Jiffy Doctor Privacy Policy

This policy is not a Notice of Privacy Practices

This is Jiffy Doctor’s general website and service Privacy Policy. It is separate from the draft HIPAA policy set and from any Notice of Privacy Practices that a healthcare provider or covered entity may separately adopt and make applicable.

Review the separate public Notice of Privacy Practices for conditional HIPAA rights and uses where HIPAA applies. The separate HIPAA policy set remains a draft resource.

Information We May Collect

Depending on the services you use, we may collect the following categories of information:

We seek to collect only information reasonably necessary to provide requested services, satisfy legal or regulatory obligations, protect our systems, process transactions, and communicate with patients.

• Contact and identity information, such as your name, date of birth, mailing or residential address, email address, telephone number, and identification information.
• Documents you voluntarily upload, such as photographs, state identification, proof of residency, or Veteran eligibility documentation.
• Health and care information, including medical history, conditions, symptoms, medications, treatment history, and information used to evaluate eligibility for an applicable state medical cannabis program.
• Appointment, provider, intake, application, patient-portal, renewal, document, and customer-support information.
• Payment and transaction information, such as the amount, status, and processor reference associated with a payment.
• Communications and consent choices, including service-related communication consent and optional marketing preferences.
• Technical information from public website use, which may include device and browser details, IP address, requested pages, referral information, and website usage events.

Health Information and HIPAA

Information submitted in connection with healthcare services may be sensitive health information. Depending on the parties, purpose, and circumstances involved, some information may be subject to the Health Insurance Portability and Accountability Act (“HIPAA”), state health-privacy laws, or other healthcare privacy requirements.

Where HIPAA applies, the applicable covered entity and its properly authorized service providers must handle protected health information according to applicable law and the covered entity’s adopted Notice of Privacy Practices. This Privacy Policy does not itself establish that Jiffy Doctor is a HIPAA covered entity or business associate, prove that any Business Associate Agreement is in place, or replace an applicable Notice of Privacy Practices.

Jiffy Doctor’s separate HIPAA policy set is a draft internal policy resource. It has not been presented as a formally adopted Notice of Privacy Practices. A separately adopted notice, when applicable, governs the HIPAA privacy rights and uses described in that notice.

How We May Use Information

We may use information as reasonably necessary to:

• Process patient intake, registration, renewal, and support requests.
• Schedule or facilitate medical evaluations and connect patients with appropriately licensed healthcare providers.
• Verify identity, residency, documentation, appointment tier, and eligibility information.
• Help facilitate participation in applicable state medical cannabis programs without guaranteeing approval, certification, or a prescription.
• Process payments and maintain transaction records.
• Communicate about requested services, appointments, applications, documents, payment, patient accounts, renewals, and customer support.
• Record and honor operational communication consent, optional marketing choices, and opt-out requests.
• Maintain records required for clinical, business, security, contractual, or legal purposes.
• Protect against fraud, misuse, abuse, unauthorized access, and threats to our services.
• Improve the functionality, reliability, accessibility, and security of our services.
• Comply with applicable laws, court orders, and lawful governmental or regulatory requirements.

Payments

Payments may be processed by independent third-party payment providers using hosted or tokenized payment flows. Jiffy Doctor does not intentionally collect or store complete payment-card numbers when payment details can instead remain with the authorized payment provider.

We may retain transaction details needed to reconcile a payment, such as the amount, payment status, appointment type, and an opaque processor reference. Payment providers maintain their own privacy and security practices, which you should review when you use their services.

How Information May Be Shared

We may share information only when reasonably necessary for requested services, authorized operations, security, payment, or legal obligations. Recipients may include:

• Healthcare providers involved in an evaluation or care.
• Authorized workforce members and contractors with a legitimate need for the information.
• Hosting, database, document-storage, security, support, and other technology providers.
• Approved communications providers used for requested operational messages or separately authorized marketing.
• Payment processors.
• Applicable state medical cannabis programs, registries, or licensed dispensing organizations when legally permitted and necessary.
• Governmental, regulatory, law-enforcement, or judicial authorities when disclosure is legally required.
• A successor or other party involved in a proposed or completed business transaction, subject to applicable privacy obligations.

Vendors and Business Associate Agreements

Healthcare privacy obligations depend on the information involved, the parties’ legal roles, the services used, and the agreements covering the specific account and service. When HIPAA requires a Business Associate Agreement, the responsible covered entity must have an applicable agreement in place before a vendor handles protected health information on its behalf.

This Privacy Policy does not claim that every Jiffy Doctor vendor is HIPAA eligible, that every service is covered by a signed Business Associate Agreement, or that a vendor’s general security or compliance materials establish coverage for Jiffy Doctor.

Cookies, Analytics, and Tracking Technologies

Our public-facing website may use cookies or similar technologies for essential functionality, security, analytics, and permitted marketing. Public website analytics may collect page visits and limited, non-sensitive interaction data to help us understand and improve the site.

Jiffy Doctor does not intend to send patient names, contact details, medical answers, uploaded documents, record identifiers, state-portal credentials, or private access tokens to public website analytics. Analytics and advertising technologies should not receive protected health information or sensitive form contents from patient intake, medical questionnaire, document-upload, clinic, or patient-portal areas.

Information Security

Jiffy Doctor uses safeguards designed to reduce the risk of unauthorized access, use, alteration, disclosure, or destruction. Depending on the system and environment, safeguards may include access controls, authentication, restricted workforce access, request validation, private document-access controls, logging designed to minimize sensitive content, backups, and protected communications.

No internet-based service can be guaranteed completely secure, and this policy does not claim that all data or vendors meet any particular certification or assurance standard. Protect your devices and private access links, and promptly report suspected unauthorized account access.

State and Third-Party Account Credentials

Jiffy Doctor does not ask patients to provide passwords for state medical-cannabis portals, government accounts, email accounts, or other third-party accounts. Do not enter or send those passwords through Jiffy Doctor forms, email, text messages, support requests, or patient tools.

When a state program requires you to use its portal, you should sign in directly through the official state website. Jiffy Doctor may request a non-secret patient or registration identifier when needed, but not the password used to access the account.

Data Retention

We retain different categories of information for different periods based on the purpose for which the information was collected and applicable clinical-record, regulatory, contractual, transaction, security, dispute-resolution, and legal requirements.

Jiffy Doctor has not stated one universal retention period in this policy. When information is no longer reasonably needed and no obligation or legal hold requires continued retention, it should be deleted, de-identified, or otherwise handled according to the applicable retention and disposal process. Backup copies and vendor systems may follow separate approved deletion cycles.

Children’s Privacy

Jiffy Doctor services are not intended for children to independently submit personal information without the involvement or authorization of a parent, legal guardian, or eligible caregiver when required by law or the applicable state program.

Your Privacy Choices

Depending on applicable law, Jiffy Doctor’s role, and the type of information involved, you may be able to request access, correction, amendment, restriction, deletion, or other handling of your information. Some requests may be limited by medical-record, legal, security, fraud-prevention, or record-retention obligations.

You may opt out of optional marketing text messages by replying STOP, use the unsubscribe link in a marketing email, or contact us. Marketing preferences do not prevent operational communications that are necessary or permitted for a service, transaction, appointment, account, or care relationship.

HIPAA-related rights, when applicable, are described separately in the relevant covered entity’s adopted Notice of Privacy Practices.

Changes to This Privacy Policy

We may update this Privacy Policy as our services, technologies, vendors, or legal obligations change. The current version will be posted here with its effective and last-updated dates. Material changes may also be communicated through another appropriate channel.

Contact Jiffy Doctor

Questions, privacy requests, or concerns about this Privacy Policy may be sent to patients@jiffydoctor.com or discussed by calling 844-78-JIFFY (844-785-4339). Please do not include account passwords or unnecessary medical details in ordinary email or text messages.