Notice of privacy practices.
How protected health information created during your care is used, disclosed, and safeguarded — and which entities are responsible for it.
LuneRx is a technology platform, not your care team
LuneRx is a marketing and technology company. We are not a pharmacy and not a medical provider, and in most circumstances LuneRx itself is not a HIPAA covered entity. The protected health information (PHI) created during your care — consultation notes, prescriptions, and treatment decisions — is created and held by the independent medical group whose licensed providers conduct consultations, and by the state-licensed partner pharmacy that fills any prescription.
This page summarizes, for transparency, how that PHI is generally used and protected under the Health Insurance Portability and Accountability Act (HIPAA). It is a summary only and is not a substitute for the official notices issued by the entities that hold your records. Their own notices control: [PLACEHOLDER: medical group and pharmacy Notices of Privacy Practices].
Information you submit directly to LuneRx — for example, through forms on this website — is handled as described in our Privacy Policy.
How PHI may be used without your written authorization
HIPAA permits covered entities — here, the independent medical group and the state-licensed partner pharmacy — to use and disclose PHI for a defined set of purposes:
- Treatment. For example, the licensed provider who conducts your consultation may share your prescription and relevant history with the partner pharmacy that fills it, and a pharmacist may contact that provider with a clinical question about your care.
- Payment. For example, using your information to process charges for the care and medication you receive, and to resolve billing questions.
- Health-care operations. For example, quality review, safety monitoring, licensing and accreditation activities, and the administrative work required to run a compliant medical practice or pharmacy.
- As required or permitted by law. For example, public health reporting, responding to lawful requests from authorities, or acting to prevent a serious threat to health or safety.
Uses that require your written permission
Most uses of PHI beyond treatment, payment, and health-care operations require your written authorization first. In particular, PHI is not used for marketing purposes without your authorization, and PHI is never sold.
If you provide an authorization, you may revoke it in writing at any time. Revoking an authorization stops future uses and disclosures, but it cannot undo uses or disclosures already made in reliance on it.
Your rights over your health information
Federal law gives you specific rights with respect to the PHI held by the independent medical group and the partner pharmacy. You may:
- Request access to your records and obtain copies, in electronic or paper form.
- Request an amendment if you believe information in your record is incorrect or incomplete.
- Request an accounting of certain disclosures that have been made of your PHI.
- Request restrictions on how your PHI is used or disclosed. The covered entity is not always required to agree, but every request must be considered.
- Request confidential communications — for example, asking to be contacted only at a specific phone number or address.
- Receive a paper copy of the applicable Notice of Privacy Practices on request, even if you agreed to receive it electronically.
If your information is compromised
Covered entities are required by law to maintain the privacy and security of PHI and to notify affected individuals following a breach of unsecured PHI. If a breach affects your information, you will be notified as required by law, together with information about what happened and steps you can take to protect yourself.
How to raise a privacy concern
If you believe your privacy rights have been violated, you may file a complaint with the privacy contact for the entity that holds your records: [PLACEHOLDER: privacy officer contact]. You may also send general questions to LuneRx at support@lunerx.com and we will direct them to the appropriate party.
You may also file a complaint directly with the U.S. Department of Health and Human Services, Office for Civil Rights, at https://www.hhs.gov/ocr. You will not face retaliation, and your care will not be affected, because you filed a complaint.
When this notice applies
This summary is effective as of [PLACEHOLDER: effective date of this notice]. The independent medical group and the partner pharmacy may update their own Notices of Privacy Practices from time to time, and the current version of each notice governs your care with that entity.