Privacy Policy & HIPAA Notice

Notice of Privacy Practices

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

1. Our Commitment to Privacy

Vine Health is committed to protecting your personal and health information. This policy explains our practices regarding the collection, use, and disclosure of your information.

2. Information We Collect

• Personal identification information (name, date of birth, address, email, phone)
• Health information shared during telehealth visits
• Payment and billing information
• Device and usage information

3. How We Use Your Information

• To provide and coordinate your healthcare services
• To process payments and manage your membership
• To communicate with you about your care and our services
• To comply with legal and regulatory requirements

4. Protected Health Information (PHI)

Your health information is protected under the Health Insurance Portability and Accountability Act (HIPAA). We will not use or disclose your PHI without your authorization except as permitted by law.

5. Your Rights

You have the right to:

• Access and receive a copy of your health records
• Request amendments to your health information
• Request restrictions on certain uses and disclosures
• Receive an accounting of disclosures
• File a complaint if you believe your privacy rights have been violated

6. Data Security

We implement administrative, physical, and technical safeguards to protect your information, including encryption, access controls, and regular security assessments.

7. Data Retention

We retain your information for as long as necessary to provide services and comply with legal requirements, typically for a minimum of 7 years after your last visit.

8. Third-Party Integrations

Vine Health integrates with third-party services to deliver care. Each integration accesses only the data required for its function, and none is used for advertising or resold:

• Stripe — payment processing (payment method, billing address).
• Google Calendar (optional, provider-side only) — when a provider chooses to connect their Google Calendar, Vine Health requests the https://www.googleapis.com/auth/calendar scope to (a) read the provider's calendar events so their Vine availability is automatically blocked when they are busy elsewhere, and (b) write opaque "Vine visit" placeholder events (no patient name, no clinical detail) so their upcoming Vine visits appear on their calendar. Vine Health does NOT transmit any patient information to Google Calendar and does not use Google user data for any purpose other than the two described above. OAuth tokens are encrypted at rest. Providers may disconnect at any time from Settings → Calendar sync, which revokes access and removes any events Vine placed on their calendar. Vine Health's use of and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• DoseSpot — electronic prescription writing and pharmacy transmission.
• Quest Diagnostics — laboratory order transmission and result retrieval.
• Electronic health record system — clinical record storage for provider notes and encounter documentation.
• 8x8 JaaS — video conferencing infrastructure for telehealth visits.

9. Contact Information

For questions about this policy or to exercise your rights, contact our Privacy Officer at shawn@vine.health.