Privacy Policy

Regenerative Pain & Spine ("we," "us," or "our") operates the Regenerative Pain & Spine Portal ("Portal"), a secure clinical operations platform designed to support HIPAA-aligned privacy and security safeguards at carejourneypro.com. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you access or use our Portal.

By accessing or using the Portal, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree with the terms of this Privacy Policy, please do not access the Portal.

• Protected Health Information (PHI) means individually identifiable health information that is created, received, maintained, or transmitted by a covered entity, including demographic data, that relates to an individual's past, present, or future physical or mental health condition, the provision of health care, or payment for health care.
• Covered Entity means a health care provider, health plan, or health care clearinghouse that transmits health information electronically. Regenerative Pain & Spine is a covered entity under HIPAA.
• Business Associate means a person or entity that performs functions or activities on behalf of, or provides certain services to, a covered entity that involve the use or disclosure of PHI.
• Electronic Protected Health Information (ePHI) means PHI that is created, stored, transmitted, or received in electronic form.

Regenerative Pain & Spine is a covered entity under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), as amended by the Health Information Technology for Economic and Clinical Health (HITECH) Act. We are required by law to maintain the privacy and security of your PHI, to provide you with notice of our legal duties and privacy practices with respect to your PHI, and to notify you in the event of a breach of your unsecured PHI.

Permitted Uses and Disclosures of PHI

We may use and disclose your PHI for the following purposes:

• Treatment: To provide, coordinate, and manage your health care, including consultations between health care providers regarding your care.
• Payment: To obtain payment for health care services, including billing, claims management, and collection activities.
• Health Care Operations: To support our business activities, including quality assessment, case management, care coordination, staff training, and business planning.
• As Required by Law: When required by federal, state, or local law.
• Public Health Activities: To public health authorities for purposes of preventing or controlling disease, injury, or disability.
• Health Oversight: To health oversight agencies for activities authorized by law, such as audits and investigations.
• Workers' Compensation: As authorized by and to the extent necessary to comply with workers' compensation laws.
• Legal Proceedings: In response to a court or administrative order, subpoena, discovery request, or other lawful process.

Your Rights Regarding Your PHI

• Right to Access: You have the right to inspect and obtain a copy of your PHI maintained by Regenerative Pain & Spine, with limited exceptions. We may charge a reasonable, cost-based fee for copies.
• Right to Amend: You have the right to request that we amend your PHI if you believe it is incorrect or incomplete. We may deny your request under certain circumstances, but we will provide you with a written explanation.
• Right to an Accounting of Disclosures: You have the right to request a list of certain disclosures of your PHI that we have made, other than for treatment, payment, health care operations, and certain other purposes.
• Right to Request Restrictions: You have the right to request restrictions on certain uses and disclosures of your PHI. We are not required to agree to your request, except in certain circumstances involving self-pay patients.
• Right to Request Confidential Communications: You have the right to request that we communicate with you about your health matters in a certain way or at a certain location.
• Right to a Copy of this Notice: You have the right to obtain a paper copy of this Privacy Policy upon request.
• Right to File a Complaint: If you believe your privacy rights have been violated, you may file a complaint with us or with the Secretary of the U.S. Department of Health and Human Services. You will not be penalized or retaliated against for filing a complaint.

In compliance with 42 CFR Part 2 and the 2024 HIPAA Final Rule aligning Part 2 with HIPAA, any records related to substance use disorder diagnosis, treatment, or referral are afforded additional protections. SUD records may not be used to investigate or prosecute a patient. Disclosures of SUD records require specific written consent unless otherwise permitted by law.

Information You Provide Directly

• Account registration information (name, email address, role)
• Clinical and case management data entered by authorized clinical staff
• Messages sent through the secure messaging system
• Documents uploaded to the Portal
• Patient demographic information (name, date of birth, contact information)

Information Collected Automatically

• IP address and approximate geographic location
• Browser type, version, and operating system
• Access timestamps and session duration
• Pages viewed and actions taken within the Portal
• Device identifiers and screen resolution (for responsive display)

Cookies and Tracking Technologies

We use strictly necessary cookies for authentication, session management, and security purposes only. Server-managed portal session cookies are configured as httpOnly, Secure, and SameSite=Strict, and the activity cookie is signed to detect tampering. Cognito browser tokens are stored in Secure, SameSite=Strict cookies while the application migrates toward a fully server-owned session model. We do not use advertising cookies, marketing trackers, or third-party analytics that collect personal information, and we do not engage in cross-site tracking.

We use the information we collect for the following purposes:

• Providing, operating, and maintaining the Portal and its features
• Authenticating users and managing role-based access permissions
• Processing and managing patient cases and care coordination
• Facilitating secure messaging between authorized internal staff and external legal representatives
• Generating operational reports and analytics for clinical management
• Maintaining comprehensive audit logs as required by HIPAA
• Detecting, preventing, and responding to security threats
• Improving Portal functionality, performance, and usability
• Complying with legal and regulatory obligations

We implement comprehensive administrative, physical, and technical safeguards to protect all information processed through the Portal, including:

• Encryption at Rest: AES-256 encryption for all stored data, with column-level encryption (pgcrypto) applied to all PHI fields in our database
• Encryption in Transit: TLS 1.2 or higher for all data transmissions
• Key Management: AWS Key Management Service (KMS) for centralized encryption key management
• Authentication: AWS Cognito with multi-factor authentication (MFA) required for administrative roles
• Access Control: Role-based access control (RBAC) with five distinct permission levels, enforced on every API request
• Session Security: Automatic session timeout after 2 hours of inactivity, signed server-managed activity cookies, and secure cookie attributes
• Audit Logging: Append-only audit logs of all PHI access, stored in AWS CloudWatch
• Network Security: AWS Web Application Firewall (WAF), CloudFront CDN with DDoS protection
• Input Validation: Zod schema validation on all API inputs, parameterized queries to prevent injection attacks
• Document Security: Pre-signed URLs with time-limited expiry for document access

All data is stored exclusively within Amazon Web Services (AWS) infrastructure in the US-East-1 (Virginia) region. We have executed a Business Associate Agreement (BAA) with AWS covering all services that process, store, or transmit PHI. No PHI is transmitted to or stored in any system outside of our BAA-covered infrastructure.

Services covered under our AWS BAA include: Amazon RDS (PostgreSQL), Amazon S3, Amazon Cognito, AWS Lambda, Amazon API Gateway, AWS KMS, Amazon CloudWatch, Amazon SES, Amazon ECS Fargate, Amazon CloudFront, and AWS Secrets Manager.

We maintain Business Associate Agreements (BAAs) with all third-party service providers that may create, receive, maintain, or transmit PHI on our behalf:

• Amazon Web Services (AWS) — Infrastructure, storage, computing, and security services
• DrChrono — Electronic Health Records (EHR) system integration

We do not sell, trade, rent, or otherwise disclose your personal information or PHI to any third party for marketing or commercial purposes. We do not share data with data brokers.

We retain PHI and clinical data in accordance with applicable federal and state regulations, including but not limited to Illinois medical records retention requirements. Specifically:

• Medical records are retained for a minimum of 10 years from the date of last treatment, or longer as required by law
• Audit logs are maintained indefinitely as append-only records
• Account data is retained for the duration of the user's authorized access and for a reasonable period thereafter as required by law
• Messaging records are retained in accordance with applicable litigation hold and regulatory requirements

In the event of a breach of unsecured PHI, we will notify affected individuals without unreasonable delay and no later than 60 days after discovery of the breach, as required by the HIPAA Breach Notification Rule (45 CFR Part 164, Subpart D). If a breach affects 500 or more individuals, we will also notify the U.S. Department of Health and Human Services and prominent media outlets in the affected jurisdiction.

Illinois Residents

If you are an Illinois resident, you may have additional rights under the Illinois Personal Information Protection Act (PIPA) and the Biometric Information Privacy Act (BIPA). We do not collect biometric information through the Portal.

California Residents

If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA), including the right to know what personal information is collected, the right to request deletion, and the right to opt out of the sale of personal information. We do not sell personal information. Note that HIPAA-covered PHI is exempt from CCPA/CPRA, but non-PHI personal information may be subject to these laws.

This Privacy Policy is available in an accessible format. If you need this document in an alternative format or require assistance understanding its contents, please contact us using the information provided below. We are committed to ensuring digital accessibility in compliance with Section 504 of the Rehabilitation Act and WCAG 2.1 Level AA standards.

The Portal's primary purpose is to manage Protected Health Information of patients, but as a user (clinical staff, attorney, billing partner, or other authorized workforce member), we also process certain information about you:

• Identity: name, email, role, organization affiliation, NPI (for clinicians)
• Authentication state: password hash (managed by AWS Cognito), MFA enrollment status, login timestamps, session activity, IP address, and user-agent
• Activity audit records: every PHI-access event tied to your user identifier, retained indefinitely as an append-only forensic trail (HIPAA § 164.312(b))

This user-data is processed under our legitimate interest in operating a clinical platform with HIPAA-aligned safeguards and meeting our audit-trail obligations. It is not sold, rented, or shared with third parties for marketing.

You may request a copy of the user-data we hold about you, or request correction of inaccurate fields, by contacting the Privacy Officer below. Audit records are retained as a compliance obligation and cannot be deleted on request, even after your account is terminated; access logs are required by HIPAA to be preserved.

The Portal is not intended for use by individuals under the age of 18 in an individual capacity. Minors' health information may be managed through the Portal by authorized clinical staff and legal representatives in accordance with applicable law.

We reserve the right to update or modify this Privacy Policy at any time. We will notify you of any material changes by posting the updated policy on this page with a revised "Last Updated" date. For significant changes affecting how we use or disclose PHI, we will provide direct notification through the Portal or via email. Your continued use of the Portal after any changes constitutes your acceptance of the updated Privacy Policy.

If you have questions or concerns about this Privacy Policy, wish to exercise any of your privacy rights, or need to file a complaint, please contact us:

You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights: