HIPAA Notice of Privacy Practices

Who this Notice applies to

This Notice is issued by WellNash LLC, a Tennessee limited liability company doing business as Mamaya Health, with its principal place of business at 1 Vantage Way, Ste E-130, Nashville, TN 37228. “We,” “us,” or “Mamaya” in this Notice refers to WellNash LLC operating the Mamaya Health brand, together with the clinical partners and Business Associates identified in our Privacy Policy.

Your rights under HIPAA

• Get a copy of your paper or electronic medical record.
• Correct your medical record when information is wrong or incomplete.
• Request confidential communications (specific phone numbers, email addresses, or mailing addresses).
• Ask us to limit what we use or share.
• Get a list of those with whom we’ve shared your information.
• Choose someone to act for you (for example, a health-care proxy).
• File a complaint if you believe your privacy rights have been violated — you will not be retaliated against.

How we typically use or share your PHI

• Treatment: sharing with your care team and care coordinators.
• Payment: billing your payor or collecting direct payment.
• Health care operations: internal quality improvement, credentialing, training.
• Public health and safety: as required or permitted by law (mandated reporting, imminent harm, etc.).
• Business Associates: vendors we’ve signed BAAs with (EHR/practice-management, secure hosting, transactional email).

Uses and disclosures requiring your authorization

We will obtain your written authorization before using or sharing your PHI for purposes other than those listed above — including for most marketing purposes, sale of PHI (we don’t do this), or disclosure of psychotherapy notes.

Patient stories and testimonials. If you choose to share your story with us, we obtain your written authorization first and record when you gave it. We publish only with the attribution you chose — anonymously, or with your first name. We never publish your last name, and we do not include clinical details unless you separately authorize that.

You may revoke an authorization at any time by writing to us. Revocation stops any further use or disclosure from that point on. It does not undo what was done while the authorization was in effect — and for a story that has been published on our website, it cannot recover copies already made by search engines or AI systems. Our Privacy Policy sets out what withdrawal can and cannot reach.

Breach notification

In the unlikely event of a breach that may have compromised your PHI, we will notify you and applicable authorities within the timeframes required by HIPAA.

Contact

Privacy Officer: support@mamayahealth.com

You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights: 200 Independence Avenue SW, Washington DC 20201, or hhs.gov/ocr/privacy/hipaa/complaints.