Nevada Supplemental Privacy Notice
This Nevada Supplemental Privacy Notice supplements the Thymos Health Privacy Policy and provides additional transparency concerning health-related information involving Nevada consumers.
1. Application of Nevada's Consumer Health Data Law
Nevada law includes consumer health data requirements in NRS Chapter 603A.
Those consumer health data provisions contain an exemption for persons and entities that are subject to the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations.
Thymos Provider Group, PC is a healthcare provider subject to HIPAA.
Thymos Health, Inc. provides management, technology, administrative, and operational services to Thymos Provider Group and performs HIPAA-regulated Business Associate functions under a written Business Associate Agreement.
Accordingly, the Nevada consumer health data provisions may not apply to Thymos in the same manner they apply to a non-HIPAA consumer health application.
This Supplemental Notice is provided voluntarily for transparency and should not be interpreted as a concession that a particular Nevada consumer health data requirement applies to information or entities that are legally exempt.
2. Health-Related Information Thymos May Collect
Depending on how you interact with Thymos, information may include:
- health conditions, diseases, diagnoses, and symptoms;
- medical history and healthcare records;
- medications and prescriptions;
- laboratory, biomarker, and diagnostic information;
- imaging and pathology;
- bodily functions, vital signs, and health measurements;
- mental and behavioral health information;
- reproductive or sexual health information;
- genetic information;
- nutrition, sleep, activity, and environmental health information;
- healthcare services requested or received;
- healthcare-seeking activity;
- information derived or inferred from health-related information; and
- information identifying that an individual sought or received healthcare.
Where this information constitutes PHI, it is governed by HIPAA and the Thymos Provider Group Notice of Privacy Practices.
3. Sources
Health-related information may come from:
- you;
- Thymos clinicians and care-team members;
- healthcare providers from whom you authorize Thymos to request records;
- laboratories, pharmacies, and other healthcare organizations involved in requested care;
- service providers acting on behalf of Thymos; and
- information generated in connection with your use of Thymos Services.
4. How We Use Health-Related Information
Thymos may process health-related information to:
- provide healthcare;
- evaluate symptoms and medical history;
- create and maintain medical records;
- provide telehealth services;
- coordinate care;
- facilitate prescriptions, laboratories, imaging, and referrals;
- support clinical documentation;
- communicate securely with patients;
- administer accounts and payments;
- conduct quality assurance;
- evaluate clinician performance;
- maintain security;
- improve Thymos technology;
- develop and validate Thymos algorithms using appropriately de-identified information where applicable;
- perform research using appropriately aggregated or de-identified information; and
- comply with legal and regulatory requirements.
5. Sharing
Where permitted by applicable law, health-related information may be disclosed to:
- healthcare professionals;
- laboratories;
- pharmacies;
- imaging providers;
- other healthcare organizations involved in requested care;
- electronic health record and healthcare technology providers;
- telehealth and documentation service providers;
- cloud, security, authentication, and infrastructure providers;
- payment processors;
- health plans where appropriate;
- entities acting at your direction; and
- governmental, regulatory, or legal recipients where legally permitted or required.
Service providers handling PHI enter into Business Associate Agreements where HIPAA requires them.
6. Advertising and Sale
Thymos does not sell PHI or Consumer Health Data.
Thymos does not upload patient lists or health-derived prospect lists to advertising platforms for:
- Customer Match;
- Custom Audiences;
- lookalike audiences;
- retargeting; or
- similar audience-building.
Thymos does not use identifiable health information for third-party targeted advertising.
Thymos does not send advertising platforms conversion events reflecting disease-specific webpage activity, Autoimmune Guide activity, commencement of clinical intake, or similar health-derived behavior.
7. Cross-Site Collection
Thymos does not authorize third parties to collect health information over time and across unrelated websites or online services for purposes of creating health-based advertising profiles when consumers use authenticated or clinical portions of Thymos Services.
Public-facing website analytics may operate as described in the main Thymos Health Privacy Policy and subject to applicable consent and opt-out mechanisms.
8. Global Privacy Control
Thymos recognizes applicable browser-based opt-out preference signals, including Global Privacy Control, where required by applicable law.
9. Access, Correction, and Deletion
Regardless of whether Nevada's consumer health data provisions apply to a particular request, Thymos provides mechanisms through which patients and consumers may ask about information associated with them.
You may contact:
privacy@thymoshealth.com
(415) 379-0745
PHI and medical-record requests are handled pursuant to HIPAA, applicable state healthcare law, and the Thymos Provider Group Notice of Privacy Practices.
Patients may initiate deletion of their Thymos user account through the mobile application. Account deletion does not require destruction of medical records or other information Thymos is legally required or permitted to retain.
If a Nevada privacy law applies to particular information notwithstanding an applicable exemption, Thymos will honor the rights and response procedures required by that law.
10. Security
Thymos maintains administrative, technical, and physical safeguards designed to protect health-related information.
Access is limited according to role and legitimate operational need.
Service providers are subject to contractual security, confidentiality, and data-use requirements appropriate to the information processed.
11. Changes
Thymos may update this Supplemental Notice as its Services, privacy practices, or legal requirements change.
Where a legally applicable requirement mandates additional notice or consent before a material change involving covered health information, Thymos will provide that notice or obtain that consent as required.
12. Contact
Thymos Health Privacy Office
Thymos Health, Inc.
Thymos Provider Group, PC
Attn: Nilesh Bhandari, COO and Privacy/Security Officer
679 S. Eliseo Dr.
Greenbrae, CA 94904
Phone: (415) 379-0745
Email: privacy@thymoshealth.com
See also our Privacy Policy.