HIPAA Notice of Privacy Practices

DRAFT — FOR ATTORNEY REVIEW. This notice is a placeholder prepared for the Ann Arbor Appeals prototype and has not been reviewed by counsel.

THIS NOTICE DESCRIBES HOW HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Who we are

Ann Arbor Appeals ("we," "us") provides a platform that helps you prepare, submit, and track appeals of health insurance coverage decisions. To do that work, you share health information with us — including medical records, denial letters, explanations of benefits, and information you provide to our AI companion, Alvin.

Our duties

• We are required by law to maintain the privacy and security of your protected health information ("PHI").
• We will let you know promptly if a breach occurs that may have compromised the privacy or security of your information.
• We must follow the duties and privacy practices described in this notice and give you a copy of it.
• We will not use or share your information other than as described here unless you tell us we can in writing. If you tell us we can, you may change your mind at any time by telling us in writing.

How we use and disclose your information

• To pursue your appeal: we use your documents and the information you provide to prepare appeal letters and supporting materials, and — only with your signed authorization — share them with your insurer, your providers, or a patient advocate you designate.
• To operate the service: we use your information to maintain your account, secure the platform, audit access, and improve the reliability of the service.
• AI processing: with your consent, our AI companion Alvin reads your uploaded documents and chat history to understand your situation and help draft your appeal. AI processing happens under the same access controls and audit logging as the rest of the platform.
• As required by law: we will disclose information when valid legal process compels us to, and only to the minimum extent required.
• We never sell your information. We never use your information for marketing without separate written authorization.

Your rights

• Get a copy of your records: you can ask to see or receive an electronic or paper copy of the information we hold about you. We will provide it, usually within 30 days.
• Get a copy of every legal document you agreed to: every version of this notice and our Terms of Service that you consented to is preserved and available for download from your account, in perpetuity, even after later versions are published.
• Ask us to correct information you believe is incorrect or incomplete.
• Request restrictions on what we use or share. We will consider all reasonable requests.
• Request confidential communications (for example, only by a specific phone number or email).
• Get a list of those with whom we have shared your information (an accounting of disclosures) for six years prior to your request.
• Revoke an authorization at any time, in writing. Revocation does not affect disclosures already made.
• File a complaint with us or with the U.S. Department of Health and Human Services Office for Civil Rights. We will not retaliate against you for filing a complaint.

How we protect your information

• Encryption in transit and at rest, multi-factor authentication, and automatic session timeouts.
• Every access to your documents and appeal records is logged and auditable.
• Uploaded files are scanned for malware before they become available.
• Staff and systems access your information only to the minimum extent necessary.

Changes to this notice

We may change this notice from time to time. Changes apply to information we already hold as well as new information. When we make a material change, we will post the new version, mark it with a new version number and effective date, and ask you to review it. The version you previously agreed to remains available for download from your account.

Contact

Privacy Officer, Ann Arbor Appeals — privacy@annarborappeals.example. If you believe your privacy rights have been violated, you may also contact the HHS Office for Civil Rights.