Current Version — Effective Immediately
Daily Wellness Check ("Daily Wellness Check," "we," "us," "our") is committed to
protecting your privacy. This Privacy Policy explains how we
collect, use, disclose, and safeguard your personal information and
Protected Health Information (PHI) when you use our website, mobile
application, and healthcare services across the United States, in
compliance with HIPAA and applicable state and federal laws.
1. Information We Collect
1.1 Personal Identification: Your full name, date
of birth, Social Security Number (when required for insurance or
regulatory purposes), government-issued ID, gender, mailing address,
email addresses, and phone numbers provided during registration or
communications.
1.2 Protected Health Information: Medical history,
current diagnoses, medications and dosages, allergies, immunization
records, lab and diagnostic results, treatment plans, physician
notes, mental health records, biometric data (height, weight,
vitals), and genetic testing results collected as part of your care.
1.3 Insurance Information: Insurance carrier name,
policy and group numbers, member IDs, subscriber details, dependent
information, claims history, explanation of benefits, and coverage
verification data.
1.4 Financial Data: Credit and debit card numbers
(tokenized at point of entry), bank account details for ACH, billing
address, payment transaction records, and outstanding balance
history.
1.5 Technical Data: IP address, geolocation data,
device identifiers, browser type and version, operating system,
screen resolution, pages visited, time on page, click patterns,
referral source, and cookie identifiers.
1.6 Communication Records: All emails, chat
transcripts, support tickets, recorded phone calls (with your
consent), telehealth session metadata, and SMS message logs between
you and our team.
1.7 User-Generated Content: Profile photos, health
questionnaire responses, symptom journals, fitness tracking data,
dietary logs, wellness assessments, and reviews or feedback
submitted through our platform.
2. How We Use Your Information
2.1 Healthcare Delivery: Diagnosing conditions,
developing treatment plans, prescribing medications, ordering and
interpreting labs, coordinating specialist referrals, managing
chronic conditions, and conducting preventive screenings.
2.2 Care Coordination: Sharing relevant medical
data between providers on your care team, facilitating referrals,
maintaining unified health records across in-person and virtual
visits, and ensuring continuity of care.
2.3 Scheduling Operations: Booking and managing
appointments, sending reminders and confirmations, managing provider
availability, processing waitlists, and optimizing scheduling
efficiency.
2.4 Insurance & Billing: Verifying eligibility,
obtaining prior authorizations, submitting claims, processing
payments and refunds, handling billing disputes, and managing
payment plans.
2.5 Communications: Sending transactional messages
(appointments, results, prescriptions, billing) and promotional
content (newsletters, health tips, service announcements, offers)
based on your preferences.
2.6 Platform Improvement: Analyzing usage patterns,
conducting A/B testing, improving UX, training symptom checker
algorithms, debugging, and personalizing content delivery.
2.7 Legal Compliance: HIPAA documentation,
responding to subpoenas and court orders, cooperating with
regulatory audits, reporting to public health authorities, and
maintaining compliance records.
3. Data Sharing & Disclosure
3.1 Treatment Partners: PHI shared with physicians,
specialists, pharmacists, therapists, and lab technicians involved
in your direct care under a HIPAA treatment relationship.
3.2 Payment Processors: Financial data shared with
our PCI-DSS Level 1 certified payment processor for transaction
execution. Card numbers are tokenized and never stored on our
servers.
3.3 Insurance Carriers: Clinical and administrative
data disclosed to your insurer for claims processing, utilization
review, and coverage determination as required by your policy.
3.4 Business Associates: Data shared with vetted
third parties under executed Business Associate Agreements including
cloud hosting (AWS), EHR systems, lab partners, pharmacy networks,
and analytics providers.
3.5 Public Health Reporting: Reportable diseases,
immunization data, adverse drug reactions, and vital events
disclosed to CDC, state health departments, and other agencies as
mandated by law.
3.6 Research Use: De-identified or anonymized data
may be used for approved research with your explicit authorization.
No individually identifiable data is shared for research without
consent.
3.7 No Data Sale: Daily Wellness Check does not sell, rent,
lease, or trade your personal information or PHI to any third party
for any purpose — marketing, advertising, data brokerage, or
otherwise. This is absolute and non-negotiable.
4. Security Measures
4.1 Encryption: TLS 1.3 for data in transit with
perfect forward secrecy. AES-256-GCM for data at rest with rotating
keys via AWS KMS. End-to-end encryption for telehealth video and
messaging.
4.2 Access Controls: Zero-trust architecture with
role-based access control (RBAC), just-in-time provisioning,
principle of least privilege, and automatic session timeout after 15
minutes of inactivity.
4.3 Authentication: Mandatory MFA for all staff.
Optional but encouraged MFA for patients. Biometric login support
(Face ID, fingerprint). Passwords checked against known breached
databases.
4.4 Network Security: Web application firewall,
DDoS mitigation, IDS/IPS, DNS filtering, email security with
anti-phishing, and micro-segmented network architecture.
4.5 Monitoring: 24/7 SOC monitoring with real-time
alerting. Quarterly penetration testing by independent firms. Annual
comprehensive security audits. Responsible disclosure bug bounty
program.
4.6 Incident Response: Documented plan with defined
severity levels and escalation paths. Breach notification within 60
days per HIPAA. Post-incident forensic analysis and remediation.
5. Your Privacy Rights
5.1 Right to Access: Request a complete copy of
your health records and personal data, fulfilled within 30 days in
your preferred format.
5.2 Right to Correction: Request amendments to
inaccurate or incomplete health records, processed within 60 days
with notification to relevant parties.
5.3 Right to Restriction: Request restrictions on
PHI uses/disclosures. We must comply for disclosures to health plans
when you pay out-of-pocket in full.
5.4 Right to Confidential Communications: Specify
alternative communication methods or locations and we will
accommodate reasonable requests.
5.5 Right to Accounting: Request a log of certain
PHI disclosures made in the past six periods, excluding treatment,
payment, and operations disclosures.
5.6 Right to Paper Copies: Receive paper copies of
this Privacy Policy, your Notice of Privacy Practices, and your
health records upon request.
5.7 Right to Breach Notification: Written
notification within 60 days of any breach involving your unsecured
PHI, including nature, data types, and protective steps.
5.8 Right to Complain: File complaints with our
Privacy Officer or the HHS Office for Civil Rights without fear of
retaliation or impact on your care.
6. Cookies & Tracking
6.1 Essential: Required for authentication,
sessions, and security — cannot be disabled.
6.2 Analytics: Privacy-focused, anonymized,
aggregated data for UX improvement only.
6.3 Marketing: Third-party pixels deployed only
after explicit opt-in consent, fully compliant with state privacy
laws.
7. Minors
Patients under 18 require verifiable parental/guardian consent. We
collect only minimum necessary data for pediatric care.
COPPA-compliant consent for children under 13.
8. State-Specific Rights
Residents of states with comprehensive privacy laws (CCPA/CPRA,
CDPA, CPA, Washington My Health My Data Act, etc.) have additional
rights including data deletion, opt-out of sale/sharing, data
portability, and limitation of sensitive data processing. We honor
all applicable rights.
9. Data Retention
Health records retained per state and federal requirements
(typically 7–10 years for adults, longer for minors). Account data
retained while active. Upon deletion, personal data purged within 90
days subject to legal holds. Analytics data retained 24 months.
10. Policy Changes
Material changes communicated via email 30 days before effectiveness
and via prominent website notice. Continued use after effective date
= acceptance. Version history available on request.
11. Contact
Privacy Officer — privacy@dailywellnesscheck.info · +1 610-698-7253,
Option 5 · 2876 Lyndon Street
Northampton, PA 18067
· Response
within 5 business days.
