Privacy Policy


UTM Healthcare, LLC


PRIVACY POLICY
Patients’ privacy is extremely important to UTM Healthcare (“UTMH”). This Privacy Policy
(“Policy”) governs the use of UTMH’s patient interfacing software, whether provided through a web site, dedicated applications and/or various cloud services (collectively, the “UTMH Service”). This Policy explains how we use, disclose and secure information collected by UTMH’s Service. Please review it carefully.

Some of the information collected by UTMH is personal information. In general terms, “personal information” is information that the patient or someone acting on the patient’s behalf submits to UTMH and which identifies the patient or can be used to contact the patient, such as name, address, email address, phone number, social security number, and insurance-issued ID numbers.
UTMH sometimes combines non-personal information with other information in a way that makes the combined information personal information. UTMH treats this combined information as if it were all personal information. UTMH does not consider Personal Information to include information that has been anonymized so that it does not allow a third party to easily identify a specific
individual.


CONFIDENTIALITY OF HEALTH INFORMATION
Some of the users of UTMH’s Service – such as healthcare providers – are subject to laws and regulations governing the use and disclosure of personal health information that they create or receive from other sources. Included among those laws are the Health Insurance Portability and Accountability Act of 1996, the Health Information Technology for Economic and Clinical Health Act of 2009 and the applicable regulations (collectively referred to as “HIPAA”).

When UTMH stores, processes or transmits “individually identifiable health information” (as that term is defined in HIPAA) on behalf of a healthcare provider who has entered into a user agreement with us, we do so as the provider’s “business associate,” as that term is defined in HIPAA. As a business associate, UTMH is prohibited from using individually identifiable health information to the same extent that the healthcare provider itself is prohibited from using it.

UTMH is required to take appropriate measures to safeguard the confidentiality, integrity and availability of individually identifiable health information which it collects, stores and processes on behalf of such providers.

METHODS OF COLLECTING DATA
User-Provided Information
The UTMH Service obtains user information when individuals use the UTMH Service and input or otherwise transmit information into the UTMH Service.

When individuals register with UTMH and use UTMH’s Service, UTMH obtains the following information:
(a) Name, email address, age, password and other registration information.
(b) Information recorded in the individual’s electronic health record and provided by the healthcare provider.

(c) Information the individual enters into the system when using UTMH’s Service.

Information gathered during the use of the UTMH Service is intended to be used by the healthcare provider to render services to patients using the UTMH Service. UTMH may also use the information provided to contact patients from time to time to provide important information and required notices.

Automatically Collected Information
UTMH’s Service may collect certain information automatically from the computer, mobile phone or tablet being used, including, but not limited to, the type of device used, the unique device ID, the IP address of the device, operating system type, the language the system uses, the type of Internet browsers used, location-based information (e.g., country and time zone) and
information about the way UTMH’s Service is used. Generally, this sort of data does not personally identify any particular user. Nevertheless, such data can be used in conjunction with personal information. In these circumstances, UTMH treats such combined information as personal information.

UTMH also uses cookies and other technological tools to enhance the quality of the UTMH Service by allowing us to do such things as save user preferences, help authenticate users, and debug and evaluate the performance of the UTMH Service.

USE AND SHARING OF YOUR INFORMATION
We use non-personal information for evaluating the performance of the UTMH Service, developing additional features and services, delivery of cookie-based content and for other purposes described in this Policy or in your End User Licensing Agreement.

With regard to personal information, UTMH appreciates its sensitivity and the need to limit its disclosure. Accordingly, we limit when we share personal Information as follows:

  • As required by law, such as to comply with a subpoena, search warrant, court order, judicial proceeding or similar legal process;
  • When UTMH obtains express consent;
  • Patients’ healthcare providers will have access to their own patients’ UTMH account information,
    including personal information and may: (i) receive and store account information in their own
    system; or (v) access or retain, for any purpose authorized by
    applicable law, any information patients provide or otherwise store as part of the patient’s UTMH
    account; and
  • When UTMH provides such information to trusted service providers and vendors who work on our
    behalf and have agreed to adhere to the rules set forth in this Policy and applicable law. These
    trusted service providers will execute legally binding business associate agreements as
    appropriate, setting forth their confidentiality and security
    obligations.

HIPAA AND HITECH COMPLIANCE
This Privacy Policy and the security practices described in it are intended to comply with HIPAA as amended from time to time. As such we maintain protected health information (PHI) in compliance with these rules and our contractual obligations with the healthcare providers that are “Covered Entities” under the federal healthcare privacy and security rules.

CONSENTS AND AUTHORIZATIONS
UTMH may request consent or authorization in connection with its own use of or its sharing of personal information with others, either because this Policy or applicable laws and regulations require us to obtain such consent or we deem such consent to be appropriate. No request by UTMH to obtain consent in any way narrows the scope or applicability of this Policy. By using the UTMH Service, individuals accept and agree to UTMH’s use and disclosure of information as described in this Policy.

Because the purpose of the UTMH Service is to allow users to share information, users should take care in selecting the persons with whom their share their personal and health information. UTMH takes no responsibility or assumes any liability for the actions of other users or persons with whom you share such information.

In some instances, UTMH may use tools (e.g., “cookies”) in its emails to users to collect usage information, such as the device (i.e., computer, mobile device or tablet) that is being used to communicate with the UTMH Service. By doing so, we can track resources and data accessed within the UTMH Service per visitor, record general statistics and activity, and assist users who may be experiencing problems with our UTMH Service. Our purpose in doing all of this is to provide the best possible service. In any event, cookies do not identify a specific user and are not used to collect any personal information. Moreover, cookie information may be disabled at any time by adjusting browser preferences on the personal device being used.

COPPA
With regard to COPPA (Children’s Online Privacy Protection Act), we do not seek to collect any information from anyone under 13 years of age. Our UTMH Service, products and services are all directed to adults (18 years of age or older).

UTMH does not knowingly collect personal information from children. If UTMH learns that it has obtained personal information from a child, UTMH will delete that information as soon as practicable. If any user discovers that their child has provided us with personal information without consent, UTMH must be contacted immediately.

While observing any applicable provisions of COPPA, the UTMH Service does not prevent persons above the age of 18 years – such as healthcare providers, parents and guardians – to provide, share and store personal information about others, including minors and children. Any user providing, storing or submitting information on behalf of a child assumes full responsibility for the submission, use and transmission of such information.

SECURITY AND SAFETY OF THE UTMH WEBSITE
UTMH employs technical measures to help safeguard the confidentiality, integrity and availability of personally identifiable information stored and shared through the UTMH Service. Applicable law requires us to investigate potential or suspected threats to the UTMH Service and to the confidentiality, integrity or availability of the information which UTMH stores. UTMH may use,
retain and disclose information – including personal and non-personal information – when it has a good-faith belief that it is necessary or advisable in order to:

  • detect, prevent and address potential or suspected threats to the UTMH Service or the
    confidentiality, integrity or availability of any information we store on our UTMH Service;
  • to detect, prevent and otherwise deal with illegal activity;
  • to detect, prevent and otherwise deal with violations of the terms of use of the UTMH Service by
    which all users are bound by consenting and agreeing to this Policy, by using the UTMH Service, and
    by entering into end-user and such other binding agreements as UTMH may require; and
  • to otherwise protect UTMH, its users and third parties.
    As stated above, UTMH may also use, preserve and disclose such information as required by law,
    e.g., to comply with a subpoena or similar legal process. The governmental entity initiating such
    legal process may prohibit UTMH from notifying the users or other individuals or entities
    identified in the requested information or take other actions that would otherwise be a violation
    of this Policy. UTMH may for these reasons preserve information from both active and disabled
    accounts for extended periods of time as necessary to comply with applicable law or as it deems
    appropriate under the circumstances.

UTMH utilizes and periodically evaluates the effectiveness of a number of technical, physical and administrative measures to prevent unauthorized access to its UTMH Service, maintain data accuracy and ensure the appropriate use of personal and non-personal information. These measures include firewalls, system alerts, and the use of industry-standard encryption technology. We also house such information in secure facilities that restrict physical and network access. UTMH applies what it regards as reasonable and accepted measures widely used in the IT industry to protect the confidentiality, integrity and availability of individually identifiable health information residing on and processed by the UTMH Service. No security system, however, can be expected to prevent all potential security breaches no matter what technology is used.

UTMH may notify you and inform you of potential countermeasures if UTMH learns of a security vulnerability or risk. UTMH strongly encourages you to be conscientious in using well-known and readily available technology to improve the security of your own system and devices.

ACCESS LIMITED TO U.S. USERS
Access to the UTMH Service is administered in the United States and is intended solely for users within the United States, unless UTMH in advance and in writing authorizes specific users in specified locations outside of the United States who have executed such binding legal agreements and other documentation as UTMH may require. Access by foreign nationals to systems located in the United States constitutes the exportation of technology under applicable U.S. law and may require compliance with U.S. export controls.

Under no circumstances should the UTMH Service be used in any jurisdiction where accessing or using the UTMH Service would violate U.S. law or any other law. Any information that submitted to us while outside of the United States will be transferred to UTMH systems that reside in the United States. Users hereby consent to any such transfer of non-personal and personal information when the UTMH Service is used and such information is provided to us.

UPDATES AND REVISIONS TO THIS POLICY
UTMH may update and otherwise revise this Privacy Policy from time to time as it deems necessary. The most current version of this Policy will be posted on UTMH’s web site along with the new effective date. It is your responsibility to review this Policy periodically on the UTMH Service to see if there have been any changes that affect you. Use of the UTMH Service, including the continued storage of information on UTMH systems, following any such change constitutes your agreement that all information collected through the UTMH Service will be
subject to the terms of the revised Policy.

CORRECTING, UPDATING, AND DEACTIVATING INFORMATION
UTMH complies with all laws regarding access to and correction of your information. The UTMH Service provides you with access to the information you submit and the means to correct and update it. If you have an online account with us, you can log into your account at any time to access and update your information. Likewise, health care providers may contact UTMH to
update patient information.

If you desire to deactivate your account, please have your healthcare provider contact us, whereupon UTMH will deactivate your account and archive your personal information and records. UTMH may retain archived information for a period of up to six years or as necessary to comply with legal obligations, resolve disputes, enforce our agreements and engage in other health care operations authorized by applicable law and this Policy. All archived information shall
continue to be subject to the confidentiality and security obligations and restrictions set forth in this Policy. Upon the expiration of the applicable retention period, UTMH will delete and destroy any personal information and records it has in its possession and control. If you have any questions about this Policy or information security, please contact us at info@utmhealthcare.com.

Last updated June 30, 2026.

Appendices:
A. Standard Operating Procedures for Internal Managers and IT Staff
B. Employee Acknowledgement of Standard Operating Procedures & Patient Privacy
Policy