Notice of Privacy Practices

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

Who this notice covers

When a licensed clinician provides care to you through Gini Care, the clinician (and the medical practice through which they are engaged) is a health care provider under HIPAA, and Gini Health acts as the technology platform supporting that care. The information created in that care — your intake, messages with the clinician, clinical notes, lab recommendations and prescription records — is protected health information (PHI). Gini Health, the clinician and the practice follow this notice for PHI, and Gini Health signs business associate agreements with any vendor that handles PHI for us (hosting, database, email delivery, and the AI model provider).

Information you bring to Gini yourself, from your wearables, or from your health records is not PHI in Gini’s hands merely because it came from a doctor or a plan. It is protected by the rest of our Privacy Policy and by state consumer health data laws, and by this notice only once a clinician uses it in your care.

How we may use and disclose PHI

• Treatment. To provide care to you, and to coordinate with other clinicians you ask us to involve (for example, sending a summary to your primary care physician at your request).
• Payment. To bill you for clinician visits. Gini Care does not currently bill insurers.
• Health care operations. Quality review, clinician supervision, training, and running the service. We apply the minimum necessary standard: staff see only what they need. Console operators who are not clinicians see queue counts and status, never names or transcripts.
• Required by law, public health reporting, abuse or neglect reporting, health oversight, court orders, law enforcement within HIPAA’s limits, to avert a serious threat to health or safety, and other disclosures HIPAA permits without authorisation.
• Business associates, under written agreements that require them to protect PHI and use it only for the work we contract.

Uses that need your written authorisation: marketing, sale of PHI (which we do not do), sharing psychotherapy notes, and any other use not described here. You may revoke an authorisation in writing at any time, except to the extent we already relied on it.

AI in Gini Care. The AI assistant drafts informational replies grounded in the data you allow it to see, using a third-party model provider under a business associate agreement. The provider may not train on your data or use it for anything but returning a reply to Gini. Clinicians may review AI conversations when you ask for a clinician. AI replies are informational and are not a diagnosis; a clinician’s reply is medical advice from that clinician.

Your rights over PHI

• Access and copies. Inspect or get a copy of your record, including an electronic copy. Your account’s data export includes your Gini Care record. We respond within 30 days.
• Amend. Ask us to correct your record; we may decline in limited cases and will explain why in writing.
• Accounting of disclosures. A list of disclosures we made other than for treatment, payment, operations, or with your authorisation, for the prior six years.
• Restrictions. Ask us to limit uses or disclosures; we are not always required to agree, but we must agree not to tell your health plan about a service you paid for in full out of pocket.
• Confidential communications. Ask to be contacted in a specific way or place.
• Paper copy of this notice, on request.
• Breach notification. We will tell you if a breach compromises the privacy or security of your PHI.

Telehealth consent

Gini Care clinician services are delivered by asynchronous messaging (telehealth). Before your first clinician conversation you will be asked to read and accept a separate Telehealth Informed Consent covering how messaging care works, its limits and risks, your responsibility to keep a primary care relationship, payment, lab partners, communications, how to complain, and any state-specific medical board notices. Clinicians hold a licence in the state you tell us you are in at the time of care; if none of our clinicians is licensed there, you keep the AI assistant and we tell you so.

Our duties and changes

We are required by law to keep PHI private, give you this notice, and follow the notice currently in effect. We may change it; the new notice will apply to PHI we already hold and will be posted at gini.health/privacy-practices with a new effective date.

Questions and complaints

Privacy Officer, Gini Health — privacy@gini.health. You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights (200 Independence Avenue SW, Washington, DC 20201; 1-877-696-6775; hhs.gov/ocr/complaints). We will not retaliate against you for filing a complaint.

This notice is part of Gini’s Privacy Policy, where it also appears as a section.