top of page

Privacy Policy

HarborWell Health, LLC (“HarborWell Health”) is committed to protecting the privacy of individuals we serve. This Privacy Policy describes how we collect, use, disclose, and safeguard personal information in connection with our website, patient portal, telehealth platform, SMS communications, and clinical care coordination services (collectively, the “Services”). It supplements but does not replace our Notice of Privacy Practices (“NPP”) required under HIPAA. For information regarding the processing of protected health information, please visit our NPP. 

 

We may update or modify this Privacy Policy at any time, by posting the updated version including the effective date of the updated version.  Please review this Privacy Policy periodically for any updates or changes.  

 

Please read this Privacy Policy carefully. Your continued use of the Services is considered your acceptance of these terms, and you agree to the terms of this Privacy Policy and the collection and use of information in accordance with this Privacy Policy. If you do not agree to be bound by this Privacy Policy or any subsequent modifications, you should not access our Services or disclose any personal information through our Services. This Privacy Policy is incorporated into our Terms of Services. 

​

1. Who We Are

HarborWell Health is a Managed Service Organization (MSO) providing physician-led care coordination to members. We operate as a Business Associate under HIPAA in contractual relationships with Health Plans and covered healthcare entities under contractual arrangements. Please visit our NPP for more information. Principal office: 3810 Bedford Ave, Suite 200, Nashville, TN 37215.

 

2. Information We Collect

 

2.1 Personal Information 

While using our Services, we may ask you to provide us with certain personally identifiable information (“Personal Information”). Personal Information is information that identifies, relates to, describes, can reasonably be associated with, or can reasonably be linked to a particular individual or household.

We collect information from you both when you provide it voluntarily and also automatically when you access our Services.

We collect Personal Information from you and any devices (including mobile devices) you use when you: use our Services, fill-out a contact form, contact us via phone, email, postal mail, or other means. 

 

2.2 Information We Collect. 

We collect and process Personal Information including:

  • Identifiers.  Your name, email address, postal address, social media usernames, telephone number, organization name, unique personal identifier, and Internet Protocol (IP) address. 

  • Interactions. Information you submit to the Services, including emails or other communications you provide to us.

  •  Internet or other electronic network activity information. For example:

    • Browse history. Data about the webpages you visit, including without limitation web browser specifications, websites visited before accessing our Services, and websites visited after leaving our Services. 

    • Device, connectivity, and configuration data.  Data about your device and nearby networks, including internet connection information, computer equipment information, regional and language settings.

    • Geolocation data. Data about your device’s location, which is inferred from your internet connection data, your IP address, and your postal address, or which you may choose to allow us to access by granting the Services access to your location when prompted.

      • This can be Personal Information and non-Personal Information that is collected about you when you are using our Services, and this may include:

        • Information about your interactions with our Services, which includes the date and time of any information you enter into our Services and your interactions with other users of our Services and what content or features you interacted with.

        • Technical data which may include URL information, cookie data, web beacons, web pixels, clickstream information collection, and other tracking technology information, your IP address, the types of devices you are using to access or connect to our Services, unique device IDs, device attributes, network connection type (e.g., WiFi, 3G, LTE, Bluetooth) and provider, network and device performance, browser type, language, and operating system. Further details about the technical data that is processed by us can be found below.

      • Cookies. Cookies are small data files that are downloaded onto your computer or mobile device when you use our Services, which are unique to your device or account.  Cookies make it easier for you to use our Services by saving your preferences so that we can use these to improve your next and subsequent visits to our Services. Cookies help us learn which areas of our Services are useful and which areas need improvement. 

      • You can choose whether to accept cookies by changing the settings on your browser or device. Each browser has its own methods for doing this. For detailed instructions on how to disable, block or delete cookies in your browser, consult your browser's help files or visit How to Manage Cookies. Please bear in mind that if you choose to disable this function, your experience with our Services may be impaired and some features may not work as they were intended. When we use cookies or other similar technologies, we may set the cookies ourselves or ask third parties to do so to help us. 

      • Please note that our Services are not set up to respond to Do Not Track (DNT) signals, but it does respond to browser cookies settings. You may opt-out from receiving personalized advertising from some third parties by visiting here. Please note that these choices will not opt you out of receiving advertisements. You will continue to receive generic advertisements. 

If we combine or associate information from other sources with Personal Information that we collect through the Services, we will treat the combined information as Personal Information in accordance with this Privacy Policy.

 

2.3 Sources

  • Service Providers (including hosting providers)

  • Data analytics service providers: usage and analytics data

  • Patients directly (including any devices you use): use of Services, fill-out contact form, contact us via phone, email, etc. 

​

3. How We Use Your Information

​

3.1 Perform the Services

  • Enforcing our agreements, terms, conditions, and policies 

  • Working with our service providers who perform certain business function or services on our behalf

  • Allowing you to participating in interactive features of our Services when you choose to do so

​

3.2 SMS Communications

We use your mobile number to send care-related transactional messages: appointment reminders, scheduling confirmations, care plan notifications, and program enrollment updates. HarborWell Health does not use patient data, mobile numbers, or any personal information for marketing purposes under any circumstances. 

​

3.3 Security and Compliance

  • Internal audits, risk assessments, and SOC 2 Type II compliance activities

  • Fulfilling legal, regulatory, and contractual reporting obligations

  • Workforce training and credential verification

  • Detecting, preventing, and addressing technical issues

  • Preventing or investigating fraud 

  • Maintaining the safety, security, and integrity of our Services and technology assets 

  • Investigating complaints and potential violations of our policies

​

3.4 Improve the Services 

  • Providing, maintaining, personalizing, and improving our Services

  • Gathering analysis and assessing trends and interests

  • Conducting aggregate or research analysis to enhance, protect, and make informed decisions on our Services

  • Monitoring the usage of the Services

  • Customizing the Services to your preferences and location 

​

4. How We Share Your Information

We share non-Personal Information with third parties at our discretion. In connection with our Services, we may share your Personal Information with certain third parties who we engage to help us run our business and perform the Services. HarborWell Health does not sell, rent, or otherwise monetize your Personal Information under any circumstances. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. The only disclosures we make are those necessary to deliver your care, fulfill our legal obligations, or operate our business as described below.

​

4.1 Technology Vendors

We share Personal Information with vendors providing services on our behalf, including electronic health record platforms, telehealth providers, SMS messaging service providers, and cloud infrastructure providers. All vendors with PHI access must execute Business Associate Agreements and comply with the HIPAA Security Rule.

 

4.2 SMS Vendors

Mobile numbers and messaging consent records are processed by our SMS service provider solely to deliver messages you have consented to receive. Our SMS service provider does not use this data for independent marketing purposes. 

 

4.3 Legal Requirements

We may disclose information as required by law, court order, or regulatory authority, or as otherwise authorized by you.

 

5. Data Security

HarborWell Health maintains an information security program aligned with SOC 2 Type II standards and the HIPAA Security Rule, including:

  • Encryption of PHI in transit (TLS 1.2+) and at rest (AES-256 equivalent or greater)

  • Role-based access controls and least-privilege principles

  • Multi-factor authentication for platform access

  • Continuous monitoring, audit logging, and vulnerability management

  • Annual risk assessments and workforce security training

  • Incident response and HIPAA breach notification procedures

Our platform infrastructure is hosted on a HIPAA-compliant cloud environment under a Business Associate Agreement. Our cloud infrastructure provider maintains SOC 2, ISO 27001, and HIPAA compliance certifications.

​

6. Data Retention

We retain Personal Information for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by applicable law. The criteria used to determine our retention periods include the nature and sensitivity of the data, the purposes for which it was collected, applicable legal requirements, and any contractual obligations.

​

SMS consent and opt-out records are retained for a minimum of four (4) years to support carrier and regulatory compliance.

​

7. Transfer of Data; Special Notice to Non-U.S. Users

Your information, including Personal Information, may be transferred to – and maintained on – computers located outside of your state, province, country or other governmental jurisdiction where the data protection laws may differ from those of your jurisdiction. Your consent to this Privacy Policy followed by your submission of such information represents your agreement to that transfer. Services are provided solely to individuals located in the United States. By using the Services, you represent that you are located in the United States and you consent to the general use and disclosure of your Personal Information in the United States. 

​

8. Policy on Children’s Information 

We do not knowingly collect personally identifiable information from anyone under the age of 14 (“Children” or “Child”), and we do not target the Services to Children. If you are a parent or guardian and you are aware that your Child has provided us with Personal Information, please contact us though one of the methods listed under “Contact Us” below. If we become aware that we have collected Personal Information from Children without verification of parental consent, we take reasonable steps to remove that information from our servers.

​

9. Links to Other Sites 

The Services may may contain links to third-party websites that are not operated or maintained by us. If you click on one of those links, you will be taken to websites we do not control. This Privacy Policy does not apply to the information practices of those third-party websites. You should read the privacy policies of third-party websites carefully. We are not responsible for the content, privacy policies, actions or security of third-party websites. 

 

10. Contact Us

HarborWell Health, LLC

3810 Bedford Ave, Suite 200, Nashville, TN 37215

support@harborwellhealth.org

​

Revised July 2026

bottom of page