Privacy Notice

Our Commitment to Your Privacy

Aira Health is committed to protecting the privacy and security of patient health information. This Privacy Notice describes how we collect, use, protect, and share Protected Health Information (PHI) as a Business Associate under the Health Insurance Portability and Accountability Act (HIPAA). PHI is disclosed to Aira Health by Covered Entities on behalf of their patients.

---

Who We Are

Aira Health is a Business Associate that provides healthcare technology services intended to simplify billing practices for Covered Entities and to streamline the patient authorization process. Our goal is to ensure that patient authorizations are in place so that insurers and health care providers can provide access to procedures to their patients. Aira Health partners with healthcare providers, health plans, and other covered entities (collectively, "Healthcare Partners") in order to do so.

We process PHI on behalf of and at the direction of our Healthcare Partners to help them deliver and improve healthcare services.

---

What Information We Handle

As a Business Associate, we may receive, process, or maintain the following types of PHI on behalf of our Healthcare Partners:

• Patient Demographics: Patient Name, Date of Birth (DOB), Insurance/Payer details, Health Plan identification numbers;
• Clinical Documentation: Patient visit (chart) notes, laboratory and imaging reports;
• Medical Conditions: Prognoses, diagnoses, and treatments; and
• Other information that identifies you and relates to your health or healthcare.

---

How We Use and Share Health Information

Uses and Disclosures on Behalf of Healthcare Partners

We use and share PHI only as directed by our Healthcare Partners and as permitted under our Business Associate Agreements (BAAs). This includes the following:

• Patient & Benefit Verification: Confirmation of patient authorization and scope of available coverage.
• Medical Necessity Checks: Cross-referencing clinical notes with insurer/payer guidelines.
• Documentation Preparation: Compiling the necessary clinical documentation.
• Lifecycle: Submission & Tracking: Managing healthcare request lifecycle.
• Legal Obligations and Compliance: To use or disclose PHI as required by federal, state, provincial, or local law(s), including defending against legal claims and disclosure to health care authorities or to comply with court orders.
• Business Operations: To conduct internal audits, for quality assurance purposes, service delivery, and storage for recording-keeping purposes.

Use of AI

Aira Health uses some Artificial Intelligence to perform a number of enterprise tasks to effect service delivery. However, we strictly limit the amount of PHI that is used within AI models and do not disclose PHI to our AI vendors to train their enterprise model. While data retrieval and packet preparation are automated, a human specialist reviews every step before final submission to ensure accuracy and clinical appropriateness. Aira Health has signed a binding BAA with our AI service provider.

De-Identified Information

We may, on occasion, strip PHI of its identifiers to create data sets containing de-identified information. This is information that cannot reasonably identify individual patients, and would be used for research, analytics, and other purposes. De-identified information would therefore not be subject to this Privacy Policy.

Disclosures That Require Patient Authorization

Except as described above, we will not use or disclose PHI without written express authorization from the patient. If a patient provides authorization, they may revoke it at any time by contacting the Healthcare Partner who provided the authorization, who would then communicate to Aira Health that the consent to process PHI has been withdrawn.

Disclosures to Subcontractors

We may share PHI with third-party service providers (subcontractors or third-party vendors) who assist us in delivering services to our Healthcare Partners. All subcontractors are required to protect PHI in accordance with HIPAA requirements, including executing a Business Associate Agreement as required.

---

Privacy Rights

While we handle PHI as a Business Associate, patient privacy rights are exercised through the Healthcare Partner who has a direct relationship with the patient. These rights include:

• Access to PHI / Copy of Notice: Patients have the right to review and obtain a copy of their health information, including PHI and Electronic Health Records (EHR). All such requests must be made in writing.
• Amendment: Patients have the right to request corrections to their health information if it is factually incorrect or incomplete. This does not apply to any information that is not factual in nature (e.g. opinions).
• Account of Disclosures: Patients have the right to receive a list of certain disclosures of PHI. Aira Health therefore keeps records of such disclosures for transparency.
• Restriction: Patients have the right to request limits on how their PHI is used or shared.
• Requesting Confidential Communications: Patients have the right to request that the Healthcare Partner communicate with them in a specific way or at a specific location. This is to facilitate and preserve patient confidentiality.
• Deletion of PHI: Patients have the right to request deletion of their PHI, subject to certain legal and regulatory exceptions. Deletion requests must be made through the Healthcare Partner.

Requesting Deletion of Your Health Information

Patients may request deletion of their PHI held by Aira Health, subject to applicable legal requirements and exceptions. To request deletion:

• Submit Your Request: Contact your Healthcare Partner directly with a written deletion request. The Healthcare Partner will review and forward approved requests to Aira Health.
• Verification: We will verify the deletion request with the Healthcare Partner to ensure proper authorization.
• Processing Timeline: Once verified, we will complete the deletion within 30 days, unless a longer period is required by law or regulatory obligations.
• Confirmation: We will notify the Healthcare Partner upon completion, who will then confirm the deletion with the patient.

Important Exceptions: We may be required to retain certain PHI for legal, regulatory, or compliance purposes, including audit requirements, ongoing legal proceedings, or to comply with record retention obligations under federal or state law. In such cases, we will inform the Healthcare Partner of any PHI that cannot be deleted and the reason for retention.

If a patient has a representative acting on their behalf, sufficient proof of such authorization is required before Aira Health can approve requests to exercise the above-noted privacy rights.

---

How We Protect PHI

We take the security of PHI seriously and implement comprehensive safeguards to protect it:

Technical Security

• Encryption of data in transit and at rest
• Secure access controls and authentication, including audit logs and multi-factor authentication. We also ensure that access to PHI are on a strict "need-to-know" basis.
• Regular security monitoring and logging, including tests and audits
• Intrusion detection and prevention systems

Physical Security

• Restricted access to facilities where health information is stored
• Secure disposal of devices and media containing health information
• Measures in place to ensure the security of any physical devices housing PHI, including both company-issued and personal devices

Administrative Security

• HIPAA, privacy, and security awareness training for all Aira Health staff, including employees and contractors
• Regular security risk assessments
• Documented policies and procedures
• Incident response and breach notification protocols

Organizational Security

• Business Associate Agreements with all partners and third-party vendors (contractors and subcontractors)
• Regular compliance audits and monitoring, as well as off-cycle audits as mandated or required
• Designated Privacy and Security Officers, as well as a dedicated HIPAA Security Officer

---

International Data Transfers

Aira Health is based in the United States and may store or process your health information in other regions. We ensure that appropriate safeguards are in place to protect your information regardless of where it is processed, in accordance with HIPAA requirements and applicable international data protection laws.

---

Breach Notification

In the event of a breach where PHI is involved, we will notify the affected Healthcare Partner(s) without unreasonable delay so they can provide the affected patient(s) with appropriate notification and any required protective services, mitigation, and remediation.

---

Changes to This Privacy Notice

We reserve the right to revise this Privacy Notice at any time. When we make material changes, we will update the "Last Updated" date at the top of this notice and post the revised notice on our website at https://www.airahealth.io/privacy-policy. The revised notice will apply to all PHI we maintain.

---

Questions and Complaints

Questions About This Notice

If you have questions about this Privacy Notice or our privacy practices, please contact:

Filing a Complaint

With Your Healthcare Partner:
If you believe your privacy rights have been violated, you should first contact your Healthcare Partner directly, as they are primarily responsible for protecting your PHI.

With Us:
You may also file a complaint with us by contacting our HIPAA Security Officer using the information above. Please provide as much detail as possible with respect to your complaint so that we may provide you with a meaningful response.

With the U.S. Government:
You have the right to file a complaint with the U.S. Department of Health and Human Services:

---

Additional Information

Our Healthcare Partners

We provide services to numerous healthcare providers, health plans, and healthcare clearinghouses. For a list of our Healthcare Partners or questions about how a specific Healthcare Partner uses your information, please contact that Healthcare Partner directly.

Not a Notice of Privacy Practices

This Privacy Notice describes our practices as a Business Associate. Your Healthcare Partner is required to provide you with their own Notice of HIPAA Privacy Practices that describes how they use and share your health information. Please refer to your Healthcare Partner's notice for information about their privacy practices.

Other Applicable Laws

In addition to HIPAA, we comply with other applicable and binding privacy and security laws. Where laws provide greater privacy protections, we follow those stricter requirements.