Privacy Policy & Notice of Privacy Practices

1. Introduction

Evergreen Telehealth ("we," "our," or "us") is committed to protecting your privacy and ensuring the security of your personal and health information. This Privacy Policy and Notice of Privacy Practices ("Policy") explains how we collect, use, share, and safeguard your information in accordance with:

• The Health Insurance Portability and Accountability Act of 1996 (HIPAA)
• Federal and state telehealth privacy laws
• Consumer privacy laws (including CCPA for California residents)
• Advertising platform requirements from Google, Meta, and others

This Policy applies to your use of our website, online services, health assessments, scheduling systems, and any telehealth consultations conducted through Evergreen Telehealth.

By using our services, you consent to the data practices described herein.

2. Who We Are

Evergreen Telehealth is operated by ConsultRX LLC, based in Kennesaw, Georgia. We provide telehealth and wellness consultation services and contract with Xpedicare LLC, which provides licensed healthcare providers across the U.S.

Protected Health Information (PHI)

Protected Health Information (PHI) may be shared between Evergreen Telehealth and Xpedicare LLC under a HIPAA-compliant Business Associate Agreement (BAA) for purposes of care coordination, diagnosis, treatment, and related healthcare operations.

3. Information We Collect

We collect the following categories of information:

A. Personal and Contact Information

• Name, address, phone number, email address, and demographic information.

B. Health and Medical Information (Protected Health Information)

• Information you submit through health assessments, forms, and telehealth consultations, including symptoms, history, medications, and medical documents.
• All PHI is handled in compliance with HIPAA.

C. Technical and Usage Information

• IP address, device type, browser version, operating system, and activity on our site.
• Data from cookies, pixels, and analytics technologies (Google Analytics, Google Tag Manager, Meta Pixel, etc.).

D. Communication Preferences

• Information about how you engage with our emails and marketing communications.

4. How We Use Your Information

Your information is used to:

1. Deliver telehealth and consultation services.
2. Coordinate care with Xpedicare LLC and its licensed providers.
3. Communicate with you about appointments, results, and updates.
4. Improve website performance and user experience.
5. Conduct marketing and outreach (with consent).
6. Comply with legal and regulatory obligations.

We do not sell or share your data with third parties for advertising or profit.

5. HIPAA Notice of Privacy Practices

This section explains how your Protected Health Information (PHI) may be used and disclosed, and how you can access your information.

A. Your Health Information Rights

You have the right to:

• Access your medical records.
• Request corrections of inaccurate or incomplete PHI.
• Request restrictions on uses or disclosures.
• Receive an accounting of certain disclosures.
• Request confidential communications by alternative means.
• File a complaint if you believe your privacy rights have been violated.

Requests may be submitted to connect@evergreentelehealth.com.

B. How We May Use and Disclose PHI

We may use and disclose PHI for:

• Treatment — to coordinate care with healthcare providers (including Xpedicare LLC).
• Payment — to process billing or insurance claims, if applicable.
• Healthcare Operations — to improve quality, train staff, or manage operations.
• Legal Requirements — if required by law or public health authorities.
• Business Associates — under HIPAA-compliant agreements ensuring privacy and security.

We will not use your PHI for marketing or sell your information without explicit written authorization.

Our Duties

• We are required by law to maintain the privacy and security of PHI.
• We will notify you if a breach compromises the privacy or security of your information.
• We will only use or disclose PHI as described in this Notice.

6. Cookie Policy

We use cookies, pixels, and similar technologies to enhance your browsing experience and optimize our marketing efforts.

A. What Cookies We Use

• Essential Cookies – Necessary for core site functionality (e.g., scheduling, secure logins).
• Analytics Cookies – Track website usage (Google Analytics, Google Tag Manager).
• Advertising Cookies – Used by Google Ads and Meta (Facebook/Instagram) to deliver relevant ads.
• Email Marketing Cookies – Measure engagement with newsletters or automated emails.

B. How We Use Cookies

Cookies help us:

• Analyze website traffic and improve functionality.
• Deliver and measure ads based on user preferences.
• Personalize the user experience and remember settings.

C. Managing Your Cookie Preferences

You can manage or delete cookies through your browser settings or opt out of personalized advertising via:

• Google Ad Settings
• Meta Ad Preferences

You may also disable cookies entirely, though some features of the site may not function properly.

7. Data Security and Retention

• All PHI is encrypted in transit and at rest.
• Access is restricted to authorized personnel and providers.
• We retain data only as long as required for medical and legal purposes.
• Regular audits and monitoring help prevent unauthorized access or breaches.

If a data breach occurs, affected users will be notified in compliance with HIPAA and state law.

8. Third-Party Service Providers

We use third-party services for:

• Website hosting, analytics, and email marketing.
• Appointment scheduling and telehealth video conferencing.

Each provider is contractually bound to protect data and maintain confidentiality in compliance with HIPAA or equivalent data protection standards.

9. Marketing and Communications

With your consent, we may send promotional or informational messages about our services. You can opt out anytime by clicking "unsubscribe" in an email or emailing connect@evergreentelehealth.com.

10. Children's Privacy

Our services are not intended for individuals under 18 years of age. We do not knowingly collect or maintain information from minors without parental consent.

11. Your Rights Under State or Geographic Law

If you reside in certain states (such as California, Virginia, or Colorado), you may have additional rights under state privacy laws, including the right to know, delete, or restrict certain personal data uses. Contact connect@evergreentelehealth.com to exercise these rights.

Additional Rights Regarding Analytics and Tracking:

• Regardless of your location, you have the right to:
  • Know what data is being collected through analytics
  • Access your consent history and see what you've agreed to
  • Withdraw consent at any time without penalty
  • Request deletion of analytics data associated with your sessions
  • Opt out of cross-site tracking through our cookie settings
  • Receive annual reminders to review your privacy preferences
• For California Residents (CCPA/CPRA):
  • Right to know what personal information is collected and how it's used
  • Right to delete personal information (subject to legal exceptions)
  • Right to opt-out of the sale or sharing of personal information (we do not sell your data)
  • Right to non-discrimination for exercising your privacy rights
• For EU Residents (GDPR):
  • Right to access your personal data
  • Right to rectification of inaccurate data
  • Right to erasure ("right to be forgotten")
  • Right to restrict processing
  • Right to data portability
  • Right to object to processing
  • Right to withdraw consent at any time

12. Changes to This Policy

We may update this Policy from time to time to reflect operational or legal changes. Updates will be posted on this page with a new "Effective Date."

13. Compliance & Audit Trail

To ensure ongoing privacy protection and regulatory compliance:

• Consent Audit Logs: All consent actions (granted, withdrawn, modified) are logged with timestamps for compliance verification
• Regular Privacy Audits: We conduct quarterly reviews of our privacy practices and analytics configurations
• Third-Party Validation: Our Google Tag Manager and analytics setup is configured to meet HIPAA, GDPR, and CCPA requirements
• Breach Notification: In the unlikely event of a data breach, we will notify affected individuals within 72 hours as required by law
• Compliance Documentation: We maintain documentation of all consent mechanisms, data flows, and security measures

14. Contact Information

For questions, privacy concerns, or to exercise your rights, contact:

15. Acknowledgment

By using our website or telehealth services, you acknowledge that you have read, understood, and agree to this Privacy Policy & Notice of Privacy Practices.