HeartFit for LifeSign in

HIPAA Notice of Privacy Practices (NPP)

Covered Entity:
HeartFit For Life at the Cardiac Therapy Foundation
Effective Date:
January 1, 1995
Privacy Officer Contact:
Robin Wedell, RN — Email: info@heartfitforlife.org — Phone: 650-494-1301
Address:
4000 Middlefield Rd. Suite G-8, Palo Alto, CA 94303

PLEASE REVIEW THIS NOTICE CAREFULLY. This Notice describes how medical information about you may be used and disclosed and how you can get access to this information.

1. Our Commitment to Your Health Privacy

HeartFit For Life at the Cardiac Therapy Foundation ("HeartFit", "we", or "us") provides structured cardiac rehabilitation, supervised exercise, lifestyle counseling, and digital health monitoring. In providing these services, we collect, generate, and maintain your Protected Health Information (PHI) in our secure electronic companion platform.

We are required by federal law (HIPAA Privacy Rule, 45 CFR Part 160 and Part 164, Subparts A and E) to maintain the privacy of your health information, to provide you with this Notice of our legal duties and privacy practices, and to notify you following any breach of unsecured health information.

2. What Health Information We Collect in the Companion Platform

When you participate in HeartFit cardiac rehabilitation, we maintain electronic health records including:

  • Identification & Contact Data: Name, date of birth, emergency contacts, attending physician details.
  • Vital Telemetry & Physiological Readings: Blood pressure, resting and exercise heart rate, body weight, blood glucose, and oxygen saturation.
  • Wearable Sensor Telemetry: Optical heart rate samples and step activity recorded via paired Apple Watch or Wear OS devices.
  • Clinical Notes & Care Plans: Diagnoses, cardiac risk factors, nurse notes, Borg Perceived Exertion (RPE) ratings, symptom reports, and exercise logs.
  • Care-Team Communications: Secure messaging between you, supervising exercise physiologists, nurses, and medical directors.

3. How We May Use and Disclose Your Health Information

Under federal law, we may use and disclose your health information without your specific written authorization for the following purposes:

For Treatment:

  • To coordinate your cardiac rehabilitation program.
  • To share vital trends and exercise progress reports with your primary cardiologist or referring physician.
  • To assess heart rate and symptom reports during supervised exercise classes.

For Healthcare Operations:

  • To evaluate program quality, assess clinical outcomes, perform software security audits, and train healthcare staff.
  • Cloud infrastructure providers (e.g., Google Cloud Platform) supporting our systems operate under strict, legally binding Business Associate Agreements (BAAs).

For Payment:

  • To verify insurance eligibility, process program subscription payments, or provide superbills for insurance reimbursement.

As Required by Law or Public Health:

  • When required by federal, state, or local law; for public health activities; to prevent a serious and imminent threat to health or safety; or in response to a court order.

All other uses and disclosures not covered by this Notice (including marketing or sale of PHI) require your explicit written authorization.

4. Your Rights Regarding Your Health Information

You have the following rights under HIPAA:

  • Right to Inspect and Copy: You have the right to inspect and receive an electronic copy of your medical records and vital logs. You may access your data directly in the HeartFit Companion app or request a complete export in PDF/CSV format.
  • Right to Request Amendments: If you feel the health information we have about you is incorrect or incomplete, you may submit a written request to amend your record.
  • Right to an Accounting of Disclosures: You have the right to request a list of disclosures we have made of your PHI for purposes other than treatment, payment, or healthcare operations.
  • Right to Request Restrictions: You may request limits on how we use or disclose your information for treatment, payment, or operations. While we are not required to agree to all requests, we must agree if you pay out-of-pocket in full for a service and ask us not to bill your insurer.
  • Right to Confidential Communications: You may request that we communicate with you via specific secure channels or at an alternative address.
  • Right to a Paper Copy of this Notice: You may obtain a paper copy of this Notice upon request at any time.

5. Security & Automated Protections

HeartFit implements technical and physical safeguards to protect your electronic records:

  • Encryption in Transit & at Rest: Health data is protected using strong industry-standard encryption protocols (including TLS during transmission and encrypted database storage) complying with HIPAA Security standards.
  • Automatic Inactivity Logoff: Web and workstation screens automatically lock after 15 minutes of inactivity to prevent unauthorized viewing.
  • Immutable Audit Logging: All access to your clinical record is permanently logged in a secure, tamper-resistant audit registry.

6. Complaints & Contact Information

If you believe your privacy rights have been violated, you may file a complaint with us or with the Office for Civil Rights (OCR) of the U.S. Department of Health and Human Services:

HeartFit Privacy Officer:

Robin Wedell, RN — 650-494-1301 — info@heartfitforlife.org
4000 Middlefield Rd. Suite G-8, Palo Alto, CA 94303

U.S. Department of Health & Human Services (HHS OCR):

200 Independence Avenue, S.W., Washington, D.C. 20201
Toll Free: 1-877-696-6775 | Website: https://www.hhs.gov/hipaa/filing-a-complaint/

We will never retaliate against you for filing a complaint.