HIPAA Notice of Privacy Practices (NPP)

1. Our Commitment to Your Health Privacy

HeartFit For Life at the Cardiac Therapy Foundation ("HeartFit", "we", or "us") provides structured cardiac rehabilitation, supervised exercise, lifestyle counseling, and digital health monitoring. In providing these services, we collect, generate, and maintain your Protected Health Information (PHI) in our secure electronic companion platform.

We are required by federal law (HIPAA Privacy Rule, 45 CFR Part 160 and Part 164, Subparts A and E) to maintain the privacy of your health information, to provide you with this Notice of our legal duties and privacy practices, and to notify you following any breach of unsecured health information.

2. What Health Information We Collect in the Companion Platform

When you participate in HeartFit cardiac rehabilitation, we maintain electronic health records including:

• Identification & Contact Data: Name, date of birth, emergency contacts, attending physician details.
• Vital Telemetry & Physiological Readings: Blood pressure, resting and exercise heart rate, body weight, blood glucose, and oxygen saturation.
• Wearable Sensor Telemetry: Optical heart rate samples and step activity recorded via paired Apple Watch or Wear OS devices.
• Clinical Notes & Care Plans: Diagnoses, cardiac risk factors, nurse notes, Borg Perceived Exertion (RPE) ratings, symptom reports, and exercise logs.
• Care-Team Communications: Secure messaging between you, supervising exercise physiologists, nurses, and medical directors.

3. How We May Use and Disclose Your Health Information

Under federal law, we may use and disclose your health information without your specific written authorization for the following purposes:

All other uses and disclosures not covered by this Notice (including marketing or sale of PHI) require your explicit written authorization.

4. Your Rights Regarding Your Health Information

You have the following rights under HIPAA:

• Right to Inspect and Copy: You have the right to inspect and receive an electronic copy of your medical records and vital logs. You may access your data directly in the HeartFit Companion app or request a complete export in PDF/CSV format.
• Right to Request Amendments: If you feel the health information we have about you is incorrect or incomplete, you may submit a written request to amend your record.
• Right to an Accounting of Disclosures: You have the right to request a list of disclosures we have made of your PHI for purposes other than treatment, payment, or healthcare operations.
• Right to Request Restrictions: You may request limits on how we use or disclose your information for treatment, payment, or operations. While we are not required to agree to all requests, we must agree if you pay out-of-pocket in full for a service and ask us not to bill your insurer.
• Right to Confidential Communications: You may request that we communicate with you via specific secure channels or at an alternative address.
• Right to a Paper Copy of this Notice: You may obtain a paper copy of this Notice upon request at any time.

5. Security & Automated Protections

HeartFit implements technical and physical safeguards to protect your electronic records:

• Encryption in Transit & at Rest: Health data is protected using strong industry-standard encryption protocols (including TLS during transmission and encrypted database storage) complying with HIPAA Security standards.
• Automatic Inactivity Logoff: Web and workstation screens automatically lock after 15 minutes of inactivity to prevent unauthorized viewing.
• Immutable Audit Logging: All access to your clinical record is permanently logged in a secure, tamper-resistant audit registry.

6. Data Retention Practices

We retain your personal information, vital telemetry, and medical records for as long as you maintain an active account or participate in our cardiac rehabilitation program.

• Clinical & Medical Records: Following the conclusion or termination of your enrollment, your clinical records, physician notes, and vital histories are retained in secure, encrypted storage in accordance with our organizational retention schedule and applicable state law (typically a minimum of seven (7) years following the date of last encounter, and longer for minors).
• Account Access & Session Event Logs: When an account is deactivated or closed, account login access and associated role permissions are revoked. Active session credentials expire in accordance with token expiration lifecycles. Historical session and authentication event records are retained for a minimum of one (1) year following account deactivation in compliance with security event retention standards, after which they are permanently deleted.
• Compliance & Audit Records: Under our organizational compliance policy, audit logs and compliance documentation are designated for retention for a minimum of six (6) years pursuant to HIPAA documentation standards (45 CFR § 164.316(b)(2)(i)), with production archive retention configurations scheduled prior to live production PHI onboarding.

7. User Data Deletion Request Process

You have the right to request the deletion of your account and personal information at any time.

8. Complaints & Contact Information

If you believe your privacy rights have been violated, you may file a complaint with us or with the Office for Civil Rights (OCR) of the U.S. Department of Health and Human Services:

We will never retaliate against you for filing a complaint.