HIPAA Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

This notice describes the privacy practices that apply to health information created or received when you are evaluated or treated through the GOODNCO experience. The covered entity is the licensed provider group that treats you — the medical practice whose clinicians review your intake, decide on treatment, and hold your medical record. GOODNCO is not the covered entity.

GOODNCO operates the website and the intake experience. We collect the answers and contact details you submit and transmit them to the clinical platform used by the provider group. Some product paths may ask for photos in the future; today no photo is uploaded from this site. In doing so, GOODNCO acts as a business associate of the provider group under a written agreement, and may use or disclose your health information only as that agreement and HIPAA permit. GOODNCO does not make clinical decisions and does not use your health information for advertising.

• Treatment: your intake answers are made available to the clinician reviewing your case, and to a pharmacy or laboratory involved in carrying out an order, so treatment can be evaluated, prescribed, filled, or followed up. Some product paths may ask for photos in the future; when that is available, any photo you submit will be handled the same way.
• Payment: limited information is used to bill your payment method, confirm eligibility for a service, and collect amounts owed. Payment card details are handled by a payment processor and are not part of your medical record.
• Health care operations: information is used for quality review, clinician oversight, training, safety monitoring, credentialing, and the administration of the practice.

Your health information may be used or disclosed without your authorization as required by law; for public health activities, including reporting adverse events and product recalls; to report suspected abuse, neglect, or domestic violence; for health oversight activities; in judicial and administrative proceedings in response to a valid order or subpoena; for law enforcement purposes as permitted; to coroners, medical examiners, and funeral directors; for organ and tissue donation; for approved research; to avert a serious and imminent threat to health or safety; for specialized government functions, including military and national security; and for workers’ compensation as state law requires.

Written authorization is required before your health information is used or disclosed for marketing communications, other than as HIPAA permits; for the sale of your health information; for the use or disclosure of psychotherapy notes, other than the narrow uses HIPAA permits; and for any purpose not described in this notice. You may revoke an authorization in writing at any time. Revocation does not undo disclosures already made in reliance on it.

• Inspect and copy: see and get a copy of your medical and billing records, including an electronic copy where the record is kept electronically, usually within 30 days. A reasonable, cost-based fee may apply.
• Amend: ask in writing to correct information you believe is incorrect or incomplete. The practice may deny the request and will tell you why in writing; you may file a statement of disagreement.
• Accounting of disclosures: request a list of certain disclosures made in the six years before your request, excluding disclosures for treatment, payment, and health care operations.
• Request restrictions: ask the practice to limit how it uses or discloses your information. It is not required to agree, except that it must withhold information from a health plan when you pay for that item or service in full out of pocket.
• Confidential communications: ask to be contacted at an alternative address or by an alternative method. Reasonable requests are accommodated.
• Paper copy: request a paper copy of this notice at any time, even if you agreed to receive it electronically.
• Notice of a breach: be notified if a breach compromises the privacy or security of your unsecured health information.
• A representative: a personal representative with legal authority may exercise these rights for you.

The practice is required by law to keep your health information private, to give you this notice of its legal duties and privacy practices, to follow the terms of the notice currently in effect, and to notify you if a breach occurs. GOODNCO is required by its business associate agreement and by HIPAA to safeguard the information it handles, to limit its use to the services it performs, to bind its own subcontractors to the same terms, and to report any security incident to the practice.

If you believe your privacy rights were violated, you may complain to the practice using the contact information it publishes, or write to GOODNCO so we route your complaint to the practice’s privacy officer. You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, 200 Independence Avenue SW, Washington, DC 20201, or at hhs.gov/ocr. You will not be retaliated against for filing a complaint.

The practice may change this notice and apply the changed terms to information it already holds. The current notice is posted on this page with its effective date, and a paper copy is available on request.

Where state law gives you greater protection than HIPAA — for example, for mental health, substance use, HIV, or reproductive health information — the stricter state rule applies.

This interim notice is published September 4, 2026 and becomes effective on approval by counsel; the effective date will be printed here.

Email support@goodnco.com. Please do not include health details in email; we will direct you to a secure channel or to the practice’s privacy officer. A privacy-officer telephone number will be added here once one is designated.