Privacy practices
This notice explains how your protected health information may be used, shared, and safeguarded through LEV18 and our licensed healthcare and pharmacy partners.
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
Clinical services are provided by independent licensed providers of Arora Health. This notice is provided on behalf of those providers, who deliver clinical services to patients enrolled through LEV18. Those providers are the HIPAA covered entities responsible for your protected health information (PHI). LEV18 operates the enrollment platform and website. It is not a healthcare provider and receives PHI only to the limited extent needed to support enrollment, scheduling, and billing.
1. Your Protected Health Information
Protected health information is information that identifies you and relates to your health, the care you receive, or payment for that care. It includes your intake responses, medical history, lab results, prescriptions, and billing records. Your treating providers are required by law to:
- Maintain the privacy and security of your PHI.
- Provide you with this notice of their legal duties and privacy practices with respect to your PHI.
- Abide by the terms of this notice currently in effect.
- Notify you following a breach of unsecured PHI, as required by applicable law.
2. When Information May Be Shared
The categories below describe the ways your PHI may be used and disclosed without your specific written authorization. Not every use or disclosure is listed, but all permitted uses and disclosures fall within one of these categories.
Treatment
Your PHI is used to provide, coordinate, and manage your healthcare. For example, a licensed provider may review your intake responses, lab results, and medical history to determine whether a medication is appropriate for you, and may share information with a licensed pharmacy partner, including [pharmacy name], to dispense your prescription.
Payment
Your PHI may be used to bill for your care and collect payment, including verifying payment authorization with the payment processor (USA Payments), sharing the minimum necessary information with the dispensing pharmacy, and determining eligibility for services.
Healthcare Operations
Your PHI may be used to run the practice, improve your care, and contact you when necessary. Examples include quality assessment, clinician training and credentialing review, regulatory compliance, and activities to improve treatment outcomes.
Health Information Exchanges
Your PHI may be shared through secure electronic means with other healthcare providers who are treating you, including referrals for lab or pharmacy services. If you do not wish to participate, contact us in writing at support@lev18.com to object.
Appointment Reminders and Care Communications
Your PHI may be used to contact you with appointment reminders, follow up prompts, refill notifications, and program updates by email, portal message, or SMS, subject to your communication preferences. See our Telehealth Consent and SMS Terms for details on how these messages work and how to opt out.
Individuals Involved in Your Care
With your permission, information may be shared with a family member, personal representative, or other person you designate as relevant to their involvement in your care.
As Required by Law
Your PHI will be disclosed when required by federal, state, or local law. This includes reporting to state medical and pharmacy boards, the U.S. Drug Enforcement Administration, or public health authorities for purposes authorized by law.
Public Health, Safety, and Oversight
Your PHI may be disclosed for public health activities (such as disease reporting and adverse drug event reporting to the FDA), health oversight activities (such as audits and investigations), and to prevent or lessen a serious and imminent threat to health or safety.
Judicial and Administrative Proceedings, Law Enforcement
Your PHI may be disclosed in response to a valid court order, subpoena, or other lawful process, and to law enforcement in the limited circumstances permitted by HIPAA.
Business Associates
Third parties ("business associates") perform certain services on behalf of your providers, such as the enrollment platform operated by LEV18, electronic medical record hosting, secure communications, e prescribing, and billing. These business associates are bound by written agreements to protect your PHI to the same standards required of your providers.
Uses That Require Your Written Authorization
Uses and disclosures not described in this notice will be made only with your written authorization. This includes most uses and disclosures of psychotherapy notes (if any exist), uses and disclosures of PHI for marketing purposes, and disclosures that constitute a sale of PHI. You may revoke your authorization in writing at any time, except to the extent it has already been relied upon.
3. Your Privacy Rights
- Right to request restrictions: you may request a restriction on how your PHI is used or disclosed for treatment, payment, or healthcare operations, or to individuals involved in your care. Your providers are not required to agree, except that they must agree to restrict disclosure of PHI to a health plan for payment or healthcare operations when you have paid for the related item or service in full out of pocket.
- Right to amend: you may request an amendment of your PHI if you believe it is incorrect or incomplete. Requests must be made in writing and include a supporting reason. A request may be denied in certain circumstances, with a written explanation provided.
- Right to an accounting of disclosures: you may request an accounting of certain disclosures of your PHI made within the six (6) years prior to your request, excluding disclosures for treatment, payment, healthcare operations, and certain other categories.
- Right to a paper copy of this notice: you may receive a paper copy of this notice upon request, even if you agreed to receive it electronically.
- Right to notification of a breach: you will be notified following a breach of your unsecured PHI, as required by the HIPAA Breach Notification Rule.
4. Accessing Medical Records
You have the right to inspect and obtain a copy of your medical record and billing record, in paper or electronic form. Requests may be submitted through the patient portal or by emailing support@lev18.com, and a reasonable, cost based fee may apply for copies as permitted by law.
5. Confidential Communications
You have the right to request that communications about medical matters reach you in a certain way or at a certain location, for example by mail to a specific address or only through the patient portal. Reasonable requests will be accommodated.
6. Filing Privacy Concerns
If you believe your privacy rights have been violated, you may file a complaint by contacting support@lev18.com, and your concern will be routed to the appropriate privacy officer. You may also file a complaint directly with the U.S. Department of Health and Human Services, Office for Civil Rights:
You will not face retaliation for filing a complaint. The terms of this notice may change, and the new provisions will apply to all PHI maintained. When a material change is made, the revised notice will be posted on this page with an updated effective date.
Receipt of this notice is acknowledged electronically at the time of enrollment as part of your intake consents. A paper copy is available at any time upon written request.
Notice version: October 12, 2026.