Notice of Privacy Practices
HALE - A Hale Health LLC Service
Effective Date: January 10, 2026
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
About This Notice
Hale is a personal health assistant application provided by Hale Health LLC. We are committed to protecting the privacy and security of your Protected Health Information (PHI) as required by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its implementing regulations.
This Notice of Privacy Practices describes how we may use and disclose your PHI, your rights regarding your PHI, and our obligations to protect your PHI. This Notice applies to all PHI we create, receive, maintain, or transmit through the Hale application.
Our Commitment to Your Privacy
We are required by law to maintain the privacy of your PHI, provide you with this Notice of our legal duties and privacy practices, notify you following a breach of unsecured PHI, and follow the terms of the Notice currently in effect.
What is Protected Health Information (PHI)?
PHI is information that identifies you and relates to your past, present, or future physical or mental health, healthcare services, or payment for healthcare. In the context of Hale, your PHI may include:
- Health conditions and symptoms you track
- Medications and supplements you log
- Lab results and medical documents you upload
- Health-related questions and conversations with the AI assistant
- Appointment and provider information
- Any other health information you provide through the application
How We May Use and Disclose Your PHI
Treatment
We may use your PHI to provide you with health-related services through Hale, including AI-powered health guidance, medication interaction checking, symptom analysis, and lab result interpretation. This helps you better understand and manage your health conditions.
Payment
We may use limited information to process your subscription payments through our payment processor. Payment processing does not require access to your health information. We do not share your PHI with payment processors.
Healthcare Operations
We may use your PHI for activities that support our operations and improve our services, including:
- Quality assessment and improvement
- Customer support to resolve issues with your account
- Training staff on privacy and security requirements
With Your Authorization
Other uses and disclosures of your PHI not described in this Notice will only be made with your written authorization. You may revoke any authorization at any time by contacting us, except to the extent that we have already taken action based on your authorization.
As Required or Permitted by Law
We may use or disclose your PHI without your authorization in certain situations, including:
- When required by federal, state, or local law
- For public health activities (e.g., reporting diseases)
- To report suspected abuse, neglect, or domestic violence
- For health oversight activities
- In response to a court order or subpoena
- To law enforcement under limited circumstances
- To avert a serious threat to health or safety
- For specialized government functions (military, national security)
Our Business Associates
We contract with certain third-party service providers (Business Associates) who may have access to your PHI to help us provide services. All Business Associates are required to sign agreements that obligate them to protect your PHI in accordance with HIPAA. Our Business Associates include:
- Amazon Web Services (AWS) - Cloud hosting and AI processing (AWS Bedrock)
All Business Associates are contractually prohibited from using your PHI for their own purposes, including training AI models.
AI Processing of Your Health Information
Hale uses artificial intelligence (AI) to provide personalized health guidance. When you use AI features:
- Your PHI may be sent to AI services operated by our Business Associates under signed agreements
- AI providers do not retain your PHI after processing (zero data retention)
- Your PHI is never used to train AI models
- All data is encrypted in transit
Important: AI-generated content is for informational purposes only and is not a substitute for professional medical advice, diagnosis, or treatment. Always consult with qualified healthcare providers for medical decisions.
Marketing and Sale of PHI
- We will never sell your PHI.
- We will not use or disclose your PHI for marketing purposes without your written authorization.
Your Rights Regarding Your PHI
Under HIPAA, you have the following rights with respect to your PHI:
Right to Access: You have the right to inspect and obtain a copy of your PHI. We will respond to your request within 30 days. We may charge a reasonable fee for copying and mailing costs. You can export your data directly through the Hale application at any time.
Right to Amend: You have the right to request that we amend your PHI if you believe it is incorrect or incomplete. We may deny your request in certain circumstances, and if we do, we will explain why in writing.
Right to an Accounting of Disclosures: You have the right to receive a list of certain disclosures we have made of your PHI. This does not include disclosures made for treatment, payment, healthcare operations, or disclosures you authorized.
Right to Request Restrictions: You have the right to request restrictions on how we use or disclose your PHI. We are not required to agree to your request, but if we do, we will honor it except in emergencies.
Right to Confidential Communications: You have the right to request that we communicate with you about your PHI in a certain way or at a certain location. We will accommodate reasonable requests.
Right to a Paper Copy: You have the right to obtain a paper copy of this Notice upon request.
Right to Revoke Authorization: If you have provided us with written authorization to use or disclose your PHI, you may revoke that authorization at any time by contacting us in writing.
Breach Notification
In the event of a breach of your unsecured PHI, we will notify you within 60 days of discovering the breach. The notification will include a description of what happened, the types of information involved, steps you should take to protect yourself, what we are doing to investigate and mitigate the breach, and contact information for questions.
Complaints
If you believe your privacy rights have been violated, you may file a complaint with us or with the Secretary of the U.S. Department of Health and Human Services. We will not retaliate against you for filing a complaint.
To file a complaint with us:
Hale Health LLC
Email: privacy@hale.med
To file a complaint with the U.S. Department of Health and Human Services:
Office for Civil Rights
U.S. Department of Health and Human Services
200 Independence Avenue, S.W.
Washington, D.C. 20201
Toll-free: 1-877-696-6775
Website: www.hhs.gov/ocr/privacy/hipaa/complaints
Changes to This Notice
We reserve the right to change this Notice at any time. Any changes will apply to PHI we already have about you as well as any PHI we receive in the future. The revised Notice will be posted on our website at hale.med/hipaa-notice and will be available through the application. The effective date of this Notice is listed at the top of the page.
Contact Information
If you have any questions about this Notice or want to exercise any of your rights, please contact:
HIPAA Privacy Officer
Hale Health LLC
Email: privacy@hale.med
Acknowledgment of Receipt
By using Hale, you acknowledge that you have received and reviewed this Notice of Privacy Practices. A copy of this Notice is available at any time at hale.med/hipaa-notice or by contacting us.