Notice of Privacy Practices
Your Information. Your Rights. Our Responsibilities.
This Notice describes how medical information about you may be used and disclosed, how you can get access to this information, and your rights regarding your health information. Please review it carefully.
This Notice applies to healthcare services provided by Thymos Provider Group, PC ("Thymos Provider Group," "we," "us," or "our").
Thymos Health, Inc. provides technology, administrative, management, and operational services to Thymos Provider Group and may access Protected Health Information ("PHI") on behalf of Thymos Provider Group as its Business Associate under a written Business Associate Agreement.
Our official medical records are maintained electronically through our electronic health record system and related HIPAA-compliant healthcare infrastructure.
Contact Information
If you have questions about this Notice, want to exercise a privacy right, or believe your privacy rights have been violated, contact:
Thymos Provider Group Privacy Office
Attn: Nilesh Bhandari, COO and Privacy/Security Officer
679 S. Eliseo Dr.
Greenbrae, CA 94904
Phone: (415) 379-0745
Email: privacy@thymoshealth.com
Your Rights
When it comes to your health information, you have certain rights. We are responsible for helping you exercise them.
Get a Copy of Your Medical Record
You may ask to inspect or obtain an electronic or paper copy of your medical record and other health information that we maintain about you and to which you have a legal right of access.
We will provide access within the period required by applicable law. Under HIPAA, this is generally within 30 days of receiving your request.
We may charge a reasonable, cost-based fee where permitted by law.
State law may give you additional or faster access rights, and we will follow applicable state law where it provides greater rights.
Ask Us to Correct or Amend Your Medical Record
You may ask us to amend health information that you believe is incorrect or incomplete.
We may deny a request in circumstances permitted by law, including where we did not create the information or determine that the existing information is accurate and complete.
If we deny your request, we will explain the reason in writing and describe applicable rights to submit a statement of disagreement or other response.
Request Confidential Communications
You may ask us to communicate with you about health matters in a particular way or at a particular location. For example, you may ask that we use a particular telephone number or mailing address.
We will accommodate reasonable requests as required by law.
Ask Us to Restrict Certain Uses or Disclosures
You may ask us not to use or disclose certain health information for treatment, payment, or healthcare operations. We are generally not required to agree to every requested restriction.
If you pay for a healthcare service or item completely out of pocket, you may ask us not to disclose information about that service or item to your health plan for payment or healthcare operations. We will honor that request unless disclosure is otherwise required by law.
If we agree to another restriction, we will comply with it except where disclosure is necessary for emergency treatment or otherwise permitted by applicable law.
Get an Accounting of Certain Disclosures
You may ask for an accounting of certain disclosures of your health information made during the six years before your request.
The accounting generally will not include disclosures for treatment, payment, or healthcare operations or other disclosures that HIPAA excludes from the accounting requirement.
We will provide one accounting during any 12-month period without charge. We may charge a reasonable, cost-based fee for additional accountings requested during the same period after notifying you of the fee.
Additional accounting rights may apply to certain records protected by 42 CFR Part 2 as federal requirements evolve.
Get a Copy of This Notice
You may request a paper or electronic copy of this Notice at any time, even if you previously agreed to receive it electronically.
Have a Personal Representative Act for You
If another person has legal authority to act on your behalf, such as under a valid healthcare power of attorney or other legally recognized authority, that person may exercise applicable privacy rights for you.
Thymos does not currently offer routine caregiver or proxy access to patient accounts. This does not limit the rights of a legally authorized personal representative under applicable law.
We will verify the person's authority before allowing that person to act on your behalf.
Revoke an Authorization
If you give us written authorization to use or disclose your information for a purpose requiring authorization, you may revoke that authorization in writing at any time. Revocation will not affect actions we already took in reliance on your authorization.
File a Complaint
You may complain to us if you believe your privacy rights have been violated by contacting the Thymos Provider Group Privacy Office using the information above.
You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights.
We will not retaliate against you for exercising your privacy rights or filing a complaint.
Your Choices
For certain uses and disclosures, you may tell us your preferences.
Family Members, Friends, and Others Involved in Your Care
At your direction, or where otherwise permitted by law, we may share relevant information with a family member, close friend, caregiver, or other person involved in your care or payment for your care.
Thymos patient accounts are currently designed for use only by the individual patient. We do not provide routine proxy or caregiver account access. You may nevertheless authorize us to disclose information to another person as permitted by law.
If you are unable to tell us your preference, such as during an emergency, we may disclose information where permitted by law and where we determine disclosure is in your best interests or necessary to prevent or lessen a serious threat to health or safety.
Marketing
Thymos does not use or disclose your PHI for marketing where HIPAA requires your written authorization unless you have provided that authorization.
We do not provide patient lists to advertising platforms to create Customer Match, Custom Audience, lookalike, or retargeting audiences.
Sale of PHI
Thymos does not sell your PHI. If an activity were ever to constitute a sale of PHI under HIPAA, we would obtain any authorization required by law before engaging in it.
Psychotherapy Notes
If we maintain psychotherapy notes as that term is defined by HIPAA, most uses or disclosures of those notes require your written authorization except where otherwise permitted by law.
Fundraising
Thymos does not currently use PHI for fundraising. If this practice changes, you will be provided any notice and opt-out rights required by law.
We will not use records subject to 42 CFR Part 2 for fundraising except as specifically permitted by Part 2 and with any required notice, consent, or choice.
How We Typically Use and Disclose Your Health Information
Treatment
We may use and disclose your health information to provide, coordinate, and manage your healthcare.
For example, we may share relevant information with another physician, specialist, laboratory, imaging provider, pharmacy, or other healthcare professional involved in your care.
When you ask Thymos to retrieve records from another healthcare provider, we may obtain and incorporate those records into your Thymos medical record.
Healthcare Operations
We may use and disclose your health information to operate our medical practice, improve quality, train and evaluate healthcare professionals and authorized workforce members, conduct audits, manage our services, maintain security, and perform other activities permitted by HIPAA.
We may disclose PHI to our Business Associates that provide services on our behalf, including Thymos Health, Inc. and healthcare technology, electronic health record, hosting, telehealth, security, documentation, and other service providers.
Business Associates that receive PHI are required to protect the information under written agreements where HIPAA requires them.
Payment
We may use and disclose health information as necessary to obtain payment or administer healthcare-related financial matters.
For example, if insurance reimbursement or health-plan payment is involved, information may be used or disclosed as permitted by law to support that process.
Patients currently pay Thymos membership fees directly. Thymos's payment processor handles payment-card information. Thymos does not receive full payment-card numbers.
Communications About Your Care
We may contact you concerning appointments, intake requirements, account administration, treatment-related matters, prescription or laboratory coordination, payment, security, or other matters related to providing healthcare.
Clinical communications between patients and clinicians are provided through secure clinical systems rather than ordinary SMS or email.
Telehealth Recording and AI-Assisted Documentation
With your affirmative consent, Thymos may record audio from a telehealth visit to assist with clinical documentation, quality assurance, audit, clinician-performance evaluation, and internal validation. Video is not recorded.
You receive notice of recording and are asked to consent during onboarding and again before each recorded visit. You may decline audio recording and still receive the telehealth visit.
Audio may be securely processed by a Business Associate to generate a temporary transcript and AI-assisted draft summary to help your clinician prepare documentation. The clinician remains responsible for reviewing, editing, and approving the final medical note. The signed clinician-authored or clinician-approved note is the permanent clinical documentation produced through this workflow.
Raw visit audio, temporary transcripts, and AI-generated draft summaries are retained by Thymos for approximately 90 days for defined quality-control, documentation-quality, audit, and validation purposes and are then automatically deleted, unless retention is required by law or a valid legal hold.
After the clinician signs the final visit note, Thymos does not use these temporary recordings or AI artifacts to make or change decisions about that individual patient's diagnosis, medication, treatment plan, eligibility for care, or other clinical management.
Access to temporary recordings and related documentation is limited to authorized personnel with a legitimate role-based need.
Thymos does not permit identifiable patient recordings to be used to train a third party's general-purpose artificial intelligence model.
Where Thymos uses de-identified information for internal algorithm development or validation beyond ordinary healthcare operations, we seek to use information that has been de-identified in accordance with applicable law.
Other Uses and Disclosures Permitted or Required by Law
We may use or disclose your health information in other circumstances permitted or required by law. Additional legal requirements must be satisfied before many of these disclosures can occur.
Public Health and Safety
We may disclose health information for legally permitted public-health and safety purposes, including:
- preventing or controlling disease;
- reporting adverse events or product problems;
- reporting suspected abuse, neglect, or domestic violence as required or permitted by law;
- preventing or reducing a serious and imminent threat to health or safety; and
- other legally authorized public-health activities.
Health Oversight
We may disclose information to health oversight agencies for activities authorized by law, such as audits, investigations, inspections, licensing matters, and regulatory oversight.
Complying With Law
We will disclose information where federal, state, or other applicable law requires us to do so. This can include disclosures to the U.S. Department of Health and Human Services when necessary to demonstrate compliance with federal privacy requirements.
Judicial and Administrative Proceedings
We may disclose PHI in response to a valid court or administrative order or other lawful process where permitted by HIPAA and applicable state and federal law. Special protections apply to records subject to 42 CFR Part 2, as described below.
Law Enforcement
We may disclose PHI for certain law-enforcement purposes where HIPAA and applicable law permit or require the disclosure. Special protections may apply to sensitive health information, including Part 2 records.
Workers' Compensation and Similar Programs
We may disclose health information as authorized by and necessary to comply with workers' compensation laws and similar programs.
Coroners, Medical Examiners, and Funeral Directors
We may disclose PHI to coroners, medical examiners, or funeral directors where permitted or required by law.
Organ and Tissue Donation
Where applicable, we may disclose health information to organizations involved in organ, eye, or tissue donation or transplantation as permitted by law.
Research
Thymos may conduct or participate in research in the future. Thymos's current policy is not to use identifiable PHI for formal research.
We may use information that has been appropriately de-identified for research and may publish or collaborate with qualified research partners regarding aggregated or de-identified outcomes.
If Thymos's research practices involving identifiable PHI change in the future, identifiable PHI will be used or disclosed only where permitted by applicable law, including through patient authorization or an appropriate Institutional Review Board or Privacy Board process where applicable.
We do not currently license or sell de-identified patient datasets to third parties.
Substance Use Disorder Records — 42 CFR Part 2
Thymos Provider Group is not currently a federally assisted substance use disorder treatment program subject to Part 2 solely by virtue of providing its general medical services.
However, we may receive or maintain substance use disorder patient records from an outside provider or program that are protected by 42 CFR Part 2. When information in our possession remains subject to Part 2, we will handle that information in accordance with Part 2 and other applicable law.
Where a valid Part 2 consent permits use or disclosure for treatment, payment, or healthcare operations, we may use or disclose those records as permitted by applicable federal law.
Part 2 records may not be used or disclosed in a civil, criminal, administrative, or legislative investigation or proceeding against you unless you provide the written consent required by Part 2 or the disclosure is authorized by a court order and subpoena meeting applicable Part 2 requirements.
We will not use Part 2-protected information for fundraising or marketing except where expressly permitted and where any required consent, authorization, or choice has been obtained.
Additional rights regarding accounting for disclosures of Part 2 records will be provided as and when applicable federal requirements become effective.
Information Subject to Greater State or Federal Protection
Some types of health information may receive protections that are more restrictive than ordinary HIPAA requirements. Depending on the jurisdiction and circumstances, this may include information concerning:
- mental or behavioral health;
- psychotherapy;
- substance use disorder;
- HIV or sexually transmitted infections;
- genetic testing or genetic information;
- reproductive or sexual health;
- certain communicable diseases; and
- other specially protected healthcare information.
Where applicable federal or state law provides greater privacy protection than HIPAA, we will follow the more protective law.
Our Responsibilities
We are required by law to maintain the privacy and security of your PHI. We maintain administrative, technical, and physical safeguards designed to protect health information.
We are required to notify affected individuals when a breach of unsecured PHI occurs where notification is required by law.
We must follow the privacy practices described in the version of this Notice currently in effect.
We will not use or disclose your information for a purpose requiring your written authorization unless you provide that authorization. If you give an authorization, you may revoke it as described in this Notice.
We apply appropriate restrictions to Business Associates and other service providers that receive PHI on our behalf.
We seek to limit uses, disclosures, and access to PHI to what is permitted by law and appropriate for the applicable purpose.
Retention of Medical Records
Thymos Provider Group retains medical records for the period required by applicable federal and state laws, professional obligations, payer requirements, and other applicable legal requirements. Because these requirements vary by jurisdiction and circumstances, the applicable retention period may differ among patients.
Deleting your Thymos application account does not require Thymos Provider Group to destroy medical records or other information that we are legally required or permitted to retain.
Temporary telehealth audio recordings, transcripts, and AI-generated draft summaries are subject to the separate temporary retention practices described above and generally are deleted after approximately 90 days.
Changes to This Notice
We may change this Notice and our privacy practices from time to time. Changes may apply to health information we already maintain as well as information we receive or create in the future, as permitted by law.
When we make a material change, the revised Notice will include a new effective date.
The current Notice will be available through the Thymos website, mobile application, upon request, and through other locations or methods required by law.
Questions or Complaints
Thymos Provider Group Privacy Office
Attn: Nilesh Bhandari, COO and Privacy/Security Officer
679 S. Eliseo Dr.
Greenbrae, CA 94904
Phone: (415) 379-0745
Email: privacy@thymoshealth.com
You may also submit a complaint to the U.S. Department of Health and Human Services, Office for Civil Rights, 200 Independence Avenue, S.W., Washington, D.C. 20201, or by calling 1-877-696-6775.
Thymos will not retaliate against you for filing a privacy complaint or exercising a privacy right.
See also our Privacy Policy.