Privacy Policy

1. Introduction and Scope

Journey Care Solutions ("we," "us," or "our") is a licensed mobile wound care provider operating in California. We are committed to protecting the privacy and confidentiality of your personal information. This Privacy Policy describes how we collect, use, disclose, retain, and safeguard information when you visit our website, contact us, or receive services from us.

This Policy applies to information collected through our website, online forms, telephone, email, and in the course of providing wound care services. It applies to all individuals whose information we handle, including patients, website visitors, referring providers, and family members or caregivers who contact us on behalf of a patient.

Please read this policy carefully. If you do not agree with the terms of this privacy policy, please do not access the site or submit personal information to us.

2. Information We Collect

2.1 Information You Provide Directly

We collect personal information when you submit a form on our website, call us, email us, or receive services from us. This may include:

• Contact information: Name, mailing address, phone number, and email address
• Demographic information: Date of birth, sex, and preferred language
• Insurance and billing information: Medicare identification numbers, insurance carrier names, policy or group numbers, and billing addresses
• Medical information: Wound type and history, diagnosis codes, medication lists, treating physician information, and care setting details
• Location information: Home address, facility name, or care location address provided so we can dispatch a clinician
• Referring provider information: Physician or facility name, NPI number, contact information, and fax number
• Communications: Notes, messages, and records of telephone and email communications with us

2.2 Information Collected Automatically

When you visit our website, we may automatically collect certain technical information, including:

• IP address and approximate geographic location derived from IP
• Browser type, version, and operating system
• Referring website URLs and exit pages
• Pages visited, time spent on each page, and clickstream data
• Device type and screen resolution

This information is collected using server logs and similar technologies. It does not directly identify you and is used solely to maintain website security, improve functionality, and understand aggregate usage patterns.

2.3 Cookies and Tracking Technologies

Our website may use essential cookies necessary for the website to function (for example, to remember form entries during a session). We do not use advertising cookies, cross-site tracking cookies, or third-party analytics services that sell or share your data. You may disable cookies through your browser settings; however, some website features may not function properly if cookies are disabled. We do not respond to "Do Not Track" browser signals at this time because we do not engage in the tracking those signals are designed to prevent.

2.4 Information from Third Parties

We may receive information about you from referring physicians, hospitals, skilled nursing facilities, home health agencies, or other healthcare providers who refer you to us for wound care services. We may also receive information from Medicare or insurance carriers as part of eligibility verification and claims processing.

3. How We Use Your Information

We use the personal information we collect for the following purposes:

• To provide wound care services: Scheduling visits, dispatching clinicians, conducting wound assessments, and delivering treatment
• Insurance verification and billing: Verifying Medicare or insurance eligibility, obtaining prior authorizations, submitting claims, and processing payments
• Care coordination: Communicating with your referring provider, primary care physician, facility staff, or care team regarding your wound status and treatment plan
• Clinical documentation: Creating and maintaining clinical records including progress notes, wound measurements, photographs, and plans of care
• Legal and regulatory compliance: Complying with applicable federal and California state laws, including HIPAA, the CMIA, Medicare conditions of participation, and state licensing requirements
• Quality improvement: Evaluating clinical outcomes, identifying service gaps, and improving our care delivery processes
• Communication: Responding to your inquiries, confirming appointments, and providing follow-up care instructions
• Website improvement: Analyzing aggregate website usage data to improve content, navigation, and functionality
• Safety: Detecting, investigating, and preventing fraudulent transactions and other illegal activity

We do not use your personal information for marketing, advertising, or any purpose unrelated to the provision of wound care services or our legal obligations.

4. California Confidentiality of Medical Information Act (CMIA)

As a healthcare provider operating in California, Journey Care Solutions is subject to the California Confidentiality of Medical Information Act (Cal. Civ. Code §§ 56–56.37), which provides protections for medical information that are in some respects more stringent than HIPAA.

4.1 What the CMIA Covers

The CMIA protects "medical information," defined broadly as any individually identifiable information in electronic or physical form relating to a patient's medical history, mental or physical condition, or treatment. This includes wound care records, visit notes, photographs, diagnoses, and any other clinical documentation we create or receive.

4.2 Prohibition on Unauthorized Disclosure

Under the CMIA, we are prohibited from disclosing your medical information to any third party without your written authorization, except in limited circumstances permitted by law (such as treatment, payment, healthcare operations, and legally required disclosures). We will never sell your medical information. We will never disclose your medical information to employers, family members not involved in your care, or marketing companies without your explicit written consent.

4.3 Your Rights Under the CMIA

In addition to your rights under HIPAA, California law provides you with the following rights:

• Right to access: You have the right to inspect and receive a copy of your medical records. We will provide access within five (5) business days of a written request, and provide copies within 15 days.
• Right to correct: You have the right to request amendments to your medical information if you believe it is inaccurate or incomplete.
• Right to an accounting: You have the right to obtain a list of disclosures of your medical information made without your authorization.
• Right to restrict disclosure to health plans: If you pay for a service entirely out of pocket, you may request that we not disclose information about that service to your health plan.
• Damages for violations: California law permits patients to seek actual damages, plus damages of $1,000 to $3,000 per negligent violation, or $3,000 to $150,000 per intentional or negligent violation that results in economic loss or personal injury.

4.4 Mental Health Information

California law provides heightened protection for mental health records. While Journey Care Solutions provides wound care services and does not provide mental health treatment, if any mental health information is incidentally included in your records, it will be treated with the highest level of protection under applicable law.

5. Disclosure of Your Information

5.1 Disclosures We Make Without Authorization

We may disclose your information without your prior written authorization in the following limited circumstances:

• Treatment: To other healthcare providers involved in your care, including your primary care physician, specialists, hospitals, skilled nursing facilities, and home health agencies
• Payment: To Medicare, Medi-Cal, commercial insurance carriers, and their authorized contractors to obtain reimbursement for services
• Healthcare Operations: For our internal quality assurance, compliance, and administrative operations
• Legal requirements: When required by court order, subpoena, warrant, or applicable law
• Public health: To public health authorities for legally required reporting (e.g., communicable disease reporting)
• Health oversight: To government agencies such as CMS, the California Department of Public Health, or the Medical Board of California in connection with oversight activities
• Business Associates: To vendors and service providers who perform functions on our behalf (such as electronic health records systems or billing services), subject to Business Associate Agreements that require them to protect your information
• Serious threats: To prevent or lessen a serious and imminent threat to the health or safety of a person or the public

5.2 Disclosures That Require Your Authorization

We will obtain your written authorization before disclosing your information for marketing purposes, for sale of your information, for research purposes (unless subject to an IRB waiver), or for any other purpose not described in this Policy. You may revoke any authorization in writing at any time, except to the extent we have already relied on it.

5.3 What We Never Do

• We never sell your personal information or medical information to any third party
• We never share your information with data brokers or advertising networks
• We never use your medical information for commercial marketing without explicit written consent
• We never disclose your information to your employer

6. California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA)

California residents have specific rights under the CCPA (Cal. Civ. Code § 1798.100 et seq.) as amended by the CPRA. Note that personal information collected and used solely for treatment, payment, or healthcare operations under HIPAA is exempt from CCPA. However, personal information collected through our website (such as IP addresses, contact form submissions, and technical data) that falls outside of HIPAA's scope is subject to CCPA.

6.1 Categories of Personal Information We Collect (CCPA)

In the preceding 12 months, we have collected the following categories of personal information from website visitors and individuals who contact us:

• Identifiers (name, address, phone number, email, IP address)
• Personal records (insurance numbers, billing information)
• Protected classification characteristics (age, sex)
• Internet or other electronic network activity (browsing history on our site)
• Geolocation data (approximate location from IP address)
• Medical information (for individuals who become or seek to become patients)

6.2 Your CCPA/CPRA Rights

• Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you, the sources, the business purposes, and the third parties with whom we share it
• Right to Delete: You may request deletion of personal information we hold about you, subject to certain exceptions (including our obligation to retain medical records under California law)
• Right to Correct: You may request correction of inaccurate personal information
• Right to Opt-Out of Sale/Sharing: We do not sell or share personal information for cross-context behavioral advertising. No opt-out is required, but you may contact us to confirm
• Right to Limit Use of Sensitive Personal Information: We use sensitive personal information (including medical information) only as necessary to provide the services you have requested
• Right to Non-Discrimination: We will not discriminate against you for exercising any of these rights

To submit a CCPA/CPRA request, contact us at [email protected] or call (818) 465-5772. We will verify your identity before processing the request and respond within 45 calendar days (with a possible 45-day extension with written notice).

You may designate an authorized agent to submit requests on your behalf. We will require written proof of authorization and may require you to verify your identity directly with us.

7. Data Retention

We retain personal information for as long as necessary to fulfill the purposes described in this Policy, comply with applicable law, resolve disputes, and enforce our agreements. Specific retention periods include:

• Medical records (adults): Minimum of 10 years from the date of service, in accordance with California Health & Safety Code § 123111 and CMS conditions of participation
• Medical records (minors): Until the patient's 19th birthday or 10 years from the date of service, whichever is later
• Billing and claims records: Minimum of 7 years, in accordance with Medicare program requirements
• Authorization and consent forms: Retained with the associated medical record
• Website inquiry data (non-patients): 2 years from date of last contact, then securely deleted
• Technical/log data: Up to 12 months, then automatically purged

When records are no longer required to be retained, we destroy them using methods that render the information unreadable and unrecoverable, in compliance with HIPAA and California law.

8. Data Security

We implement administrative, technical, and physical safeguards designed to protect your personal information from unauthorized access, use, disclosure, modification, or destruction. Our security measures include:

• Encrypted transmission of all data via TLS/SSL protocols
• Access controls limiting staff access to information on a need-to-know basis
• Staff training on HIPAA privacy and security requirements
• Business Associate Agreements with all vendors who handle protected health information
• Secure storage of physical records
• Incident response procedures for breach detection and notification

In the event of a breach of unsecured protected health information, we will notify affected individuals in accordance with the HIPAA Breach Notification Rule (45 CFR Part 164, Subpart D) and California law, within the required timeframes (no later than 60 days after discovery for HIPAA; no later than 15 days for breaches affecting 500 or more California residents under Cal. Civ. Code § 1798.29).

9. Children's Privacy

Our website is not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13 through our website. If we learn that we have collected personal information from a child under 13 without parental consent, we will delete that information promptly. If you believe we have collected information from a child under 13, please contact us immediately at [email protected].

We do provide wound care services to pediatric patients when referred by a physician. In those cases, medical information is handled in accordance with HIPAA, the CMIA, and applicable California minor patient privacy laws, including Cal. Health & Safety Code § 123115 regarding parental access rights.

10. Third-Party Links and Services

Our website may contain links to external websites, including the Medicare.gov eligibility portal and other government resources. These third-party websites are not operated by us, and we are not responsible for their privacy practices or content. We encourage you to review the privacy policies of any third-party sites you visit. The inclusion of a link does not imply our endorsement of that site.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, applicable law, or regulatory guidance. When we make material changes, we will update the effective date at the top of this page. For significant changes, we may also provide notice through our website or by direct communication. Your continued use of our website or services after changes are posted constitutes your acceptance of the revised Policy.

We recommend reviewing this Policy periodically. The current version is always available at this URL.

12. How to Exercise Your Rights and Contact Us

To exercise any of the rights described in this Policy, file a privacy complaint, request your records, or ask questions about our privacy practices, please contact our Privacy Officer:

Journey Care Solutions — Privacy Officer
21405 Devonshire St #207
Chatsworth, CA 91311
Phone: (818) 465-5772
Fax: (818) 465-9213
Email: [email protected]

We will acknowledge receipt of your request within 5 business days and provide a substantive response within the timeframe required by applicable law. We will never retaliate against you for exercising your privacy rights.

If you are not satisfied with our response, you may file a complaint with:

• U.S. Department of Health and Human Services, Office for Civil Rights: www.hhs.gov/ocr or 1-877-696-6775
• California Privacy Protection Agency: cppa.ca.gov
• California Attorney General: oag.ca.gov/privacy