Privacy Policy

Depending upon how an individual uses EllisMD, we may collect several categories of personal information.

Account and Identity Information

This may include:

• Name
• Date of birth
• Email address
• Telephone number
• Address
• Sex or other information relevant to healthcare
• Account username or identifiers
• Authentication information
• Emergency or authorized representative information where applicable and
• Information used to verify identity.

Health and Medical Information

When users obtain healthcare or related services through EllisMD, we may process information including:

• Medical history
• Current and previous medical conditions
• Symptoms
• Medications
• Allergies
• Family medical history
• Laboratory and diagnostic results
• Vital signs
• Immunization information
• Preventive screening history
• Clinical notes
• Consultation information
• Treatment plans
• Referrals
• Prescriptions
• Pharmacy information
• Uploaded health records
• Mental-wellness information and
• Other information reasonably necessary to provide requested healthcare services.

Health Vault Information

Users may store or receive health-related documents and information through the EllisMD Health Vault.

Health Vault information may originate from the patient, EllisMD healthcare professionals, pharmacists, laboratories, diagnostic facilities, participating healthcare organizations, or other authorized sources.

Information stored in the Health Vault may not represent the patient's complete medical record.

Pharmacy Information

Where pharmacy services are available, EllisMD may process information concerning:

• Prescriptions
• Medication history
• Allergies
• Medication interactions
• Refill requests
• Selected pharmacies
• Pharmacist consultations
• Prescription status and
• Medication delivery information.

Preventive-Care Information

EllisMD may process information relevant to preventive care, including age, sex, medical history, family history, previous screenings, immunizations, laboratory information, lifestyle factors, and other health risk information.

This information may be used to identify potential preventive-care needs or screening opportunities.

Mental Wellness Information

When individuals use Mental Wellness features, EllisMD may process information voluntarily provided through wellness assessments, mood check-ins, structured reflection tools, journaling features, or other wellness services.

Mental Wellness information that is intended to remain private will not automatically be published to the Social Room.

Social Room Information

Information users intentionally submit to community areas may include:

• Posts
• Comments
• Reactions
• Profile information
• Images or other permitted content and
• Reports concerning community activity.

Users should avoid publicly posting information that they do not want other community participants to see.

Payment and Transaction Information

When users purchase EllisMD services, we may process information concerning:

• Services purchased
• Amounts charged
• Transaction dates
• Billing status
• Refunds
• Subscription information and
• Payment-related identifiers.

Payment-card information may be processed by an authorized third-party payment processor rather than stored directly by EllisMD.

Device and Technical Information

When individuals access EllisMD electronically, certain technical information may be collected automatically, including:

• IP address
• Device type
• Browser type
• Operating system
• Login activity
• Session information
• Security logs
• Platform interactions
• Error information and
• Other information reasonably necessary for security and operation of the Platform.

EllisMD may collect personal information:

• Directly from users
• During account registration
• During medical or telemedicine consultations
• Through information entered into the Health Vault
• Through pharmacy services
• Through preventive-care tools
• Through Mental Wellness features
• Through Social Room participation
• From healthcare professionals providing services through EllisMD
• From participating pharmacies
• From laboratories or diagnostic providers
• From authorized representatives
• From service providers supporting the Platform and
• Automatically through the user's interaction with the Platform.

Where information is obtained from another source, EllisMD will process that information in accordance with applicable legal requirements.

EllisMD may use personal information for legitimate purposes associated with operating and providing the Platform, including to:

• Create and manage accounts
• Verify identity
• Provide telemedicine services
• Facilitate healthcare consultations
• Maintain appropriate medical records
• Facilitate prescriptions and pharmacy services
• Support preventive care
• Identify potential screening opportunities
• Operate the Health Vault
• Provide Mental Wellness features
• Operate and moderate the Social Room
• Coordinate care
• Communicate appointment information
• Send appropriate health or medication reminders
• Process payments
• Provide customer support
• Maintain Platform security
• Detect fraud or unauthorized access
• Comply with legal and regulatory obligations
• Maintain and improve Platform functionality and
• Protect patients, healthcare professionals, EllisMD, and other users.

EllisMD will seek to use personal information only for legitimate and authorized purposes.

Health information may be made available to appropriately authorized healthcare professionals when reasonably necessary to provide or coordinate healthcare.

Healthcare professionals may document consultations and other clinical activities in accordance with applicable professional and legal requirements.

Information entered into a patient's record may be subject to medical-record retention requirements and therefore may not be eligible for immediate deletion at the patient's request.

EllisMD may use artificial intelligence ("AI"), algorithms, rules-based systems, or other automated technologies to support certain Platform functions.

These technologies may assist with activities such as:

• Identifying potential preventive-care gaps
• Generating screening reminders
• Organizing medical information
• Summarizing information
• Supporting documentation
• Providing educational information
• Supporting Platform navigation and
• Identifying information that may warrant review by a healthcare professional.

AI-supported features are intended to assist—not independently replace—the professional judgment of qualified healthcare professionals when clinical judgment is required.

When AI-enabled functionality requires access to personal or health information, EllisMD will seek to limit access to information reasonably necessary for the authorized function.

EllisMD will not intentionally provide identifiable patient health information to unrelated public AI systems for unrestricted model training.

If EllisMD proposes to use identifiable health information for AI model development, research, commercial product development, or another purpose materially different from providing the user's services, EllisMD will first evaluate applicable legal requirements and obtain any notice, authorization, or consent required.

Where appropriate, information may instead be anonymized or de-identified before secondary analysis.

EllisMD may use automated technologies to generate recommendations, reminders, risk indicators, or other decision-support information.

Where an automated process may have a significant effect on an individual and applicable law provides rights concerning automated decision-making, EllisMD will provide appropriate information and processes for exercising those rights.

Healthcare professionals remain responsible for clinical decisions requiring professional judgment.

EllisMD does not disclose personal information indiscriminately.

Information may be shared where reasonably necessary with:

Healthcare Professionals

Information may be shared with physicians and other appropriately authorized healthcare professionals involved in a patient's care.

Pharmacies and Pharmacists

Relevant information may be shared with pharmacists or pharmacies when necessary to process, review, clarify, dispense, or coordinate prescriptions and medication-related services.

Laboratories and Diagnostic Providers

Where a patient receives testing or diagnostic services, information reasonably necessary to order, process, interpret, or return results may be shared with participating providers.

Technology and Service Providers

EllisMD may use third parties for services such as:

• Cloud hosting
• Data storage
• Cybersecurity
• Identity verification
• Communications
• Payment processing
• Video consultation technology
• Software infrastructure
• Customer support and
• Other Platform operations.

Where these organizations process personal information on behalf of EllisMD, appropriate privacy, confidentiality, security, and contractual safeguards will be required where applicable.

Authorized Representatives

Information may be shared with a parent, guardian, caregiver, personal representative, or other individual when the patient has authorized access or applicable law permits or requires it.

Legal and Regulatory Requirements

EllisMD may disclose information where reasonably necessary to comply with applicable law, court orders, regulatory requirements, professional obligations, or lawful governmental requests.

Information may also be disclosed where legally permitted and reasonably necessary to address serious safety threats, investigate fraud, protect Platform security, or protect the rights and safety of EllisMD or others.

EllisMD does not sell identifiable patient health information to advertisers or data brokers.

EllisMD will not intentionally permit third-party advertisers to use identifiable Health Vault information, medical records, prescription information, or private Mental Wellness information for unrelated targeted advertising without an appropriate lawful basis and any consent required by applicable law.

The Social Room is different from private areas of EllisMD.

Information a user intentionally posts in community areas may be visible to other authorized participants.

Users should not post confidential information they do not want others to see.

Other users may potentially copy, screenshot, or repeat information voluntarily posted to a community area. EllisMD cannot guarantee control over information another user obtains from content voluntarily shared within the Social Room.

Private Health Vault information and private Mental Wellness information should not automatically become Social Room content.

A user must intentionally choose to share information before it is displayed through applicable community features.

EllisMD may use cookies or similar technologies where necessary to:

• Maintain authenticated sessions
• Remember user preferences
• Maintain Platform security
• Detect suspicious activity
• Measure Platform performance and
• Improve functionality.

Where applicable law requires consent for non-essential cookies or similar technologies, EllisMD will provide appropriate choices.

EllisMD should not use sensitive health information for unrelated advertising tracking.

EllisMD will implement technical and organizational safeguards appropriate to the sensitivity of the information processed.

Safeguards may include:

• Encryption during transmission
• Encryption of appropriate stored information
• Secure authentication
• Role-based access controls
• Multi-factor authentication for appropriate privileged accounts
• Access logging
• Security monitoring
• Secure backups
• Vulnerability management
• Security testing
• Workforce confidentiality obligations
• Privacy and security training
• Vendor-security requirements and
• Incident-response procedures.

No electronic platform can guarantee absolute security. EllisMD nevertheless seeks to maintain safeguards proportionate to the risks associated with sensitive health information.

Access to patient information will be limited according to the user's authorized role and legitimate need for access.

Patients, healthcare professionals, pharmacists, administrators, and other authorized personnel may have different levels of access.

Administrative privileges do not automatically authorize unrestricted access to patient medical information.

EllisMD may maintain audit records documenting access to sensitive information where appropriate.

Users are responsible for maintaining the security of their account credentials and devices.

Users should not share passwords and should promptly notify EllisMD if they believe an account has been accessed without authorization.

EllisMD may require additional verification when unusual or suspicious account activity is detected.

EllisMD will maintain procedures for identifying, investigating, containing, documenting, and responding to suspected privacy or security incidents.

Where applicable law requires notification of affected individuals, regulatory authorities, or other parties, EllisMD will provide appropriate notification in accordance with applicable requirements.

Some technology providers supporting EllisMD may process or store information outside Jamaica.

Before permitting cross-border processing of personal information, EllisMD will evaluate applicable data-protection requirements and seek to implement appropriate contractual, technical, organizational, and other safeguards.

Where applicable law requires consent or another authorization for a particular transfer, EllisMD will obtain the required authorization.

EllisMD will retain personal information only for periods reasonably necessary for the purposes for which it was collected and consistent with applicable healthcare, pharmacy, financial, regulatory, legal, security, and data-protection requirements.

Different types of information may be subject to different retention periods.

Closing an EllisMD account does not necessarily result in immediate deletion of medical records or other information that EllisMD or participating healthcare professionals are legally or professionally required to retain.

When information is no longer required, EllisMD will seek to securely delete, anonymize, archive, or otherwise appropriately dispose of it.

Depending upon applicable law and the circumstances, individuals may have rights concerning their personal information, including the right to:

• Be informed about how information is processed
• Request access to personal information
• Request correction of inaccurate or incomplete information
• Obtain copies of eligible information
• Object to certain processing
• Request restriction or cessation of certain processing
• Withdraw consent where processing is based upon consent
• Request deletion where legally available
• Receive information concerning certain automated processing
• Request human review where applicable and
• Submit a complaint concerning the handling of personal information.

Certain rights may be subject to lawful exceptions, including medical-record retention requirements and other legal or professional obligations.

Because EllisMD handles sensitive health information, we may require reasonable identity verification before granting access to records, correcting information, processing deletion requests, or completing other privacy requests.

This is intended to prevent unauthorized individuals from obtaining or altering another person's information.

EllisMD may establish age requirements for particular services.

Where EllisMD provides services involving minors, appropriate parental, guardian, or other legally authorized consent will be obtained when required.

Additional safeguards may apply to minors' medical records, Mental Wellness information, Social Room access, telemedicine services, and other sensitive features.

EllisMD may send communications necessary to provide requested services, including:

• Account verification
• Security alerts
• Appointment reminders
• Consultation information
• Prescription notifications
• Preventive-care reminders
• Payment receipts
• Service notifications and
• Important privacy or security notices.

Marketing communications will be distinguished from essential healthcare, security, and account communications, and appropriate opt-out mechanisms will be provided where required.

EllisMD may update this Privacy Policy as the Platform, technology, services, or applicable requirements evolve.

The updated policy will display a revised "Last Updated" date.

Where a change materially affects how personal information is processed, EllisMD will provide additional notice and obtain consent where required by applicable law.

Questions, requests, or complaints regarding this Privacy Policy or EllisMD's handling of personal information may be submitted to:

EllisMD Privacy Office / Data Protection Contact

• Email: [Insert Privacy Email]
• Address: [Insert Registered Business Address]
• Telephone: [Insert Contact Number]

Where applicable, individuals may also have the right to submit a complaint to the relevant data-protection regulatory authority.

This Privacy Policy should be read together with the EllisMD:

• Terms of Use
• Medical & Telemedicine Care Terms
• Pharmacy Services Terms
• Preventive Care & AI Terms
• Health Vault & Privacy Terms
• Mental Wellness & Social Room Terms
• Payments & Account Terms and
• Any service-specific consent or authorization presented before a particular service is provided.

If EllisMD requires specific consent for a particular use of sensitive information, general acceptance of this Privacy Policy will not replace that specific consent where separate consent is required by applicable law.

Where processing is based on consent, users will be provided with appropriate information regarding the relevant processing before consent is requested.

By using EllisMD, users acknowledge that they have been provided access to this Privacy Policy.

Acknowledgment of this Privacy Policy does not constitute consent for every possible use of personal information. Where applicable law requires separate or explicit consent for a particular activity, EllisMD will seek that consent separately.