing, audits, and general practice administration.
• Required by law. When federal, state, or local law compels disclosure, including reporting to public health authorities, responding to court orders or subpoenas, health oversight activities, and reporting suspected abuse or neglect.
• To avert a serious threat. When disclosure is necessary to prevent a serious and imminent threat to your health or safety or that of another person.

4.2 Only with your written authorization

We will obtain your written authorization before using or disclosing your PHI for any of the following, and you may revoke that authorization in writing at any time:

• Marketing communications.
• Any sale of your PHI. We do not sell your health information under any circumstances.
• Most uses and disclosures of psychotherapy notes, if any exist.
• Any purpose not described in this Notice.

4.3 Reproductive health care privacy

Consistent with the HIPAA Privacy Rule as amended to support reproductive health care privacy, we will not use or disclose your PHI to investigate or impose liability on any person for the mere act of seeking, obtaining, providing, or facilitating lawful reproductive health care. Where required, we will obtain a signed attestation before disclosing PHI potentially related to reproductive health care in response to certain requests.

5. Your rights over your health information

You have the following rights. To exercise any of them, contact our Privacy Officer using the details in Section 10.

• Access and copies. You may inspect and obtain a copy of your records, generally within 30 days. We may charge a reasonable, cost-based fee for copies.
• Electronic copies. You may request your records in an electronic format we can readily produce, and ask us to send them to a person or entity you designate.
• Amendment. You may ask us to correct information you believe is inaccurate or incomplete. We may deny the request, and if we do, you may submit a statement of disagreement that becomes part of your record.
• Accounting of disclosures. You may request a list of certain disclosures we made in the six years before your request, excluding disclosures for treatment, payment, and operations.
• Restrictions. You may ask us to restrict certain uses or disclosures. We are not required to agree, except that we must agree to withhold information from a health plan when you have paid for that item or service in full out of pocket.
• Confidential communications. You may ask us to contact you at a particular address or by a particular method. We will accommodate reasonable requests and will not ask you why.
• Paper copy. You may request a paper copy of this Notice at any time, even if you agreed to receive it electronically.
• Breach notification. We will notify you if a breach occurs that compromises the privacy or security of your PHI.
• Choose someone to act for you. A personal representative with legal authority may exercise these rights on your behalf.

6. Third-party service providers

We rely on a small number of vendors. Each is bound either by a HIPAA Business Associate Agreement (for vendors that handle PHI) or by appropriate data-processing terms (for vendors that only process website data).

We do not authorize any of these providers to use information we share with them for their own marketing purposes.

7. Website data and cookies

This website sets no cookies. It runs no analytics, no advertising pixels, no session recording, no heatmaps, no A/B testing, and no third-party trackers of any kind. We do not know who you are when you browse this site, and we have not built any way to find out.

Two things do happen automatically and are worth naming:

• Server logs. Our website host records standard request data — IP address, timestamp, page requested, browser user-agent — as every web server does. These logs are used for security and reliability, not to profile you.
• Font loading. The site loads two typefaces from Google Fonts, which sends your IP address to Google. This is the only external asset this site requests. If you prefer to avoid it, a content blocker will stop it and the site will still work with a system font.

Because we set no cookies and run no tracking, there is no cookie banner and no consent to manage. Your browser's "Global Privacy Control" and "Do Not Track" signals require nothing of us here, because there is no tracking to opt out of.

8. State privacy rights

We provide services to patients in Nebraska, Iowa, Colorado, Illinois, Kansas, Arizona, Utah, Idaho, Montana, South Dakota, North Dakota, Kentucky, Vermont, New Hampshire, Maine, and New Mexico. Several of these states have consumer data privacy acts granting rights to access, correct, delete, and port personal data, and to opt out of targeted advertising, profiling, and the sale of personal data.

For any non-PHI personal data we hold, we voluntarily honor the core rights of access, correction, deletion, and portability for residents of every state we serve, regardless of whether that state's law technically applies to a practice of our size. We do not sell personal data, we do not use it for targeted advertising, and we do not engage in profiling that produces legal or similarly significant effects.

To make a request, contact our Privacy Officer using the details in Section 10. We will verify your identity before acting and will respond within the timeframe your state's law requires, or within 45 days if no timeframe applies. If we deny your request, you may appeal by replying to our response.

9. Security and retention

We maintain administrative, physical, and technical safeguards appropriate to the size of our practice, including encrypted transmission of intake data, access controls limiting PHI to personnel who need it, and business associate agreements with vendors that handle PHI.

We retain clinical records for the period required by the law of the state in which you received care, which is generally between five and ten years after the last date of service, and longer for patients who were minors at the time of treatment. When records reach the end of their retention period, we destroy them securely.

No method of transmission or storage is perfectly secure. We cannot guarantee absolute security, and you should not send health information to us by ordinary email.

10. Complaints and contact

If you have a question about this Notice, want to exercise a right described above, or believe your privacy rights have been violated, contact us:

Privacy Officer
Midwest Mind & Body Healthcare LLC
131 N Washington St, Suite A
Papillion, NE 68046
Phone: 531-217-5257
Email: Info@midwestmindandbodyhealthcare.com (please do not include health information)

You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights:

• Online: OCR Complaint Portal
• Mail: 200 Independence Avenue SW, Room 509F, HHH Building, Washington, DC 20201
• Phone: 1-800-368-1019 (TDD: 1-800-537-7697)

We will not retaliate against you for filing a complaint.

Changes to this Notice

We may change the terms of this Notice and make the new provisions effective for all PHI we maintain. If we make a material change, we will post the revised Notice on this website and update the effective date above. You may request a paper copy of the current Notice at any time.