Bliv Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

1. Who this Notice covers

This is a joint Notice of Privacy Practices of Metabody Medical P.A. and its affiliated professional entities listed below (together, the “Medical Groups,” “we,” or “us”), the independent, physician-owned medical practices that provide clinical care to patients through the Bliv platform at joinbliv.com and its subdomains and in the Bliv mobile app. The Medical Groups participate in an organized health care arrangement and have agreed to follow the terms of this single Notice. Each Medical Group may share your protected health information with the others for the treatment, payment, and health care operations of the arrangement. The Medical Groups covered by this Notice, and the states each serves, are:

“Protected health information” or “PHI” is information that identifies you and relates to your past, present, or future physical or mental health, the care you receive, or payment for that care, and that we create or receive in providing your care. We are required by the Health Insurance Portability and Accountability Act (“HIPAA”) to keep your PHI private, to give you this Notice of our legal duties and privacy practices, and to follow the Notice currently in effect.
The Bliv platform. The Medical Groups contract with Metabody Services, LLC to provide the technology, administrative, and support services that make telehealth care possible — including the Bliv website and app, secure messaging, the electronic health record in which your clinical information is stored, scheduling and billing, and the AI Assistant described in §3. Metabody Services, LLC performs these services on our behalf as our business associate under a written agreement that requires it to protect your PHI as HIPAA requires and to use it only to provide services to us. Information that Metabody Services, LLC collects for its own purposes as the operator of the platform — for example, when you browse the Bliv website before becoming a patient, or connect a wearable for Bliv’s wellness features — is not PHI and is governed by the Bliv Privacy Policy and Consumer Health Data Privacy Policy rather than by this Notice.

2. How we may use and disclose your PHI without your authorization

For treatment. We use your PHI to evaluate, diagnose, and treat you and to coordinate your care. For example, your clinician reviews your intake responses, history, laboratory results, and connected-device data to decide whether a treatment is appropriate; sends your prescription to a pharmacy; orders laboratory tests; and may consult with other clinicians in the Medical Groups about your care. We may also share your PHI with other health care providers you see, or with a pharmacy or laboratory, so they can treat you.
For payment. We use and disclose PHI to bill and collect payment for your care — for example, to process your payment through our business associate’s payment systems, to confirm your eligibility for an employer-sponsored program, or, if you ask us to, to provide you with documentation you can submit to your health plan or health savings account. Our services are generally provided on a self-pay basis and we do not bill health plans unless we tell you otherwise.
For health care operations. We use PHI to run the Medical Groups and improve the care we provide — for example, quality review of clinical decisions, training and supervising clinicians, credentialing, compliance and legal review, auditing, business planning, and resolving complaints. We may share PHI for these purposes with our business associates, including Metabody Services, LLC, and with the other Medical Groups in our arrangement.
Appointment reminders, treatment information, and health-related services. We may contact you about appointments, refills, follow-up, test results, and treatment options, and we may tell you about health-related products and services that the Medical Groups or Bliv offer that may be of interest to you. You may ask us to stop sending you communications about health-related products and services at any time by contacting the Privacy Officer or using the preference settings in your account; we will honor your request. We do not conduct fundraising.
Business associates. We share PHI with companies that perform services for us — technology and hosting, the electronic health record, secure messaging, artificial-intelligence tools, payment processing, identity verification, communications, and customer support — under written agreements that require them to safeguard your PHI, to use it only to perform services for us, and not to use it to train their own artificial-intelligence models.
Individuals involved in your care. With your agreement, we may share PHI relevant to their involvement with a family member, friend, or other person you identify as involved in your care or payment for your care.
Other uses and disclosures permitted or required by law. We may use or disclose your PHI without your authorization: as required by law; for public health activities, such as reporting adverse reactions to medications to the Food and Drug Administration or a manufacturer, reporting disease, or reporting suspected abuse, neglect, or domestic violence to the authorities authorized to receive such reports; for health oversight activities by government agencies that regulate health care, such as licensing boards and audits; in judicial and administrative proceedings, in response to a court or administrative order, or in response to a subpoena or discovery request that meets legal requirements; to law enforcement for limited purposes permitted by law, such as identifying a suspect or reporting a crime on our premises; to coroners, medical examiners, and funeral directors; for organ and tissue donation; for research approved by an institutional review board or privacy board that has waived the authorization requirement, or using information from which identifiers have been removed; to avert a serious threat to the health or safety of you or others; for specialized government functions, such as military, national security, or protective services, and to correctional institutions about inmates; and for workers’ compensation as authorized by law. Many of these disclosures are subject to conditions in HIPAA and other laws, and we make them only when those conditions are met.

3. Artificial intelligence in your care

Your clinicians use software tools — including an AI Assistant provided by Metabody Services, LLC that uses generative artificial intelligence — to help them review your information, summarize it, flag items that may deserve attention, draft communications, and answer your questions. These tools are part of our health care operations, operate under our business associate agreement, and process your PHI only on our behalf. The AI Assistant does not make clinical decisions. Clinical decisions about your care, including whether to prescribe any medication, are made by a licensed clinician, and content generated by AI tools for your care team is reviewed by a clinician before any clinical action is taken. The AI Assistant provides information, not medical advice; you should always confirm health information with your clinician. You can learn more, including how to reach a human member of your care team at any time, in the Bliv Terms of Service and in the app.

4. Uses and disclosures that require your written authorization

We will not use or disclose your PHI for marketing purposes, sell your PHI, or use or disclose psychotherapy notes (if any are created) without your written authorization, except as HIPAA permits. If a marketing communication involves payment to us from a third party, we will tell you so in the authorization. Any other use or disclosure not described in this Notice will be made only with your written authorization. You may revoke an authorization at any time by writing to the Privacy Officer, except to the extent we have already acted in reliance on it. Revocation does not affect care you have already received.

5. Substance use disorder treatment records

If we receive records from a program that is subject to the federal confidentiality rules for substance use disorder patient records (42 CFR Part 2), those records receive additional protection. We will not use or disclose them in civil, criminal, administrative, or legislative proceedings against you without your specific written consent or a court order that meets the requirements of Part 2, and we will not use or disclose them for fundraising. Part 2 records may be redisclosed only as permitted by Part 2 and HIPAA.

6. Your rights regarding your PHI

Right to access and obtain a copy. You may inspect and obtain a copy of the PHI we maintain about you in a designated record set, including in electronic form if we maintain it electronically, and you may direct us to send a copy to a person or entity you designate. Most of your record is available in your Bliv account; for anything else, write to the Privacy Officer. We will respond within 30 days (we may extend once by 30 days with notice) and may charge a reasonable, cost-based fee for copies. We may deny access in limited circumstances; if we do, we will explain why and how to request a review.
Right to request an amendment. If you believe PHI in your record is incorrect or incomplete, you may ask us in writing to amend it and tell us why. We will respond within 60 days. We may deny the request if the information was not created by us, is not part of the designated record set, is not available for inspection, or is accurate and complete; if we deny it, you may submit a statement of disagreement that we will keep with your record.
Right to an accounting of disclosures. You may request a list of the disclosures we have made of your PHI in the six years before your request, other than disclosures for treatment, payment, or health care operations, disclosures you authorized, and certain other disclosures HIPAA excludes. The first accounting in any 12-month period is free; we may charge a reasonable fee for additional requests.
Right to request restrictions. You may ask us to limit how we use or disclose your PHI for treatment, payment, or health care operations, or to people involved in your care. We are not required to agree, except as follows: if you pay for a service or item out of pocket in full, you may ask us not to disclose PHI about that service or item to your health plan for payment or operations purposes, and we must agree unless the disclosure is required by law.
Right to confidential communications. You may ask us to communicate with you in a specific way or at a specific location — for example, only by secure message in the app rather than by text, or only at a particular email address. We will accommodate reasonable requests.
Right to be notified of a breach. We will notify you if a breach occurs that compromises the privacy or security of your unsecured PHI.
Right to a paper copy of this Notice. You may obtain a paper copy at any time by asking the Privacy Officer, even if you agreed to receive it electronically. The current Notice is always available at joinbliv.com/notice-of-privacy-practices and in the app.
Right to choose someone to act for you. If you have given someone medical power of attorney or someone is your legal guardian, that person may exercise your rights and make choices about your PHI; we will confirm the person’s authority before acting.
To exercise any of these rights, contact the Privacy Officer listed in §9. We will not retaliate against you for exercising your rights.

7. Our responsibilities

We are required by law to maintain the privacy and security of your PHI; to provide you with this Notice of our legal duties and privacy practices; to notify you promptly if a breach may have compromised the privacy or security of your PHI; to follow the duties and privacy practices described in this Notice and give you a copy of it; and not to use or share your PHI other than as described here unless you tell us we can in writing. If you tell us we can share your PHI, you may change your mind at any time by letting us know in writing. Where a state law gives your PHI greater protection than HIPAA, we follow the more protective law.

8. Changes to this Notice

We may change the terms of this Notice at any time, and the changes will apply to all PHI we maintain, including PHI we created or received before the change. When we make a material change we will post the revised Notice at joinbliv.com/notice-of-privacy-practices and in the app, with a new effective date, and make it available to you on request. Where the change materially affects your rights or our uses of PHI, we will also notify you by email or in-app message.

9. Questions and complaints

If you have questions about this Notice or wish to exercise your rights, contact our Privacy Officer:
Matthew Hall, General Counsel and Privacy Officer, c/o Metabody Services, LLC, 2943 Parkway Blvd, Unit 374, West Valley City, UT 84119 · [email protected] · 888-859-2882
If you believe your privacy rights have been violated, you may file a complaint with us by contacting the Privacy Officer, and you may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, by mail at 200 Independence Avenue S.W., Washington, D.C. 20201; by phone at 1-877-696-6775; or online at www.hhs.gov/ocr/privacy/hipaa/complaints/. We will not retaliate against you for filing a complaint.
Acknowledgment. When you first receive clinical services through Bliv, you will be asked to acknowledge that you have received this Notice. Your acknowledgment is not a consent to any particular use or disclosure and does not waive any of your rights.