HIPAA Notice of Privacy Practices

Effective Date: September 30, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Who this notice covers

This notice is provided by DRMA, LLC, doing business as DRMA (“DRMA,” “we,” “us”), and describes the privacy practices that apply to protected health information (“PHI”) we create, receive, maintain or transmit about you in connection with the telehealth services offered through drma.co.

The licensed clinicians who evaluate your intake and issue prescriptions, and the pharmacies that dispense them, may be separate covered entities with their own notices of privacy practices. This notice describes DRMA’s practices; it does not replace a notice you receive directly from a clinician or pharmacy.

How we may use and disclose your health information

We may use and disclose your PHI without your written authorization for the following purposes.

Treatment

We use and disclose your PHI to provide, coordinate and manage your care. For example, we transmit the intake questionnaire, photographs and medical history you submit to the licensed clinician who reviews your case, and we transmit an approved prescription to the dispensing pharmacy so your medication can be compounded and shipped.

Payment

We use and disclose your PHI to bill and collect payment for the services and products you receive. For example, we share the information necessary for a payment processor to charge your card, and we may disclose limited information to resolve a chargeback or billing dispute.

Health care operations

We use and disclose your PHI to run our business and maintain the quality of care. For example, we review clinical outcomes and turnaround times, audit our own compliance, and train and evaluate the personnel and vendors involved in your care.

Business associates

We contract with vendors who perform services on our behalf that require access to PHI, including our telehealth platform provider, our pharmacy partners, and our hosting and communications providers. Each is required by a written business associate agreement to safeguard your PHI and to use it only as that agreement permits.

Appointment reminders, treatment alternatives and health-related benefits

We may contact you by email, text message or telephone to remind you about your treatment, to tell you that a refill is due, or to describe a treatment alternative or health-related product or service that may be of interest to you. You may ask us to stop these communications at any time.

Other uses and disclosures permitted or required by law

We may use or disclose your PHI without your authorization when the law permits or requires it, including:

  • when required by federal, state or local law;
  • for public health activities, including reporting adverse events and product defects to the U.S. Food and Drug Administration;
  • to report suspected abuse, neglect or domestic violence as the law requires or permits;
  • to health oversight agencies for audits, investigations, inspections and licensure activities;
  • in response to a court or administrative order, subpoena, discovery request or other lawful process;
  • to law enforcement officials in the limited circumstances the law allows;
  • to coroners, medical examiners and funeral directors, and for organ and tissue donation;
  • for research, where an institutional review board or privacy board has approved a waiver of authorization;
  • to avert a serious and imminent threat to your health or safety or that of another person;
  • for specialized government functions, including military, national security and protective services; and
  • as authorized by workers’ compensation laws.

Uses and disclosures that require your written authorization

Other uses and disclosures of your PHI will be made only with your written authorization. Your written authorization is always required for:

  • most uses and disclosures of psychotherapy notes, where we maintain any;
  • uses and disclosures of PHI for marketing purposes; and
  • any disclosure that constitutes a sale of your PHI.

You may revoke an authorization in writing at any time. A revocation does not affect any use or disclosure we already made while the authorization was in effect.

Your rights regarding your health information

Right to access and receive a copy

You have the right to inspect and obtain a copy of the PHI we maintain about you in a designated record set. Because we maintain your records electronically, you may request an electronic copy, and you may direct us to send that copy to a person or entity you name. We may charge a reasonable, cost-based fee. We may deny a request in the limited circumstances the law allows, and where the law provides, you may ask that the denial be reviewed.

Right to request an amendment

You have the right to ask us to amend PHI you believe is incorrect or incomplete. We may deny your request in certain circumstances, and if we do, we will explain why in writing and you may submit a statement of disagreement that we will include with your records.

Right to an accounting of disclosures

You have the right to request a list of certain disclosures of your PHI that we made in the six years before your request. The list does not include disclosures for treatment, payment or health care operations, disclosures you authorized, or other disclosures the law excludes.

Right to request restrictions

You have the right to ask us to restrict how we use or disclose your PHI for treatment, payment or health care operations. We are not required to agree to most requested restrictions. We are required to agree to one: if you pay for an item or service in full, out of pocket, you may require us not to disclose PHI about that item or service to a health plan for payment or health care operations, unless the law requires the disclosure.

Right to confidential communications

You have the right to ask us to communicate with you about medical matters by an alternative means or at an alternative location. We will accommodate reasonable requests.

Right to a paper copy of this notice

You have the right to a paper copy of this notice on request, even if you agreed to receive it electronically.

Right to be notified of a breach

You have the right to be notified if we discover a breach of your unsecured PHI.

Our responsibilities

  • We are required by law to maintain the privacy and security of your PHI, to give you this notice of our legal duties and privacy practices, and to notify you following a breach of your unsecured PHI.
  • We must follow the terms of the notice currently in effect and may not use or disclose your PHI other than as described here, unless you give us written permission.
  • Where state or other federal law is more protective of your health information than HIPAA, we follow the more protective law.

Changes to this notice

We reserve the right to change this notice and to make the revised notice effective for PHI we already maintain as well as information we receive in the future. The current notice will always be posted at drma.co/hipaa-notice with its effective date, and we will provide the revised notice to you if the law requires it.

How to exercise your rights, or complain

To exercise any right described in this notice, or to ask a question about our privacy practices, contact our Privacy Officer:

If you believe your privacy rights have been violated, you may file a complaint with us at the address above, and you may file a complaint with the Secretary of the U.S. Department of Health and Human Services, Office for Civil Rights, 200 Independence Avenue SW, Washington, D.C. 20201, or at hhs.gov/ocr/privacy/hipaa/complaints. We will not retaliate against you for filing a complaint.