How We Protect Your Health Information

1. Who is responsible for your health information

Crystal Clear is not your health care provider, and we are not a pharmacy. Your health information is the responsibility of:

• Your treating providers. The licensed clinicians who evaluate you and decide whether to prescribe, and the medical groups they practice through. These include OpenLoop Healthcare Partners, PC and its associated or contracted professional corporations (OpenLoop’s affiliated medical groups), and the other telehealth platforms and partner prescribers we work with, such as the providers on the Qualiphy telehealth platform. They are HIPAA covered entities.
• The pharmacy that dispenses your medication. The licensed pharmacy that fills your prescription and ships it to you keeps its own prescription records. A pharmacy that bills health insurance is a HIPAA covered entity and gives you its own Notice of Privacy Practices.

Your provider’s Notice of Privacy Practices governs your health record and explains your rights under HIPAA. This page is not a Notice of Privacy Practices. If you cannot find the notice or privacy information for your provider or your pharmacy, contact us (Section 9) and we will help you get it.

2. Our role: business associate

We handle your health information as a business associate of your treating providers, and of any other covered entity we work for, under written business associate agreements. For example, our agreement with OpenLoop names Crystal Clear RX, LLC as OpenLoop’s business associate. We may use and disclose your health information only to provide our services to them and to you, as those agreements and HIPAA allow, and HIPAA requires us to safeguard it. We use it to:

• Run your membership and account. Signup, intake questionnaires, orders, refills, shipping updates, and customer support.
• Coordinate your care. We send your intake to your treating provider through the telehealth platform, and we send your order and shipping details to the pharmacy so it can dispense your medication to you.
• Bill for the Services. We share the minimum payment information our payment processor, PayMatrix, needs to charge your card.
• Run our operations. Quality checks, staff training, vendor management, and audits of which staff members viewed your record.
• Meet legal requirements. When the law requires it, for example in response to a court order or a lawful request from a government authority.

We do not sell your health information. We do not use it for marketing without your written authorization.

3. Who helps us, and our affiliated companies

• Avellum Health Co LLC. Our shared-services company, an affiliated company under common ownership, hosts our systems and protects your health information as our subcontractor business associate under a written agreement. It holds our agreements with the hosting, database, email, phone, and AI vendors that handle data for us, including their business associate agreements. It has no clinical or pharmacy role.
• Our vendors. The vendors we use to store or transmit your health information, such as our hosting, database, encrypted email, phone, and AI providers, do so under written business associate agreements, held by us or by Avellum Health Co LLC.
• Valdura Health, LLC. If your membership includes the Valdura app, we share your name, email address, a Crystal Clear account identifier, whether your membership is active, and the partner storefront you joined through (if any) with Valdura Health, LLC, an affiliated company under common ownership, so it can give you access to the app. Valdura handles that information for us under a written agreement that binds it to the same protections as Avellum Health Co LLC. What you enter in the Valdura app itself is covered by Valdura’s own privacy policy.

4. How we protect it

We use administrative, technical, and physical safeguards, including encryption, access controls, a record of which staff members viewed your information, and privacy and security training for everyone who can reach it. No method of storage or transmission is completely secure, and we cannot guarantee absolute security.

5. Your rights, and how to use them

Your rights under HIPAA are set out in your provider’s Notice of Privacy Practices, and in your pharmacy’s if it is a covered entity. They include the right to see and get a copy of your health information, to ask for a correction, to get a list of certain disclosures, to ask for limits on how it is used or shared, to ask to be contacted in a particular way, and to get a paper copy of the notice.

You can send any of these requests to us as well. Email us at sales@ccrxpharm.com with the subject “HIPAA Rights Request,” file it from the privacy requests page in your account, or contact our Privacy Officer (Section 9). We act on it as our agreements with your providers and your pharmacy require. That may mean handling it ourselves for the records we hold, or passing it to the provider or pharmacy that holds the rest and helping it respond. To prevent misuse, we may need to verify your identity first. Authorized agents acting for someone else must provide written proof of authority.

Sharing with someone you choose. To have us send your health information to someone else, such as a family member, another provider, or an attorney, email us at sales@ccrxpharm.com with the subject “HIPAA Authorization,” and we will send you a form. You can revoke an authorization at any time by writing to the same address. A revocation does not undo a disclosure already made in reliance on the authorization.

6. If a breach happens

If your unsecured health information is involved in a breach at Crystal Clear or at Avellum Health Co LLC, we report it to the covered entity as our agreements and HIPAA require. You will be notified as the law requires, without unreasonable delay and no later than 60 calendar days after the breach is discovered.

7. Filing a complaint

If you believe your privacy rights have been violated, you may file a complaint with us by contacting our Privacy Officer (Section 9), or with your provider or your pharmacy. You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1-877-696-6775, or visiting hhs.gov/ocr/privacy/hipaa/complaints. We will not retaliate against you for filing a complaint.

8. Changes to this page

We may update this page. When we do, we will post the new version here and update the “Last updated” date at the top. You may also request a paper copy from the contact in Section 9.

9. Contact us

Questions, requests, and complaints about your health information go to our Privacy Officer: