1. Information We Collect on the Site

• Identifiers: name, email, phone if you submit forms.
• Usage Data: IP address, device/browser, pages viewed, timestamps.
• Cookies/Analytics: to operate, secure, and improve the Site; measure traffic; remember preferences; and support advertising/retargeting (if used).

2. How We Use Non-PHI

• Provide and improve the Site and support.
• Respond to inquiries and schedule Services.
• Security, fraud prevention, and legal compliance.
• Marketing (with consent where required). You may opt out of marketing emails anytime.

3. Sharing Non-PHI

• Vendors: site hosting, analytics, security, and support (bound by contract).
• Legal: to comply with law, respond to requests, or protect rights/safety.
• Corporate Changes: as part of a merger, acquisition, or asset transfer.

4. Your Choices

• Browser controls for cookies; some features may be limited if disabled.
• Opt-out links (email unsubscribe).
• Do Not Track signals are not acted upon unless required by state law.

5. Data Security & Retention

We use reasonable safeguards. No method is 100% secure. We keep data as long as necessary for purposes described or as required by law.

6. Children

The Site is not directed to children under 13; our Services are only for adults 18+.

7. State-Specific Notices

We will honor applicable state privacy rights (e.g., CA/CO/CT/VA). Contact us to exercise rights to access, delete, or correct non-PHI collected via the Site.

8. Changes & Contact

We may update this policy and post a new Effective Date.
Contact: info@mycgmcoach.com

---

HIPAA Notice of Privacy Practices (NPP)

1. Your Health Information (PHI)

This Notice describes how medical information about you may be used and disclosed and how you can get access to it. We are required by law to maintain the privacy of your PHI, provide this Notice, and abide by it.

2. Our Permitted Uses & Disclosures

We may use/disclose PHI without your written authorization for:

• Treatment: share with your providers, pharmacies, labs; coordinate care and CGM training; discuss alternatives.
• Payment: verify eligibility; bill you/Medicare/insurers; manage claims and collections; respond to payer audits.
• Health Care Operations: quality improvement; training; credentialing; compliance; customer service; legal, auditing, and business planning.

Other permitted/required disclosures include: public health reporting, FDA/device safety reporting, health oversight, judicial/administrative proceedings, law enforcement (as permitted), coroners/medical examiners, organ donation, research with IRB/Privacy Board waiver or your authorization, to avert serious threats to health or safety, specialized government functions, and workers' compensation.

3. Uses/Disclosures Requiring Your Written/Verbal Authorization

We will obtain your written and/or Verbal authorization for uses/disclosures not described above, including most marketing, sale of PHI, and psychotherapy notes (if applicable). You may revoke in writing at any time, except to the extent relied upon.

4. Your Rights

• Right to Access/Copy: You may request electronic or paper copies of your records.
• Right to Amend: Request corrections if you believe information is incomplete or inaccurate.
• Right to an Accounting: Receive a list of certain disclosures made in the prior six years.
• Right to Request Restrictions: We will consider your request; we must agree to restrict disclosures to a health plan for items/services you paid for in full out of pocket.
• Right to Request Confidential Communications: Ask us to contact you at alternative addresses/phones.
• Right to Paper Copy: You may receive a paper copy of this Notice.
• Right to Breach Notice: You will be notified following a breach of unsecured PHI as required by law.

5. Our Duties

We are required to maintain PHI privacy, provide this Notice, abide by it, and notify you of material changes. We will post the current Notice on our Site and in our office.

6. Business Associates

We may share PHI with contractors ("business associates") who perform services for us under written agreements requiring HIPAA compliance (e.g., IT, EHR, billing, device logistics).

7. CGM & Device-Related Reporting

We may disclose limited PHI to device manufacturers/pharmacies for safety, recalls, replacements, adverse event reporting, and order fulfillment.

8. Complaints

If you believe your privacy rights have been violated, you may file a complaint with us or with the U.S. Department of Health & Human Services, Office for Civil Rights. We will not retaliate for filing a complaint.
Contact to File: Privacy Officer, PO Box 2565, Rockville, MD 20847. Email: info@MyCGMCoach.com

9. Effective Date & Changes

We reserve the right to change this Notice and make the new terms effective for all PHI we maintain. We will post a current Notice with the Effective Date.