Current Version — Effective Immediately
Infinity Better Health Flow ("Infinity Better Health Flow," "we," "us," "our") operates this platform and provides healthcare, wellness, and insurance brokerage services across the United States. This Privacy Policy describes our practices regarding the collection, use, disclosure, and protection of your personal information and Protected Health Information (PHI) in compliance with HIPAA, state privacy laws, and applicable federal regulations.
1. Data We Collect
1.1 Identity Data: Full legal name, date of birth, Social Security Number (when required for insurance verification or regulatory compliance), government-issued ID information, gender, and contact details including mailing address, phone numbers, and email addresses.
1.2 Health & Medical Data: Complete medical history, current and past diagnoses, medications and dosages, allergies and sensitivities, immunization records, lab results and diagnostic imaging, treatment plans and progress notes, mental health records, reproductive health information, genetic testing results, and biometric data (height, weight, vitals).
1.3 Insurance & Financial Data: Insurance carrier name, policy and group numbers, member IDs, subscriber and dependent information, claims history, explanation of benefits (EOB), credit/debit card numbers, bank account details for ACH, billing address, and payment transaction records.
1.4 Digital & Technical Data: IP address and geolocation, device identifiers (UDID, advertising IDs), browser type, version, and language settings, operating system and device model, screen resolution and display properties, pages viewed, click-through patterns, session duration, referral source, and interaction heatmaps.
1.5 Communication Records: All written correspondence (emails, chat messages, support tickets), recorded phone calls (with prior consent), telehealth video session metadata (duration, participants, technical logs, not clinical content), and SMS message logs.
1.6 User-Generated Content: Profile photos, health questionnaire responses, symptom journal entries, fitness tracking data, dietary logs, wellness assessment results, and feedback or reviews you submit through our platform.
2. How We Use Your Data
2.1 Clinical Care Delivery: Diagnosing conditions, developing and adjusting treatment plans, prescribing medications, ordering and interpreting lab work, coordinating specialist referrals, managing chronic conditions, and conducting preventive health screenings.
2.2 Care Coordination: Sharing relevant medical information between providers on your care team, facilitating specialist referrals, ensuring continuity of care across in-person and virtual visits, and maintaining unified health records.
2.3 Scheduling & Operations: Booking and managing appointments, sending reminders and confirmations, managing provider schedules, coordinating facility logistics, processing waitlists, and optimizing resource allocation.
2.4 Insurance & Billing: Verifying eligibility and benefits, obtaining prior authorizations, submitting claims, processing payments and refunds, handling billing disputes, negotiating with insurance carriers, and managing payment plans.
2.5 Communications: Sending transactional messages (appointment details, test results, prescriptions, billing), promotional content (newsletters, health tips, service announcements, offers), and urgent health alerts based on your communication preferences.
2.6 Platform Improvement: Analyzing usage patterns to improve UX, conducting A/B testing on features, training machine learning models for symptom checkers and care recommendations, debugging technical issues, and personalizing content delivery.
2.7 Legal & Regulatory Compliance: Meeting HIPAA documentation requirements, responding to lawful subpoenas and court orders, cooperating with regulatory audits, reporting to public health authorities as mandated, and maintaining compliance records.
3. Data Sharing & Disclosure
3.1 Treatment Partners: We share PHI with physicians, nurse practitioners, specialists, therapists, pharmacists, and lab technicians involved in your direct care, under a treatment relationship as defined by HIPAA.
3.2 Payment Processors: Financial data is shared with our PCI-DSS Level 1 certified payment processor for transaction execution. Card numbers are tokenized and never stored in our systems.
3.3 Insurance Entities: Necessary clinical and administrative data is disclosed to your insurance carrier for claims processing, utilization review, peer-to-peer reviews, and coverage determination.
3.4 Business Associates: Data is shared with vetted third parties under executed Business Associate Agreements (BAA) including: cloud infrastructure (AWS), electronic health record systems, lab testing partners, pharmacy benefit managers, telehealth platform providers, and analytics services.
3.5 Public Health Authorities: Reportable diseases, immunization data, adverse drug reactions, and birth/death events are disclosed to CDC, state health departments, and other agencies as required by law.
3.6 Research & De-identified Data: With your explicit consent, de-identified or anonymized data may be used for approved research studies, public health research, or aggregated trend analysis. No individually identifiable data is shared for research without authorization.
3.7 Absolute Prohibition on Sale: Infinity Better Health Flow does not sell, lease, barter, or trade your personal information or PHI to any entity for any purpose, including marketing, advertising, or data brokerage. This prohibition is absolute and non-negotiable.
4. Security Architecture
4.1 Encryption Standards: All data in transit protected by TLS 1.3 with perfect forward secrecy. All data at rest encrypted with AES-256-GCM. Database-level encryption with rotating keys managed through AWS KMS. End-to-end encryption for telehealth video and chat.
4.2 Access Control Framework: Zero-trust architecture with role-based access control (RBAC). Just-in-time access provisioning. Principle of least privilege enforced across all systems. Automatic session timeout after 15 minutes of inactivity.
4.3 Authentication Security: Mandatory MFA for all staff (TOTP or hardware key). Optional but strongly encouraged MFA for patients. Biometric login support (Face ID, fingerprint). Password policy: minimum 12 characters, complexity requirements, breach detection against known compromised password databases.
4.4 Network Defense: Web application firewall (WAF), DDoS mitigation, intrusion detection/prevention systems (IDS/IPS), DNS filtering, email security with anti-phishing and anti-spam, and micro-segmented network architecture.
4.5 Continuous Monitoring: 24/7 Security Operations Center (SOC) monitoring. Real-time alerting on anomalous activities. Quarterly penetration testing by independent third parties. Annual comprehensive security audits. Bug bounty program for responsible disclosure.
4.6 Incident Response: Documented incident response plan with defined severity levels, escalation paths, and communication timelines. Breach notification within 60 days per HIPAA requirements, with priority notification for high-severity incidents. Post-incident forensic analysis and remediation.
5. Your Privacy Rights
5.1 Right to Access: You may request a complete copy of your health records and personal data. Requests are fulfilled within 30 days in your preferred format (electronic or paper).
5.2 Right to Correction: You may request amendments to inaccurate or incomplete health records. We will process within 60 days and notify all relevant parties of corrections.
5.3 Right to Restriction: You may request restrictions on uses/disclosures of PHI for treatment, payment, or operations. We must comply for disclosures to health plans if you pay out-of-pocket in full.
5.4 Right to Confidential Communications: You may specify alternative communication methods or locations (e.g., cell phone only, no work email) and we will accommodate reasonable requests.
5.5 Right to Accounting of Disclosures: You may request a log of certain PHI disclosures made in the past six years, excluding those for treatment, payment, operations, and authorized disclosures.
5.6 Right to Paper Copy: Upon request, we provide a paper copy of this Privacy Policy, your Notice of Privacy Practices, and your health records.
5.7 Right to Breach Notification: You will receive written notification within 60 days of any breach involving your unsecured PHI, including the nature of the breach, types of information involved, and protective steps taken.
5.8 Right to File Complaints: You may file a complaint with our Privacy Officer or with the HHS Office for Civil Rights without fear of retaliation or impact on your care. Complaint procedures are outlined in our Notice of Privacy Practices.
6. Cookies & Tracking Technologies
6.1 Essential Cookies: Required for authentication, session management, security features, and core functionality. Cannot be disabled.
6.2 Analytics: Privacy-focused analytics (no personal data leaves our infrastructure). Aggregated, anonymized page view and interaction data for UX improvement only.
6.3 Marketing Pixels: Third-party remarketing pixels (Meta, Google) are deployed only after explicit opt-in consent. Fully compliant with state privacy laws.
6.4 Do Not Track: We honor DNT signals where technically feasible, though DNT is not universally recognized by all tracking technologies.
7. Minors & Children's Data
Services for patients under 18 require verifiable parental or legal guardian consent. We collect only the minimum necessary data for pediatric care. We do not knowingly collect data from children under 13 outside of the healthcare context without COPPA-compliant parental consent.
8. State-Specific Rights
In addition to HIPAA rights, residents of states with comprehensive privacy laws (CCPA/CPRA in California, CDPA in Colorado, CPA in Connecticut, my Health My Data Act in Washington, and others) may have additional rights including data deletion, opt-out of sale/sharing (which we do not engage in), data portability, and limitation of sensitive data use. We honor all applicable state privacy rights.
9. Data Retention
Health records are retained per applicable state and federal requirements (typically 7–10 years for adults, age of majority plus applicable retention period for minors). Account data is retained while your account is active. Upon account deletion, personal data is purged within 90 days, subject to legal holds and regulatory retention requirements. Technical/analytics data is retained for 24 months.
10. Policy Updates
We update this Privacy Policy as needed. Material changes are communicated via email notification at least 30 days before effectiveness and via prominent website notice. Continued use after the effective date constitutes acceptance. A version history is maintained and available upon request.
11. Contact Our Privacy Officer
Infinity Better Health Flow — Privacy Officer
Email: privacy@infinitybetterhealthflow.info
Phone: +1 315-781-8182, Option 5
Mail: 25 Grove St, Geneva, NY 14456, USA
Response time: Within 5 business days for all privacy-related inquiries.
