Prevant Health Nursing Corporation
Effective Date: July 6, 2026
Last Updated: July 6, 2026
Prevant Health Nursing Corporation ("Prévant Health," "we," "us," or "our") is a virtual concierge functional medicine practice. Prévant means to prevent — and that philosophy extends to how we treat your information. We collect only what we need, we tell you plainly what we do with it, and we protect it with the same care we bring to your health.
This Privacy Policy explains how we collect, use, disclose, and protect information when you visit prevanthealth.com (the "Site"), use the Prévant Health mobile application or patient portal (together, the "Services"), communicate with us, or become a member of our practice. It also explains the privacy rights available to you and how to exercise them.
Please read this Policy together with two companion documents:
- Notice of Privacy Practices (HIPAA) — available at prevanthealth.com/legal/notice-of-privacy-practices. If you are a patient, the medical information we create and maintain about you is "protected health information" ("PHI") governed by the federal Health Insurance Portability and Accountability Act ("HIPAA"). Our Notice of Privacy Practices — not this Policy — describes how we use and disclose PHI and your rights with respect to it. Where this Policy and the Notice of Privacy Practices both could apply to the same information, the Notice of Privacy Practices controls.
- Consumer Health Data Privacy Policy — available at prevanthealth.com/legal/consumer-health-data-privacy-policy. Certain states (including Washington, Nevada, and Connecticut) provide additional protections for health-related information that falls outside HIPAA — for example, information we may collect about website visitors who are not yet patients. That policy describes those practices and rights in detail.
This Policy is provided as a notice and does not create a contract. Where the law requires your separate, affirmative consent for a particular practice (for example, the collection of consumer health data through tracking technologies), your use of the Site alone does not constitute that consent — we will ask for it expressly. If you do not agree with our practices, please do not use the Site or Services.
1. Summary (The Short Version)
- We are a healthcare provider, not a data business. We do not sell your personal information for money, and we never sell, rent, or trade protected health information or genetic information.
- Your medical record is governed by HIPAA and our Notice of Privacy Practices, with stronger protections than ordinary consumer data.
- Our marketing website uses standard analytics and advertising tools (described in Section 6) so we can understand how people find us and improve our Site. You can opt out, and we honor Global Privacy Control signals. Where state law requires it, we obtain your consent before these tools collect health-related information.
- We do not use advertising trackers inside the patient portal or mobile app. The authenticated areas where your care happens are not connected to third-party advertising technology.
- You have rights — to access, correct, delete, and port your information, and to opt out of targeted advertising — and we extend the core set of these rights to everyone we serve, regardless of which state you live in. See Section 12.
- Questions? Email hello@prevanthealth.com, call (888) 428-0000, or write to us at 2506 Bransford Ave Ste 6, Nashville, TN 37204.
This summary is for convenience only; the full Policy below governs.
2. Scope: The Three Kinds of Information We Handle
Because we are both a medical practice and the operator of a public website, different rules apply to different information. Understanding these three categories will help you know which document and which rights apply to you.
A. Protected Health Information (PHI). Information in your medical record and related billing records once you become a patient — your history, labs, diagnoses, treatment plans, visit notes, messages with your care team, and payment information tied to your care. Governed by HIPAA and our Notice of Privacy Practices.
B. Consumer Health Data. Health-related information about individuals that is not PHI — for example, if a website visitor who is not a patient joins our interest list, completes a form describing their health goals, or interacts with health-related pages in a way that could reveal information about their health. Governed by our Consumer Health Data Privacy Policy and, where applicable, state consumer health data laws such as the Washington My Health My Data Act, Nevada SB 370, and the Connecticut Data Privacy Act's consumer health data provisions.
C. General Personal Information. Everything else — device and browsing data, contact details you provide, marketing preferences, payment information for membership fees, and similar information. Governed by this Policy and applicable state consumer privacy laws.
Information can move between categories. For example, when an interest-list subscriber becomes a patient, information incorporated into their medical record becomes PHI and is thereafter governed by our Notice of Privacy Practices.
3. Information We Collect
3.1 Information You Provide Directly
- Contact and identity information: name, email address, phone number, mailing address, state of residence, and date of birth.
- Consultation and enrollment information: the state you select in our booking flow, appointment preferences, scheduling details, and information you share when booking a free 15-minute consult or enrolling in membership.
- Interest list and waitlist information: your name, email, state, and any health goals or interests you choose to share when joining our interest list — including in states where we are not yet available.
- Intake and health information: health history, symptoms, medications, lab results, lifestyle details, and goals you submit through our secure intake process. Once you are an established patient, this information is PHI governed by our Notice of Privacy Practices.
- Payment and billing information: membership tier, billing address, and payment card or bank details. Payment card data is collected and processed by our PCI-compliant payment processor; we do not store full card numbers on our own systems.
- Communications: emails, text messages, contact form submissions, phone call details, reviews or testimonials you authorize, and survey responses.
- Household member information: if you add a partner or child to your membership, the enrollment information you provide about them. You must have authority to provide this information (see Section 15 regarding minors).
3.2 Information Collected Automatically
When you visit the Site, we and our service providers automatically collect:
- Device and browser information: IP address, browser type and version, operating system, device identifiers, screen dimensions, and language settings.
- Usage information: pages viewed, time on page, links clicked, scroll depth, referring website, and the date and time of your visit.
- Marketing attribution information: campaign parameters attached to the link you clicked to reach us — such as UTM parameters and advertising click identifiers (for example, Google's
gclid/gbraid/wbraid and Meta's fbclid) — and associated advertising cookies (such as _fbp and _fbc). We use these to understand which of our advertising and outreach efforts are working.
- Cookies and similar technologies: as described in Section 6.
Inside the patient portal and mobile app, we collect the technical information necessary to operate the Services securely (such as login events, device information for security purposes, and crash diagnostics). We do not deploy third-party advertising pixels, social media trackers, or ad-network cookies within authenticated patient areas.
3.3 Information from Other Sources
- Laboratories and diagnostic partners: results from labs and specialty testing you authorize.
- Pharmacies, imaging centers, and outside providers: records shared as part of your care and care coordination (governed by HIPAA once part of your record).
- Health information exchanges: where applicable and permitted by law, to support your treatment.
- Payment processors: confirmation of payment status.
- Advertising and analytics platforms: aggregate campaign performance data.
- Publicly available sources and review platforms: such as reviews you post publicly.
We do not purchase lists of consumer health information, and we do not use data brokers to build health profiles of prospective patients.
4. How We Use Information
We use personal information for the following purposes:
- To provide the Services: operating the Site, portal, and app; scheduling consults and visits; verifying your state of residence for licensing purposes; processing enrollment; and administering your membership.
- To provide medical care: uses of PHI for treatment, payment, and health care operations are described in our Notice of Privacy Practices.
- To communicate with you: appointment reminders, care-related messages, billing notices, service announcements, responses to your inquiries, and — with your consent where required — newsletters and educational content.
- To manage the interest list: notifying you when membership cohorts open or when Prévant Health becomes available in your state.
- To improve the Site and Services: analytics, testing, troubleshooting, and understanding how visitors use our pages.
- To market our practice responsibly: measuring the performance of our advertising, attributing inquiries and enrollments to campaigns, and reaching people who may benefit from our care. Where required by law, we obtain consent before collecting or using health-related information for these purposes, and we configure our advertising tools to avoid transmitting health information to advertising platforms.
- For security and fraud prevention: protecting the Site, Services, our patients, and our practice from malicious, deceptive, fraudulent, or illegal activity.
- For legal compliance: meeting our obligations under federal and state law, including healthcare licensing, recordkeeping, tax, and audit requirements.
- With your consent: for any other purpose we describe at the time of collection.
We collect, use, and retain personal information only as reasonably necessary and proportionate to the purposes disclosed above, and we do not process it for materially new purposes without providing notice and, where required, obtaining your consent.
5. How We Disclose Information
We disclose personal information to the following categories of recipients, for the purposes described in Section 4:
- Service providers and processors who work on our behalf under contracts restricting their use of your information, including: website hosting and development platforms; secure patient portal, electronic health record, and telehealth vendors; scheduling tools; payment processors; email, SMS, and communications providers; cloud storage and IT security vendors; and analytics providers. Service providers that handle PHI do so under HIPAA business associate agreements.
- Laboratories, pharmacies, imaging partners, and outside specialists involved in your care, as described in our Notice of Privacy Practices.
- Supplement dispensary partners, when you choose to order professional-grade supplements through your member account.
- Advertising and analytics platforms (such as Google and Meta), limited to the Site usage and attribution information described in Section 6. We configure these integrations to exclude health information and portal activity, and you may opt out as described in Sections 6 and 12.
- Professional advisors: lawyers, accountants, auditors, and insurers, under confidentiality obligations.
- Government authorities and others as required by law: in response to lawful requests, court orders, or subpoenas; to comply with licensing, public health, and mandatory reporting obligations; or to protect the rights, safety, and property of our patients, our team, or others. Disclosures of PHI in these circumstances are made only as permitted by HIPAA and applicable state law.
- Successors in a business transaction: if Prévant Health is involved in a merger, acquisition, reorganization, or sale of assets, personal information may be transferred as part of that transaction, subject to this Policy, HIPAA (for PHI), and applicable state law restrictions on the transfer of health data.
What we do not do:
- We do not sell personal information in exchange for money.
- We do not sell, rent, or trade PHI, consumer health data, or genetic information — and we will not do so without the separate, valid authorization required by law.
- We do not share the contents of your medical record, your messages with your care team, or your lab results with advertising platforms.
- We do not use or disclose information about your reproductive or sexual health, gender-affirming care, or immigration status for marketing purposes.
A note on "sale" and "sharing" under state law. Some state laws define "sale" or "sharing" broadly enough to include the disclosure of identifiers and browsing activity to advertising platforms through cookies and pixels — even when no money changes hands. To the extent our use of advertising cookies on the public marketing Site constitutes a "sale," "sharing," or processing for "targeted advertising" under your state's law, you have the right to opt out, and we honor that right (including via the Global Privacy Control). See Sections 6 and 12. We do not knowingly sell or share the personal information of anyone under 18, and we do not use targeted advertising directed at minors.
6. Cookies, Analytics, and Advertising Technology
6.1 What We Use
The public marketing pages of the Site use cookies, pixels, tags (deployed via Google Tag Manager), and similar technologies in these categories:
- Strictly necessary: required for the Site to function — page delivery, security, load balancing, and remembering your cookie choices. These cannot be switched off.
- Analytics: help us understand Site traffic and usage (for example, Google Analytics). Data is used in aggregate to improve the Site.
- Advertising and attribution: help us measure whether our advertising works and reach people who may be interested in our practice (for example, Google Ads and Meta tags, and the campaign parameters described in Section 3.2).
6.2 What We Deliberately Limit
- No advertising technology in patient areas. Third-party advertising pixels and social media trackers are not deployed within the authenticated patient portal or mobile app.
- No health details to ad platforms. We configure our advertising integrations to avoid transmitting information about your health conditions, symptoms, appointments, or the contents of forms describing your health. Conversion events we send to advertising platforms are limited to non-health actions (such as "a booking was completed") without medical detail.
- Consent where required. For visitors in states whose laws require consent before health-related data may be collected through tracking technologies (including Washington, Nevada, and Connecticut), non-essential cookies and pixels are deployed only after you consent through our cookie banner. You may withdraw consent at any time through the cookie preferences link on our Site.
6.3 Your Choices
- Cookie preferences: use the cookie banner or the "Cookie Preferences" link in the Site footer to accept, decline, or customize non-essential cookies at any time.
- Global Privacy Control (GPC): we treat a GPC signal from your browser as a valid request to opt out of targeted advertising and any "sale" or "sharing" of your personal information, as required in states including California, Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, Oregon, and Texas.
- Platform opt-outs: Google Analytics opt-out browser add-on (tools.google.com/dlpage/gaoptout); Google ad settings (adssettings.google.com); Meta ad preferences (facebook.com/adpreferences); industry tools at optout.aboutads.info and optout.networkadvertising.org.
- Browser controls: most browsers allow you to block or delete cookies. Doing so may affect Site functionality.
- "Do Not Track": because there is no common industry standard for legacy DNT signals, we do not respond to them; we do, however, honor GPC as described above.
7. Artificial Intelligence Disclosure
We do not sell personal information, and we do not collect, use, or sell personal information for the purpose of training large language models. If we use AI-enabled tools in our operations (for example, drafting assistance, transcription, or analytics tools), we do so under contracts that prohibit the vendor from using our patients' or visitors' personal information to train their models, and any AI-assisted output that informs your care is reviewed by your provider. This disclosure is provided in accordance with the Connecticut Data Privacy Act, as amended effective July 1, 2026.
8. Genetic Information
Our services may include genetic and genomic testing (for example, APOE genotyping and nutrigenomic panels such as MTHFR and COMT) ordered as part of your care. We treat genetic information with heightened protection:
- Genetic testing is performed only with your express informed consent, obtained before samples are collected or data is analyzed.
- Genetic information in your record is PHI under HIPAA and is additionally protected by state genetic privacy laws in effect in states we serve, including Arizona, California, Montana, Utah, and Tennessee.
- We do not sell genetic information, do not disclose it to advertising platforms, and do not disclose it to employers, health insurers, or life/disability/long-term-care insurers except as you direct or as the law requires. The federal Genetic Information Nondiscrimination Act (GINA) also restricts how employers and health insurers may use genetic information.
- You may revoke consent for future use of your genetic information and request destruction of your genetic sample and data, subject to laboratory retention requirements and medical recordkeeping laws. Our laboratory partners are contractually or legally required to honor applicable state genetic privacy laws.
9. Reproductive and Sexual Health Information
As a practice focused on women's health, we handle information about menopause, hormones, fertility, contraception, sexual health, and related care every day — and we hold it to the highest standard of confidentiality:
- We disclose reproductive and sexual health information only as permitted by HIPAA and applicable state law, and several states we serve (including Washington and California) impose additional restrictions on disclosing such information, which we follow.
- We do not voluntarily disclose reproductive or sexual health information for use in investigations or proceedings against a person for seeking or obtaining lawful health care. Where we receive legal demands for such information, we require valid legal process, seek to narrow overbroad requests, and notify you where the law allows.
- We never use reproductive or sexual health information for advertising.
10. Text Messages, Email, and Communications
- SMS: by providing your mobile number and opting in, you consent to receive appointment reminders, care-related messages, and account notifications by text. Message frequency varies; message and data rates may apply. Reply STOP to opt out and HELP for help. Consent to marketing texts, where offered, is separate and never a condition of receiving care. Your mobile opt-in and phone number are not shared with third parties for their own marketing.
- Email: transactional and care-related email is part of the Services. Marketing email is sent only with appropriate consent, and every marketing email includes an unsubscribe link.
- Unsecure channels: standard email and SMS are not encrypted end-to-end. If you contact us through these channels, we may respond in kind, but we encourage you to use the secure patient portal or app for anything involving your health. Never use email or text for a medical emergency — call 911.
11. Data Retention and Security
Retention. We retain personal information only as long as reasonably necessary for the purposes described in this Policy, and then delete or de-identify it. Retention periods are determined by: (a) medical record retention laws in the states where we practice (generally ranging from 5 to 10 years after the last patient encounter, and longer for minors); (b) tax, accounting, and licensing requirements; (c) the duration of your membership and any applicable statutes of limitation; and (d) for marketing data, the shorter of the period needed for the purpose collected or your opt-out. Interest-list information is retained until you unsubscribe or ask us to delete it.
Security. We maintain administrative, technical, and physical safeguards designed to protect personal information — including encryption in transit and at rest for patient data, access controls and role-based permissions, multi-factor authentication for clinical systems, business associate agreements with vendors handling PHI, workforce confidentiality obligations, and security monitoring aligned with the HIPAA Security Rule. No method of transmission or storage is 100% secure; if a breach affecting your information occurs, we will notify you and regulators as required by HIPAA and applicable state breach notification laws.
12. Your Privacy Rights
12.1 Rights We Extend to Everyone
Regardless of where you live, you may:
- Access / Know: request confirmation of whether we process your personal information and a copy of it, including, where applicable, the categories collected, the purposes, the categories of recipients, and — where required by your state's law — a list of the third parties to which we have disclosed personal information.
- Correct: request correction of inaccurate personal information. (Corrections to your medical record follow the amendment process in our Notice of Privacy Practices.)
- Delete: request deletion of personal information, subject to exceptions — most importantly, medical records that the law requires us to retain.
- Port: obtain a copy of personal information you provided to us in a portable, readily usable format.
- Opt out of targeted advertising and any "sale"/"sharing": via the cookie preferences link, the Global Privacy Control, or a request to us.
- Opt out of profiling in furtherance of decisions that produce legal or similarly significant effects. We do not use automated decision-making to make significant decisions about you without human involvement; clinical decisions are always made by your provider.
- Limit sensitive information: we obtain consent before processing sensitive personal information for non-exempt purposes and do not sell sensitive personal information; you may withdraw consent at any time.
- Non-discrimination: we will never deny care, charge different prices, or provide a different quality of service because you exercised a privacy right.
12.2 How to Exercise Your Rights
Submit a request by:
These channels are designated for privacy questions and rights requests only; they are not valid channels for legal notice, service of process, or other formal legal communications (see Section 18).
We will verify your identity using information we already hold (and, for patients, our standard identity verification procedures) before acting on a request. An authorized agent may submit a request on your behalf with written permission signed by you; we may still verify your identity directly. Parents or legal guardians may exercise rights on behalf of their minor children.
We will respond within 45 days, and may extend once by an additional 45 days where reasonably necessary, with notice to you. Requests to opt out of targeted advertising or any "sale"/"sharing" are honored within 15 business days. Requests are free up to twice per 12-month period; we may charge a reasonable fee or decline manifestly unfounded, excessive, or repetitive requests as the law allows.
Appeals. If we decline your request, we will explain why, and you may appeal by replying to our decision, emailing hello@prevanthealth.com with the subject "Privacy Appeal," or writing to the mailing address in Section 18. We will respond to appeals within the period required by your state's law (generally 45–60 days). If your appeal is denied, you may contact your state Attorney General; we will provide a link or contact method in our appeal response.
Note for patients: requests to access, amend, or restrict your medical record are handled under HIPAA and our Notice of Privacy Practices, which in some respects give you stronger rights (and in others, different procedures) than state consumer privacy laws.
12.3 State-Specific Disclosures
The following supplements apply to residents of states with comprehensive consumer privacy laws that we serve or may serve. Where a state law exempts PHI or HIPAA-covered entities, those exemptions apply to your medical information; the disclosures below principally concern Site, marketing, and other non-PHI data.
California (CCPA/CPRA). In the preceding 12 months we have collected the categories of personal information described in Section 3, which correspond to the following statutory categories: identifiers; customer records (Cal. Civ. Code § 1798.80(e)); characteristics of protected classifications (age, sex — as relevant to care); commercial information; internet or other electronic network activity; geolocation (coarse, from IP); audio/visual (telehealth, per our Notice of Privacy Practices); professional information (as volunteered); inferences; and sensitive personal information (health information and account log-in credentials; we do not collect precise geolocation). Sources, purposes, and recipients are described in Sections 3–5. We do not "sell" personal information for money; our use of advertising cookies may constitute "sharing" for cross-context behavioral advertising, which you may opt out of via the "Your Privacy Choices" / cookie preferences link or GPC. We do not use or disclose sensitive personal information for purposes other than those permitted by § 7027(m) of the CCPA regulations. We do not knowingly sell or share personal information of consumers under 16. Retention criteria appear in Section 11. California patients also have rights under the Confidentiality of Medical Information Act (CMIA), which we honor. California's "Shine the Light" law (§ 1798.83): we do not disclose personal information to third parties for their own direct marketing. When linked at or before the point of collection, this Policy serves as our notice at collection. We do not offer financial incentives in exchange for personal information.
Colorado (CPA), Connecticut (CTDPA), Delaware (DPDPA), Iowa (ICDPA), Maryland (MODPA), Minnesota (MCDPA), Montana (MCDPA), Nebraska (NDPA), New Hampshire (NHDPA), Oregon (OCDPA), Rhode Island (RIDTPPA), Utah (UCPA), and Tennessee (TIPA) — and, should we serve their residents, Indiana, Kentucky, New Jersey, Texas, and Virginia. Residents have the rights in Section 12.1 to the extent provided by their state's law, exercisable as described in Section 12.2, including the right to appeal. Additional notes:
- Connecticut: effective July 1, 2026, the CTDPA applies to entities processing sensitive data without regard to volume thresholds; we obtain consent before processing sensitive data, obtain separate consent before any sale of sensitive data (which we do not conduct), honor the right to obtain a list of third parties to which personal data was disclosed, and provide the AI disclosure in Section 7. Consumer health data protections are described in our Consumer Health Data Privacy Policy.
- Maryland (MODPA): we limit collection to what is reasonably necessary; we collect and process sensitive data only where strictly necessary to provide the services you request; and we do not sell sensitive data — Maryland law prohibits it, and it is our practice everywhere.
- Minnesota: you may question the result of profiling that produces a legal or similarly significant effect (we do not conduct such profiling), and you may obtain a list of the specific third parties to which your personal data has been disclosed. Certain identifiers (e.g., SSNs, financial account numbers) will be described rather than reproduced in access responses, as the law requires.
- Oregon: you may obtain a list of specific third parties to which we have disclosed personal data. Oregon's law exempts PHI but not HIPAA-covered entities as such; we honor OCDPA rights for non-PHI data. We do not sell precise geolocation data (we do not collect it).
- Rhode Island: the categories of third parties to which personal data may be disclosed are listed in Section 5; we do not sell personal data for monetary consideration.
- Nevada: under NRS 603A, you may direct us not to sell covered information (we do not sell it); submit requests as described in Section 12.2. Nevada consumer health data rights (SB 370) are described in our Consumer Health Data Privacy Policy.
- Utah: we provide notice and the rights required by the UCPA, including the right of correction effective July 2026.
- Montana: rights under the MCDPA as amended effective October 1, 2025, including for consumers aged 13–17 the protections applicable to minors' data. Montana's Genetic Information Privacy Act applies to genetic data as described in Section 8.
- Tennessee: Prevant Health Nursing Corporation is organized in Tennessee, and we honor Tennessee Information Protection Act rights for Tennessee residents to the extent applicable.
Washington and Nevada consumer health data. The Washington My Health My Data Act and Nevada SB 370 provide specific rights — consent, access (including the third parties with whom consumer health data was shared), withdrawal of consent, and deletion — for "consumer health data" outside HIPAA. These are described in our Consumer Health Data Privacy Policy, which is linked from our homepage.
New York. New York residents are protected by New York's data security requirements (SHIELD Act), and we monitor the New York Health Information Privacy Act, which, if signed into law, will impose additional requirements on health-related information outside HIPAA. We will update this Policy and our practices before any such law takes effect.
Residents of states without comprehensive privacy laws (including Alaska, Arizona, the District of Columbia, Hawaii, Idaho, Kansas, Maine, Massachusetts, New Mexico, North Dakota, South Dakota, Vermont, and Wyoming): we extend the baseline rights in Section 12.1 to you voluntarily, and you retain all rights under HIPAA and your state's medical confidentiality, genetic privacy, and breach notification laws.
Future states. As Prévant Health expands, this Policy applies to residents of each new state we serve, and we will update Section 12.3 to reflect any state-specific requirements before beginning operations there.
13. De-Identified Information
We may create and use de-identified or aggregate information (information that can no longer reasonably be linked to you) for analytics, quality improvement, and practice development. Where we use de-identified data, we maintain it without attempting to re-identify it, we contractually require recipients to do the same, and we publicly commit to processing it only in de-identified form, consistent with HIPAA's de-identification standards and state law.
14. Third-Party Websites and Services
The Site links to third-party websites and services — for example, laboratory portals, the Apple App Store and Google Play, Healthgrades, supplement dispensaries, and social media platforms. Those services have their own privacy policies, and we are not responsible for their practices. In particular, reviews you post on third-party platforms are governed by those platforms' terms. Review the privacy policy of any third-party service before providing information to it.
15. Children and Minors
Our Site and marketing are directed to adults. We do not knowingly collect personal information online from children under 13, and if we learn we have done so outside of a treatment relationship authorized by a parent or guardian, we will delete it (contact us at hello@prevanthealth.com). Minors may receive care through a household membership only when enrolled by a parent or legal guardian, who provides consent and exercises the minor's privacy rights, subject to state laws that give adolescents independent confidentiality rights for certain services — which we honor. We do not sell minors' personal information or use it for targeted advertising.
16. Telehealth Across State Lines
Prévant Health provides care virtually in the states listed on our Locations page. Your state of residence determines both whether we may treat you and which state privacy laws apply to you; that is why our booking flow begins with state selection. If you join our interest list from a state we do not yet serve, we use your information only to gauge demand and notify you when we become available there, as described in this Policy and our Consumer Health Data Privacy Policy. Our Services are intended for individuals located in the United States; we do not target or direct the Services to individuals in the European Economic Area or the United Kingdom.
17. Changes to This Policy
We may update this Policy from time to time. When we do, we will revise the "Last Updated" date above, and for material changes we will provide more prominent notice — such as a notice on the Site or an email to members — before the change takes effect. If a retroactive material change would apply to previously collected personal information, we will provide notice and an opportunity to withdraw consent where required by law. Prior versions are available on request.
18. Contact Us and Legal Notices
Privacy questions and rights requests. For questions about this Policy or to exercise the privacy rights described in Section 12:
Prevant Health Nursing Corporation
Attn: Privacy
2506 Bransford Ave Ste 6
Nashville, TN 37204
Email: hello@prevanthealth.com
Phone: (888) 428-0000
NPI: 1245770791
Legal notices — by mail only. Any legal notice to Prevant Health Nursing Corporation — including demand letters, notices of claim or dispute, pre-suit or statutory notices, indemnification or insurance notices, intellectual-property notices, and any other notice required or permitted by law, contract, or this Policy — must be delivered exclusively by U.S. certified mail (return receipt requested) or by a nationally recognized courier with delivery confirmation, addressed to:
Prevant Health Nursing Corporation
Attn: Legal
2506 Bransford Ave Ste 6
Nashville, TN 37204
Service of process must be made on our registered agent as identified in our public filings with the applicable Secretary of State or as otherwise permitted by applicable rules of civil procedure. Prévant Health does not accept legal notices or service of process by email, telephone, text message, fax, patient portal or app message, website form, or social media; communications sent through those channels do not constitute legal notice and will be deemed not received for legal-notice purposes.
For questions about your medical record or HIPAA rights, see our Notice of Privacy Practices. If you believe your HIPAA rights have been violated, you may file a written complaint with us at the mailing address above (Attn: Privacy) and with the U.S. Department of Health and Human Services, Office for Civil Rights (hhs.gov/ocr) — you will never be treated differently for filing a complaint.
Prévant Health does not provide emergency services. If you are experiencing a medical emergency, call 911 or go to the nearest emergency room.
