Notice of Privacy Practices

Ekayaa Consulting Private Limited ("Ekayaa", "we", "us") provides the Paperless ICU and the Patient 360 platform to hospitals and healthcare providers. When a hospital uses our platform, we handle patients' protected health information (PHI) on the hospital's behalf.

Where your hospital is subject to the US Health Insurance Portability and Accountability Act (HIPAA), this makes us a business associate of that hospital. We sign a Business Associate Agreement (BAA) with the hospital before any patient data reaches our platform, and that agreement limits what we may do with your information.

This is not the notice your hospital is required to give you. Your hospital has its own Notice of Privacy Practices, which is the main notice for your care, and you exercise your rights through your hospital. This notice explains how Ekayaa handles your information when we process it on the hospital's instructions under its BAA.

We use and share your health information only to provide our services to your hospital, as their BAA permits:

• Treatment. For example, bringing bedside device readings, hospital system data and care-team notes into one live view so your care team can treat you.
• Payment and healthcare operations. Supporting your hospital's billing, quality improvement and day-to-day operations when the hospital asks us to.
• Our subcontractors. With any service provider who helps us run the platform and needs access to health information to do so. Each one must sign a BAA with us and protect your information to the same standard.
• When required by law. For example, to the US Department of Health and Human Services when it checks that we comply with HIPAA.
• Other purposes the law permits or requires. Only where HIPAA and the BAA allow it, and usually at your hospital's direction:
  • Public health activities, such as preventing or controlling disease and reporting problems with medical devices.
  • Reporting suspected abuse, neglect or domestic violence to the authorities allowed to receive such reports.
  • Health oversight activities, such as audits, inspections and licensing.
  • Lawsuits and other legal proceedings, in response to a court order, subpoena or other lawful process.
  • Law enforcement purposes, such as responding to a warrant or helping to identify a suspect or missing person.
  • Coroners, medical examiners and funeral directors, when someone has died.
  • Organ, eye and tissue donation organizations.
  • Research approved under HIPAA's safeguards, such as by an institutional review board.
  • Preventing a serious threat to someone's health or safety.
  • Specialized government functions, such as military, national security and correctional institutions.
  • Workers' compensation and similar programs for work-related illness or injury.
  Your hospital's own notice describes these purposes in full.

Our staff can see only the minimum health information needed for their role. Access is controlled by role, and every disclosure outside your hospital is recorded in an audit trail.

Apart from the uses above, we do not use or share your health information unless you have given written permission (an "authorization"), collected through your hospital. Written permission is always needed for most uses of psychotherapy notes, for marketing, and for the sale of health information.

We do not use your health information for product development, training AI models, marketing or research unless it has first been de-identified, or you have given written permission where the law and our contract with your hospital require it.

If you give permission, you can take it back in writing at any time. From then on, we stop using or sharing your information for that purpose, but we cannot undo anything already done with your permission.

If we receive records about you that are protected by federal rules on substance use disorder treatment (42 CFR Part 2), we will not use or share them in any civil, criminal, administrative or legislative proceeding against you without your written consent or a court order.

You have the following rights over your health information. Because your hospital holds your medical record, please start by contacting your hospital. We work with your hospital to fulfil your request within the timeframes HIPAA requires. You can also contact our Privacy Officer, and we will pass your request to the right hospital and help it respond.

• See and get a copy of your health information

  You can ask to see or get an electronic or paper copy of your health information. A reasonable, cost-based fee may apply.

• Ask for your health information to be corrected

  If you think your health information is incorrect or incomplete, you can ask for it to be corrected. A request can be declined, but you will be told why in writing.

• Get a list of those we have shared your information with

  You can ask for a list (accounting) of the times your health information was disclosed, who it was shared with and why, for up to six years before the date you ask.

• Ask for limits on what is used or shared

  You can ask that certain health information not be used or shared for treatment, payment or operations. Your hospital is not always required to agree, but it must agree not to share information with your health plan about an item or service you paid for in full out of pocket, unless the law requires it. Agreed limits are honoured except in an emergency.

• Ask to be contacted confidentially

  You can ask to be contacted in a specific way (for example, by mobile instead of home phone) or at a different address. Your hospital will accommodate reasonable requests, and we follow its instructions.

• Get a paper copy of this notice

  You can ask for a paper copy of this notice at any time, even if you have agreed to receive it electronically.

• Be notified of a breach

  You will be notified by your hospital if a breach occurs that may have compromised the privacy or security of your health information.

• We are required by law to keep your protected health information private and secure.
• If a breach affects your health information, we will tell your hospital promptly so that you can be notified as the law requires.
• We follow the practices described in this notice and give you a copy on request.
• We protect your information with encryption in storage and in transit, unique user accounts with role-based access, automatic session timeouts, audit logs of all access, workforce training and at least yearly risk assessments. These safeguards run under our ISO/IEC 27001:2022 certified information security management system.
• Our HIPAA compliance has been independently assessed by Cert Assured Pte. Ltd. (Certificate No. HPCAS02021). See our Security page.

If you believe your privacy rights have been violated, you can complain to us by contacting our Privacy Officer. We acknowledge every complaint within five (5) business days, investigate it and tell you the outcome.

You can also file a complaint with the US Department of Health and Human Services, Office for Civil Rights, at hhs.gov/ocr/complaints ↗.

We will not retaliate against you for filing a complaint.

Contact the Privacy Officer to ask a question, make a request about your rights, or ask for a paper copy of this notice.

We may change this notice, and any change will apply to all the information we hold. The current version is always on this page, with its effective date shown at the top.