Aviso de prácticas de privacidad (HIPAA)

En vigor desde 1 de octubre de 2026 · Operado por Kureon Health · [email protected]

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Who this Notice applies to

This Notice describes protected health information ("PHI") for clinics and healthcare providers who use our provider portal. Each clinic and each clinician accepts a Business Associate Agreement with us before clinic patient information is handled in the portal.

If you use a personal account, HIPAA does not apply to your records here. Instead, the FTC Health Breach Notification Rule and applicable state and national privacy laws protect you; see our Privacy Policy for how your information is handled and the rights you have.

Our commitment

Kureon is committed to protecting the privacy of PHI. Where this Notice applies, we maintain the privacy of PHI, provide this Notice of our legal duties and privacy practices, and follow the terms currently in effect.

How we may use and disclose your PHI

Treatment-related features: to display your records and metrics to you and the members you authorize, and to generate AI analyses you request.
Operations: to operate, secure, and improve the Service (e.g. audit logging).
With your authorization: any use not described here will be made only with your written authorization, which you may revoke.
As required by law: when compelled by applicable law or legal process.

Clinic patient information is stored on our own server in Germany. AI features in the portal send content to Anthropic, and imaging AI to Modal, both in the United States. We do not yet have a Business Associate Agreement with Anthropic, Modal or ElevenLabs, so PHI sent to AI features is not covered by a downstream BAA today. We do not sell PHI or use it for marketing without authorization.

Your rights regarding your PHI

Right to access & obtain a copy of your PHI (in-app export from Settings).
Right to request amendment of PHI you believe is inaccurate. Amendment requests are handled on request via the contact email below, within the timelines HIPAA requires (generally 60 days, extendable once by 30 days).
Right to an accounting of disclosures of your PHI, available on request via the contact email below, within the timelines HIPAA requires (generally 60 days, extendable once by 30 days).
Right to request restrictions on certain uses and disclosures.
Right to request confidential communications.
Right to deletion of your account and records, subject to legal retention of certain logs.
Right to a paper copy of this Notice on request.
Right to be notified of a breach of unsecured PHI.

Our duties

Maintain the privacy and security of PHI.
Notify affected individuals following a breach of unsecured PHI.
Abide by the terms of the Notice currently in effect.
We reserve the right to change this Notice and make the new terms apply to all PHI we maintain; updated notices will be posted here.

Complaints

If you believe your privacy rights have been violated, you may contact us at the address below, or file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights. We will not retaliate for filing a complaint.

Contact / Privacy Officer

Privacy Officer: Meer Feerasta, [email protected].

Who this Notice applies to

How we may use and disclose your PHI

Treatment-related features: to display your records and metrics to you and the members you authorize, and to generate AI analyses you request.

Operations: to operate, secure, and improve the Service (e.g. audit logging).

With your authorization: any use not described here will be made only with your written authorization, which you may revoke.

As required by law: when compelled by applicable law or legal process.

Your rights regarding your PHI

Right to access & obtain a copy of your PHI (in-app export from Settings).

Right to request amendment of PHI you believe is inaccurate. Amendment requests are handled on request via the contact email below, within the timelines HIPAA requires (generally 60 days, extendable once by 30 days).

Right to an accounting of disclosures of your PHI, available on request via the contact email below, within the timelines HIPAA requires (generally 60 days, extendable once by 30 days).

Right to request restrictions on certain uses and disclosures.

Right to request confidential communications.

Right to deletion of your account and records, subject to legal retention of certain logs.

Right to a paper copy of this Notice on request.

Right to be notified of a breach of unsecured PHI.