Privacy Policy

Introduction

This Privacy Policy explains how Korber Art LLC (“Company,” “we,” “our,” or “us”) collects, uses, discloses, and protects information when you access or use the MedCPC platform (the “Platform”), including its public-facing website, web-based forms, mobile applications, and related Platform Services.

The Platform is licensed to Participating Organizations to facilitate the submission, communication, and exchange of information between End Users and Participating Organizations. It enables End Users, where made available by a Participating Organization, to submit requests, forms, documents, and other information to the Participating Organization and to receive service-related communications through or in connection with the Platform. This Privacy Policy applies to your use of the Platform as an End User.

Your access to and use of the Platform is also governed by the Company's End User Terms and Conditions.

Definitions

For purposes of this Privacy Policy, the following definitions apply:

"Company"

means Korber Art LLC, the provider and operator of the Platform.

"Platform"

means the public-facing website, web-based forms, mobile applications, supporting mobile technologies (as applicable), SMS notification services, and related technology provided by the Company to facilitate communications and information exchange between End Users and Participating Organizations. Unless expressly stated otherwise, the Platform does not include administration portals or other services intended solely for use by Participating Organizations.

"Participating Organization"

means any pharmacy, clinic, physician practice, healthcare provider, healthcare facility, or other organization that has entered into an agreement with the Company to use the Platform and that makes the Platform available to End Users in connection with the services it provides.

"Patient"

means an individual who receives or seeks to receive services from a Participating Organization.

"End User"

means any individual who is authorized or otherwise permitted to access or use the Platform, whether on their own behalf or on behalf of another person, including a Patient, parent, legal guardian, caregiver, authorized representative, family member, or other individual authorized by a Participating Organization or by applicable law to use the Platform.

"Protected Health Information" or "PHI"

has the meaning assigned under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and its implementing regulations, as amended. References to PHI in this Privacy Policy are intended solely to describe information that may be processed through the Platform in connection with the services provided by Participating Organizations and do not create, modify, expand, limit, or otherwise affect the respective legal rights or responsibilities of the Company or any Participating Organization under HIPAA or any other applicable law.

"Platform Services"

means the communication, information transmission, messaging, notification, functionality, features, tools, and related technology services provided by the Company through or in connection with the Platform.

"Transactional SMS Message"

means a text message transmitted through or in connection with the Platform in relation to an End User's interaction with a Participating Organization, including confirmation messages, status updates, requests to contact the Participating Organization, or other operational communications.

Our Role

This Privacy Policy describes the Company's privacy practices as the provider and operator of the Platform. It does not replace or modify the privacy policies or notices provided by the Participating Organization.

We provide the Platform and related technology services to Participating Organizations. We do not provide healthcare services, medical care, diagnosis, treatment, healthcare advice, or customer support services directly to End Users.

The Participating Organization determines which Platform features it uses, what information it requests, how submitted information is used in connection with the services it provides, and how it communicates with and supports its End Users in connection with its use of the Platform.

Questions regarding prescriptions, appointments, healthcare services, requests submitted through the Platform, assistance with using the Platform, or the Participating Organization's privacy practices should be directed to the Participating Organization.

The Company may, in its sole discretion, make available a mechanism through which End Users may report technical issues relating to the operation of the Platform. Any such mechanism is provided solely as a convenience, is supplemental to communications with the Participating Organization and does not replace communications with the Participating Organization, and does not create any obligation on the part of the Company to provide technical support or other assistance to End Users.

Information We Process

Depending on how the Participating Organization configures and uses the Platform, including the features, workflows, and forms it makes available, information submitted through or generated by the Platform may include:

• Name
• Telephone number
• Email address, where requested
• Date of birth, where requested
• Information submitted through refill, appointment, curbside, intake, messaging, or other requests
• Photographs, images, or uploaded documents
• Barcode or reference numbers
• Notes or other voluntarily submitted information
• Platform-generated confirmation or reference numbers
• Technical information necessary to operate and secure the Platform, including device information, browser type, IP address, session information, and system logs

The specific information requested is determined by the Participating Organization. End Users are not required to create an account with the Company.

Information you voluntarily provide when reporting a technical issue to the Company or in response to follow-up communications relating to a reported technical issue, together with technical information automatically provided by the Platform in connection with such reports, may include descriptions of technical issues, device information, browser information, operating system information, application version, technical information about the Platform interface through which the report was submitted, screenshots or other files you choose to provide, and contact information you provide for follow-up. Technical issue reporting channels are intended solely for reporting issues relating to the operation of the Platform and are not designed for the submission of Protected Health Information or other sensitive healthcare information.

Mobile Device Permissions

Depending on your device, operating system, and the features you choose to use, the native mobile application may request permission to access:

• Camera or photo library for document uploads
• Camera for barcode scanning
• Network connectivity required for Platform functionality and submission of requests

These permissions are requested only when needed for features you choose to use. Declining permissions may limit certain functionality.

How We Use Information

We process information solely to provide, operate, secure, maintain, and improve the Platform and related technology services.

These purposes may include:

• Transmit information to the Participating Organization through the Platform
• Process requests submitted through the Platform
• Deliver transactional SMS notifications
• Maintain the security and operation of the Platform
• Protect against fraud and unauthorized use
• Diagnose technical issues
• Improve reliability and security
• Comply with legal obligations
• Review, investigate, communicate regarding, and, in the Company's discretion, attempt to address reported technical issues.

We do not use information processed through the Platform for advertising, behavioral profiling, or marketing, and we do not sell personal information.

SMS Communications

If a mobile telephone number is provided, the Platform may be used to facilitate the transmission of text messages in connection with your interactions with the Participating Organization.

These messages may include:

• Request confirmations
• Confirmation or reference numbers
• Status updates, where enabled or configured by the Participating Organization
• Requests to contact the Participating Organization
• Other operational notifications

The Platform's SMS functionality is intended to facilitate operational communications relating to your interactions with the Participating Organization. SMS messages transmitted through the Platform are designed to avoid including sensitive health information. The Platform may automatically generate certain operational communications as part of its standard functionality and may also provide Participating Organizations with tools to configure, initiate, or transmit other communications.

Participating Organizations are responsible for communications they configure, initiate, or authorize for transmission through the Platform. The Company does not create, review, monitor, approve, verify, or control communications configured, initiated, authorized, or transmitted by Participating Organizations through the Platform. Message frequency varies, carrier rates may apply, and delivery cannot be guaranteed.

Access to Information

When providing support or maintenance services to Participating Organizations, the Company's normal operational processes are designed to use demonstration or test data whenever reasonably practicable.

In limited circumstances, authorized Company personnel, contractors, or service providers may access information when reasonably necessary to provide, operate, maintain, secure, or improve the Platform; investigate technical issues; comply with legal obligations; or fulfill contractual obligations to a Participating Organization.

Information voluntarily submitted through the Company's technical issue reporting channels may be accessed by authorized Company personnel or service providers as reasonably necessary to review, investigate, communicate regarding, or, in the Company's discretion, attempt to address reported technical issues.

We do not access or use Platform information for advertising, marketing, profiling, or unrelated purposes.

Information Sharing

We may disclose information only as reasonably necessary to provide, operate, maintain, secure, or improve the Platform and related technology services; fulfill our contractual obligations to Participating Organizations; comply with applicable law or legal process; or protect the security, integrity, or availability of the Platform or the rights, property, or safety of the Company, Participating Organizations, End Users, or others.

Information may be disclosed, where reasonably necessary, to:

• the Participating Organization;
• Service providers that support the operation of the Platform under appropriate contractual confidentiality and security obligations;
• Government authorities, regulators, law enforcement, or other persons or entities where required by applicable law, legal process, or a valid governmental request; and
• Other parties where reasonably necessary to investigate, prevent, or respond to fraud, security incidents, unauthorized access or use, violations of law, or to establish, exercise, or defend legal claims.

We do not sell, rent, or share personal information or Protected Health Information for advertising or marketing purposes.

Service Providers

We use service providers to support the operation of the Platform, including cloud hosting, data storage, transactional SMS delivery, infrastructure monitoring, security, backup, and disaster recovery. These service providers may process information only as necessary to provide services to the Company and are subject to contractual obligations appropriate to the nature of the information processed.

Security

We maintain administrative, technical, and physical safeguards designed to protect information against unauthorized access, disclosure, alteration, or destruction.

Although commercially reasonable safeguards are used, no method of electronic transmission or storage can be guaranteed to be completely secure.

If the Company becomes aware of a security incident affecting information processed through the Platform, it may take such actions as it determines appropriate, subject to applicable law and contractual obligations.

Nothing in this Privacy Policy creates any independent obligation for the Company to provide direct or individualized notice to any End User, Participating Organization, or other person regarding a security incident or other matter, except to the extent expressly required by applicable law. Any notice obligations owed by the Company to a Participating Organization under a separate agreement are governed solely by that agreement and do not create rights or remedies in favor of End Users or other third parties.

Cookies and Similar Technologies

Website and Web-Based Forms

We use only cookies and similar technologies necessary for the operation, security, and functionality of the website and web-based forms.

We do not use advertising cookies, marketing cookies, retargeting technologies, behavioral profiling, session replay, or optional analytics.

Native Mobile Applications

Depending on your device, operating system, and the technology used to provide the mobile application, the mobile application may use browser or operating system functionality necessary to provide Platform functionality and related services. The mobile application does not intentionally use browser cookies for tracking, advertising, or analytics purposes and does not include advertising SDKs, behavioral profiling, session replay technologies, tracking pixels, or optional analytics technologies.

Third-Party Websites and Services

The Platform may contain links to websites, applications, resources, or services operated by Participating Organizations or other third parties for your convenience.

This Privacy Policy applies only to the Company's operation of the Platform and does not apply to any third-party website, application, resource, or service. The Company does not control and is not responsible for the privacy practices, content, security, or terms applicable to any third-party website or service.

If you choose to access a third-party website or service, your use of that website or service and any information you provide will be governed by the privacy policy and other terms applicable to that third party. We encourage you to review those documents before providing personal information.

Data Retention

The Platform is designed primarily to facilitate the transmission of information to Participating Organizations and is not intended to serve as a long-term repository or records management system for End Users or Participating Organizations. Participating Organizations are responsible for maintaining records in accordance with applicable law and their own record retention policies. End Users and Participating Organizations should not rely on the Platform as the sole or permanent repository of information submitted through the Platform.

The Company may retain information processed through the Platform for as long as reasonably necessary to provide, operate, maintain, secure, or improve the Platform and related technology services; fulfill contractual obligations to Participating Organizations; comply with applicable law; resolve disputes; protect the Company's legal rights and interests; enforce its agreements; and satisfy legitimate operational, security, backup, and disaster recovery requirements.

Certain categories of information may be retained for different periods depending on their nature and the purpose for which they are processed. For example, uploaded files, images, documents, or other attachments that have been successfully processed are generally deleted promptly after processing. Unprocessed uploads are generally removed from active systems after up to fourteen (14) days. Backup copies may be retained for a longer period as part of the Company's routine backup, disaster recovery, security, and business continuity processes.

The Company does not guarantee that information submitted through the Platform will be retained for any particular period or remain available for future retrieval by End Users or Participating Organizations.

Children's Privacy

The Platform is not directed to children for independent use. Parents, legal guardians, caregivers, and other authorized individuals may use the Platform on behalf of minors or other persons they are authorized to represent.

Your Privacy Rights

Because Participating Organizations determine the purposes for which information submitted through the Platform is collected, used, retained, and disclosed, requests regarding access, correction, deletion, restrictions on use, copies of healthcare information, or other privacy rights should be directed to the Participating Organization.

The Company does not determine the purposes or means by which Participating Organizations collect, use, retain, or disclose information submitted through the Platform and does not undertake to receive, process, respond to, or forward privacy rights requests on behalf of the Participating Organization. If you submit such a request to the Company, we may, in our sole discretion, direct you to the appropriate Participating Organization or provide available contact information for the Participating Organization, but we undertake no obligation to do so.

International Use

The Platform is intended for use by Participating Organizations and End Users within the United States and its territories.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Revised versions will be posted at:

https://secure.medcpc.com/legal/

Updates become effective on the Effective Date shown above.

Language

This Privacy Policy may be made available in languages other than English for convenience. In the event of any conflict, inconsistency, or ambiguity between the English version and any translated version, the English version shall govern to the fullest extent permitted by applicable law.

Contact Us

Questions regarding services provided by the Participating Organization, including prescriptions, requests submitted through the Platform, healthcare information, or the Participating Organization's privacy practices, should be directed to the Participating Organization.

If you have questions regarding this Privacy Policy, you may contact:
Korber Art LLC
Email: legal@medcpc.com
Mailing Address:
PO Box 6412
Portland, OR 97228