Under California Law, California residents have the right to request in writing from businesses with whom they have an established business relationship, (a) a list of the categories of personal information, such as name, e-mail and mailing address and the type of services provided to the customer, that a business has disclosed to third parties (including affiliates that are separate legal entities) during the immediately preceding calendar year for the third parties’ direct marketing purposes; and (b) the names and addresses of all such third parties. To request the above information, please contact us with a reference to California Disclosure Information.
We will endeavor to respond to such requests to information access within 30 days following receipt at the e-mail address stated above. If we receive your request at a different e-mail address, we will respond within a reasonable period of time, but not to exceed 150 days from the date received. Please note that we are only required to respond to each customer once per calendar year.
This section only applies to California residents (“Consumers”). For the purposes of this section only, “Personal Information” means information that identifies, relates to, describes, references, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular Consumer or household.
Consumers have the following rights:
Please note, under California Law, that we are only required to respond to such requests from you twice in a twelve-month period.
You may submit requests for information by completing the Consumer Request Form, by emailing us at Personal Information Request or by calling us at 844-422-3282.
The categories of sources from which we collect Personal Information are:
The categories of third parties with whom we share Personal Information are described in detail in the “How We Disclose Personal Information” section of this Privacy Policy.
The chart below describes:
| Category | Examples | Disclosed for a Business Purpose | Sold |
|---|---|---|---|
| Identifiers | Name, address, e-mail address, telephone number, date of birth, IP address | Yes | No |
| Personal Information categories described in Cal. Civ. Code § 1798.80(e) | Name, address, telephone number, insurance policy number, employment history, medical information, health insurance information | Yes | No |
| Protected classification characteristics under California or federal law | Age, race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information) | Yes | No |
| Commercial information | Products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies | Yes | No |
| Internet or other similar network activity | Internet protocol address, type of browser, number of links clicked within our Services, state or country from which you accessed our Services, date and time of visit, name of Internet service provider, third party websites you linked to from our Services, pages or information you viewed on our Services, number of times you have viewed an ad | Yes | No |
| Geolocation data | Region or postal code | Yes | No |
| Professional or employment-related information | Work experience, performance evaluations | Yes | No |
The purposes for which the categories of Personal Information shall be used, and the business or commercial purposes for collecting or selling personal information, are described in detail in the following sections of this Privacy Policy:
We may collect the following categories of covered information about you through our Website, Portals, and Services when you visit the Website and Portals or use the Services such as:
We may share such covered information with categories of third parties such as marketing.
Third parties may collect covered information about your online activities over time and across different Internet websites or online services when you use the Website, Portals, or Services.
If you use or visit the Website and Portals or use the Services you may review and request changes to any of your covered information that is collected through the Website, Portals, or Services by calling 844-422-3282.
You may submit a verified request that we not sell any covered information that we have collected or will collect about you by calling 844-422-3282. After we receive your request and determine that it is a verified request, we will not sell any covered information that we have collected or will collect about you.
If you are visiting our Portal from outside the United States, your information may be transferred to, stored or processed in the United States, where our servers are located and our central database is operated. Although the data protection and other laws of the United States and other countries might not be as comprehensive as those in your country, we take steps to protect your privacy, including, for transfers of Personal Information from the European Economic Area, the use of contractual clauses (known as “Model Clauses” or “Standard Contractual Clauses”) that have been approved by the European Commission. By using our Portal, you understand and agree that your information may be transferred to our facilities and those third parties with whom we share it as described in this Privacy Policy.
If you are one of our patients, your personal information in our possession is protected health information (“PHI”) protected by the Health Insurance Portability and Accountability Act of 1996, as amended (‘HIPAA’), and the applicable provisions of the Health Information Technology for Economic and Clinical Health (HITECH) Act. In addition to this Privacy Policy, the HIPAA Notices of Privacy Practices of those Provider facilities apply to your PHI.
In collecting Personal Information, our Services may also collect PHI. Just as we strive to protect Personal Information we are committed to protecting your PHI. If there is a breach of your PHI, we are required by law to notify you. Your PHI will only be disclosed to you or your personal representative, unless otherwise required or permitted by state or federal law. In all circumstances, unless otherwise required by law, we will obtain your written authorization before using or disclosing your PHI. This protection extends to PHI that is oral, written, or electronic.
If collected, we will take reasonable measures to protect the confidentiality of Social Security numbers and limit access to those with a need for such information. We prohibit the unlawful disclosure of Social Security numbers.
We will never ask for or knowingly collect Personal Information from children through the Services or Portal. If you are a child, you are not permitted to use the Portal and should immediately exit our Portal. Parents of un-emancipated minors may set up accounts for themselves to access their children’s medical records only as permitted pursuant to the Terms governing the Portal. If you think that we have collected personal information from a child through this Portal, please contact us and we will dispose of the information as required by applicable law.
We reserve the right to change the terms of this Privacy Policy at any time by posting those changes in revisions to this Privacy Policy, so that you are always aware of our processes related to collection, use and disclosure of information. We urge you to check here for any updates to this Privacy Policy from time to time. Unless otherwise indicated, any changes to this Privacy Policy will apply immediately upon posting to the Website.
If you have any questions or concerns about this Privacy Policy or the information practices of our Services, please contact us.
If you are a resident of the European Economic Area and have any questions or concerns about this Privacy Policy or the information practices of our Services, please contact our appointed EU representative, the DPO Centre.
You may also write to us at:
HCA Healthcare
Attention: Privacy Requests
One Park Plaza
Nashville, TN 37203