Privacy Policy

1. Introduction

Integrated Solutions Link App, LLC ("ISLA," "we," "us," or "our") is an Arizona limited liability company that provides a patient-centered digital healthcare hub application (the "App" or "Service"). ISLA is designed to help patients access, organize, and manage their own healthcare information by connecting, with the patient's authorization, to healthcare data sources such as the Centers for Medicare & Medicaid Services ("CMS") Blue Button 2.0 program, and, as the Service expands, additional payers, providers, electronic health record systems, and healthcare information networks.

This Privacy Policy explains what information ISLA collects, how it is used, how it is protected, how patients can control and revoke access to their information, and the rights available to users of the Service. Please read this Policy carefully. By using the App, you agree to the practices described here.

2. ISLA's Regulatory Status Under HIPAA

ISLA is a consumer-facing technology application. ISLA does not provide medical advice, diagnosis, or treatment; information displayed within the App is provided for informational purposes to help patients access and understand their own healthcare information, and should not be relied upon as a substitute for professional medical judgment.

A user directing their own healthcare information to the ISLA platform does not, by itself, make ISLA a "covered entity" under the Health Insurance Portability and Accountability Act ("HIPAA"). However, depending on the services ISLA provides, the organizations with which ISLA contracts, and the manner in which information is received, processed, or used, ISLA may become subject to HIPAA or other healthcare privacy and security obligations in particular circumstances. For example, as ISLA's connections expand to include providers, payers, electronic health record systems, health information networks, or services performed on behalf of healthcare organizations, ISLA could become a HIPAA "business associate" with respect to those specific relationships, even where ISLA does not itself become a covered entity.

Regardless of ISLA's classification under HIPAA at any given time, ISLA is committed to protecting the privacy and security of the healthcare information entrusted to it, as described throughout this Policy. Where ISLA's obligations under HIPAA, applicable state law, or CMS data use requirements change as the Service evolves, this Policy will be updated accordingly.

3. Information We Collect

3.1 Information You Provide Directly

• Account information, such as your name, email address, and login credentials.
• Any information you voluntarily enter into the App.

3.2 Healthcare Information Retrieved With Your Authorization

When you choose to connect a healthcare data source to your ISLA account (for example, by authorizing ISLA to retrieve information from CMS Blue Button 2.0 through the OAuth 2.0 authorization process), ISLA retrieves and stores healthcare information made available through that connection, which may include:

• Patient demographic information (such as name and identifiers necessary to match your records).
• Coverage and insurance/benefit information.
• Explanation of Benefits (EOB) records, including claims-related information.
• Other healthcare resource types made available through connected sources as ISLA's supported connections expand over time.

This information is retrieved only after you have completed the applicable authorization process with the data source (for example, the CMS Blue Button consent screen), and only for the scope of data you authorize.

3.3 Technical and Usage Information

• Device and app diagnostic information (such as crash reports) used to maintain and improve the Service.
• Basic usage information, such as which features of the App are used, to help us understand and improve the onboarding and connection experience.

4. How We Use Information

• To operate the App and display your healthcare information back to you within your personal hub.
• To maintain a synchronization history and let you know when information was last retrieved, including clearly distinguishing currently retrieved ("live") information from previously retrieved ("cached" or "read-only") information when a data source is temporarily unavailable.
• To maintain your consent and authorization records, including a record of when you connected, revoked, or reconnected a data source.
• To provide customer support and respond to your questions.
• To maintain the security, integrity, and reliability of the Service.
• To comply with applicable law and respond to lawful requests.

ISLA does not sell your healthcare information. ISLA does not share your healthcare information with third parties for their own marketing purposes.

5. Your Consent and Control Over Connections

ISLA is built around the principle that you control which healthcare data sources are connected to your account. Before ISLA retrieves information from a source such as CMS Blue Button, you must complete that source's own authorization process, during which you may review and either grant or decline the requested access.

Once connected, you may disconnect (revoke) a data source at any time within the App. When you revoke a connection:

• ISLA will attempt to notify the data source of the revocation where the applicable protocol supports it.
• ISLA's records will reflect whether revocation was confirmed by the source itself, or was processed on ISLA's side only (for example, if the source does not provide revocation confirmation, or is temporarily unavailable).
• You may reconnect a previously revoked source at any time by repeating the authorization process.

ISLA maintains an append-only consent history so that you can review your connection, revocation, and reconnection activity for each connected source.

6. Data Retention

ISLA retains different categories of information for different periods of time, depending on the nature and purpose of that information (for example, active healthcare records you have chosen to retain within your hub, synchronization and audit history, and security logs). Retention periods for each category will be described in ISLA's data retention schedule, made available to users upon request and, where required, incorporated into this Policy.

If you delete your ISLA account, we will delete or de-identify your healthcare information in accordance with our data retention schedule and applicable law, except where retention is required for legal, security, or audit purposes.

7. How We Protect Your Information

• Encryption of healthcare information in transit and at rest.
• OAuth 2.0 and PKCE-based authorization for connections to healthcare data sources, rather than storing your data source login credentials.
• Access controls limiting which systems and personnel may access stored healthcare information.
• Audit logging of synchronization activity and consent events.
• Isolation of each patient's records so that one user's healthcare information is not accessible to another user.

No method of electronic storage or transmission is completely secure. While ISLA works to protect your information using administrative, technical, and physical safeguards, we cannot guarantee absolute security.

8. Sharing of Information

ISLA does not sell your personal or healthcare information. ISLA may share information:

• With service providers who perform functions on ISLA's behalf (such as hosting or infrastructure providers), under confidentiality and data protection obligations.
• With the healthcare data sources you have authorized, solely to the extent necessary to establish and maintain the connection you requested.
• Where required by law, subpoena, or other legal process.
• In connection with a merger, acquisition, or sale of assets, subject to continued protection of your information under materially similar terms.

9. Your Rights

Depending on your location and applicable law, you may have the right to:

• Access the healthcare and account information ISLA holds about you.
• Request correction of inaccurate information.
• Request deletion of your account and associated information, subject to Section 6 above.
• Revoke authorization for any connected data source at any time.
• Request a copy of your consent history.

To exercise these rights, contact us using the information in Section 12.

10. Children's Privacy

The Service is not directed to individuals under the age of 18, and ISLA does not knowingly collect information from children. If you believe a child has provided information to ISLA, please contact us.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated within the App or by other reasonable means before they take effect. Continued use of the Service after changes become effective constitutes acceptance of the updated Policy.

12. Contact Us

If you have questions about this Privacy Policy or ISLA's privacy practices, please contact:

Integrated Solutions Link App, LLC (ISLA)
Maricopa County, Arizona
Email: ckuhlman@integratedsolutionslinkapp.com