Privacy Policy

Notice of privacy practices for protected health information

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

Arilon Corp d/b/a MOY Health (“MOY Health,” “MOY,” “we,” “us” or “our”) issues this Privacy Policy and Notice of Privacy Practices. It explains how we collect, use, maintain and share personal information and protected health information, also called PHI, in connection with our website and services.

We are responsible for protecting the information we maintain and for carrying out the privacy practices described in this notice. We must comply with applicable privacy laws, provide you with this notice and follow its terms.

Our services and this notice

MOY Health operates at trymoy.com and uses the Bask Health platform to support its patient intake, accounts and related services.

Clinical care is delivered through Arora Health and Aesthetics. Licensed physicians make clinical and prescription decisions. State-licensed pharmacies fill prescriptions when issued.

This notice describes Arilon Corp d/b/a MOY Health’s information practices. Affiliated physicians and pharmacies also have independent responsibilities concerning information they maintain and may provide their own privacy notices.

Information we collect

Personal and account information

We collect information you provide when you use our services, including your name, email address, telephone number, mailing and shipping addresses, date of birth, and account and billing information.

Health information

We collect health information supplied through your intake, assessments and care communications. This may include your medical history, conditions, symptoms, allergies, medications, supplements, treatment history and other information relevant to your care.

We may also receive information from the physicians and pharmacies involved in your treatment, as permitted by law.

Payment information

Payment information is processed through our payment-processing services to complete transactions and manage billing.

Website usage information

We may collect your IP address, browser type, operating system, pages visited and interactions with our website.

How we use and share information

We use information to operate our services, administer patient accounts, coordinate clinical review and prescription fulfillment, process payments, communicate with you, respond to support requests, improve our services and meet legal obligations.

We may share information with affiliated physicians, dispensing pharmacies, Bask Health, payment processors and other organizations that perform services on our behalf. Access and use are subject to applicable law and contractual requirements.

We do not sell your personal information.

The following sections describe permitted uses and disclosures of PHI. Each disclosure remains subject to applicable legal conditions, including additional protections for sensitive records.

Uses and disclosures of protected health information

Treatment

We may use and disclose PHI to support the provision, coordination or management of your healthcare and related services.

For example, information submitted through your intake may be shared with an affiliated physician for clinical review or with a dispensing pharmacy to fulfill a prescription.

Payment

We may use and disclose PHI to obtain payment for healthcare services and related services provided to you.

For example, we may use information about your services to process charges, manage billing or resolve payment questions. Disclosures to insurers or other payers, when applicable, are subject to legal requirements and any restrictions we must honor.

Healthcare operations

We may use and disclose PHI for activities such as quality assessment, service improvement, case management, accreditation, licensing, credentialing, medical reviews, audits and legal services.

For example, information may be used to review how patient requests are handled and improve the coordination of care.

Required by law

We may use or disclose PHI when federal, state or local law requires it. This includes disclosures to the U.S. Department of Health and Human Services for reviews of compliance with federal privacy law.

Public health and safety

We may disclose PHI for legally permitted purposes, including preventing or controlling disease, reporting medication reactions or product problems, reporting suspected abuse or neglect, and preventing or reducing a serious threat to health or safety.

Health oversight

We may disclose PHI to authorized oversight agencies for audits, investigations, inspections, licensing and other activities authorized by law.

Legal proceedings

We may disclose PHI in response to a court or administrative order or other lawful process. A subpoena or other request does not automatically permit disclosure. We must satisfy the legal conditions that apply.

Law enforcement and government functions

We may disclose PHI for law enforcement purposes, military activities, national security or other government functions when permitted or required by law.

If you are in custody, we may disclose PHI to a correctional institution or responsible law enforcement official when legally permitted.

Research

We may use or disclose PHI for research when applicable legal requirements are met, including any required authorization or approval by an institutional review board or privacy board.

Organ donation and deceased individuals

We may disclose PHI to organizations involved in organ or tissue donation, or to coroners, medical examiners and funeral directors, when permitted by law.

Workers’ compensation

We may disclose PHI for workers’ compensation or similar programs that provide benefits for work-related injuries or illnesses, as permitted by law.

Additional protections for substance-use-disorder records

If we receive or maintain substance-use-disorder records protected by 42 CFR Part 2, those records receive additional confidentiality protections.

We will not use or disclose those records in civil, criminal, administrative or legislative investigations or proceedings against you without your written consent or the court order and subpoena required by law.

These protections apply to the uses and disclosures described throughout this notice. A general permission to disclose other health information does not remove the additional protections for Part 2 records.

If Part 2 information is ever used for legally permitted fundraising communications, you will receive clear advance notice and a choice about receiving those communications.

Your choices and written authorization

You may tell us whether you want relevant information shared with family, friends or others involved in your care or payment for your care. You may also express preferences concerning disclosures for disaster relief.

If you cannot communicate your preference, information may be disclosed as permitted by law based on professional judgment about your best interests or a serious threat to health or safety.

Uses or disclosures that require written authorization include most uses and disclosures of psychotherapy notes, marketing uses that require authorization, and any sale of PHI. MOY Health does not sell your PHI.

Other uses and disclosures not described in this notice will require your written authorization unless otherwise permitted or required by law.

You may revoke an authorization in writing. Revocation does not undo actions already taken in reliance on your authorization.

Your rights concerning protected health information

Contact our Privacy Officer using the details below to exercise these rights. We may verify your identity or your authority to act for another person.

Inspect or receive a copy

You may request access to or a copy of PHI in the records used to make decisions about you, subject to limited legal exceptions.

You may request an electronic copy when available. We generally respond within 30 days. If a legally permitted extension is necessary, we will explain the reason and expected response date in writing.

Any fee will be reasonable, cost-based and permitted by law.

Request an amendment

You may request an amendment if you believe information is incorrect or incomplete. Explain what you want amended and why.

We may deny a request for reasons allowed by law, including when the information is accurate and complete. We generally respond within 60 days. We will explain any denial and your right to submit a statement of disagreement.

Request confidential communications

You may ask us to communicate with you in a particular way or at a different location. We will accommodate reasonable requests as required by law.

Request restrictions

You may request limits on how PHI is used or disclosed for treatment, payment or healthcare operations. We are not required to accept every request, but we will consider it.

If we agree to a restriction, we will honor it subject to exceptions allowed by law, such as emergency treatment.

If you pay for a healthcare item or service entirely out of pocket, you may request that information about it not be disclosed to your health plan for payment or healthcare operations. We must honor that request unless disclosure is required by law.

Receive an accounting of disclosures

You may request an accounting of certain disclosures made during the six years preceding your request.

Disclosures for treatment, payment and healthcare operations, disclosures you authorized, and other legally excluded disclosures generally do not appear in the accounting.

One accounting in a 12-month period is free. We may charge a reasonable, cost-based fee for additional requests during that period, after notifying you.

Receive a paper copy

You may request a paper copy of this notice at any time, even if you agreed to receive it electronically.

Choose someone to act for you

A person legally authorized to act for you, such as a legal guardian or someone holding a valid medical power of attorney, may exercise your rights within the scope of that authority.

We will verify that authority before acting on a request.

Receive breach notification

You have the right to receive notification when required by law following a breach of unsecured PHI.

Make a complaint without retaliation

You may complain to our Privacy Officer if you believe your privacy rights have been violated.

You may also file a complaint with:

U.S. Department of Health and Human Services
Office for Civil Rights
200 Independence Avenue SW
Washington, DC 20201
Telephone: 1-877-696-6775
Submit a privacy complaint

We will not retaliate against you for filing a complaint.

Storage, security and transmission

We maintain information electronically through the systems used to operate MOY Health, including the Bask Health platform.

We use administrative, physical and technical safeguards designed to protect personal information and PHI. Electronic transmission of PHI must comply with applicable security requirements, including appropriate encryption and access controls.

We retain information as required to support services and meet applicable recordkeeping obligations. No system can guarantee absolute security.

State-specific protections

When applicable state law provides greater privacy protections than federal law, we follow the more protective requirements.

California

We comply with the California Confidentiality of Medical Information Act and other applicable California laws. These may provide additional protections concerning access to medical information, sensitive records, marketing, disclosure authorization and information about services to which a minor may independently consent.

The right to request a restriction on health-plan disclosure after paying entirely out of pocket is also a federal HIPAA right, as described above.

New York

We follow applicable New York requirements concerning HIV-related information, mental health records and genetic information. We obtain written consent before disclosure when required, subject to applicable exceptions.

Texas

We follow the Texas Medical Records Privacy Act and other applicable Texas requirements concerning medical information, electronic disclosures, sensitive records and secure disposal.

Florida

We follow applicable Florida protections concerning medical records, mental health information, HIV-related information and substance-use-disorder records. We obtain consent where required by law.

Illinois

We follow applicable Illinois protections concerning mental health records, HIV-related information, genetic information and breach notification. We obtain consent where required by law.

Massachusetts

We follow applicable Massachusetts requirements concerning medical records, mental health information, HIV-related information, genetic information and information security. We obtain consent where required by law.

Other states

Additional protections may apply in other states. Contact our Privacy Officer for help exercising rights that apply to your information.

Children’s privacy

MOY Health’s services are intended for adults aged 18 and older. We do not knowingly collect personal information directly from children under 18 through our treatment intake.

Our responsibilities

We must protect PHI as required by applicable law, provide this notice and follow the privacy practices described in it.

We must notify affected individuals of breaches when required by law. We must also ensure that uses and disclosures have an appropriate legal basis and respect applicable restrictions and authorizations.

Changes to this notice

We may revise this notice. Where permitted by law, revised practices may apply to information we already maintain and information received in the future.

The current version will be available at trymoy.com/privacy-policy and upon request. Its effective date appears at the top of the page.

Contact information

To ask a privacy question, exercise a right, request a paper copy or submit a complaint, contact:

Privacy Officer
Arilon Corp d/b/a MOY Health
30 N Gould St Ste R
Sheridan, WY 82801
Email: support@trymoy.com
Website: trymoy.com
Telephone: (307) 218-3882