Privacy Policy

1. Introduction

Welcome to YBT Health. This Privacy Policy describes how Medicare Services Enterprises, LLC, doing business as YBT Health ("YBT Health," "we," "us," or "our"), collects, uses, discloses, and protects your personal information when you access or use our website, mobile applications, telehealth platform, and related services (collectively, the "Services").

YBT Health provides the technology and support behind your care. Licensed healthcare providers use our platform to deliver mental and behavioral health services, and your provider is responsible for the care you receive. We are committed to protecting your privacy and handling your personal and health information responsibly and in compliance with applicable federal and state laws, including the Health Insurance Portability and Accountability Act ("HIPAA").

By accessing or using our Services, you acknowledge that you have read and understand this Privacy Policy. If you do not agree with our practices, please do not use our Services.

2. Information We Collect

We collect:

• Visit information: the name you enter at check-in, the live audio and video from your camera and microphone during a visit, chat messages you send during a visit, and transcripts and summaries created to support your provider's documentation (see Section 5).
• Device and usage data, collected automatically: IP address, browser and device type, access times, connection quality data, and essential cookies (Section 12).

We do not collect your medical history, insurance information, or payment details. Your provider maintains your medical record in their own systems.

3. How We Use Your Information

We use this information to:

• Run your telehealth visits and connect you with your provider.
• Create transcripts and summaries for your provider's documentation (Section 5).
• Keep the Services secure, reliable, and improving.
• Meet legal obligations, including HIPAA.

4. SMS & Text Messaging

We may send you text messages for the following purposes:

• Telehealth visit links and instructions
• Appointment reminders and scheduling confirmations
• Account and security notifications

Opting Out of Text Messages

You may opt out of receiving text messages at any time by replying STOP to any message you receive from us. After you send STOP, we will send you a confirmation message to acknowledge your request. Once opted out, you will no longer receive SMS messages from us unless you re-enroll.

You may also opt out by contacting us at support@oneybt.com or by calling (310) 575-2649.

Help

For help with our text messaging program, reply HELP to any message, email support@oneybt.com, or call (310) 575-2649.

Carrier Liability

Carriers are not liable for delayed or undelivered messages. Message and data rates may apply. Check with your mobile carrier for details about your messaging plan.

Consent Not Required for Purchase

Your consent to receive text messages is not a condition of purchasing any goods or services from YBT Health. You may use our Services and receive care without opting in to text messaging. Opting out of text messages will not affect your ability to receive treatment or access your account.

Data Sharing for Messaging

We use a third-party messaging service provider to deliver SMS and MMS messages. Your phone number and message content are shared with this provider solely for the purpose of delivering messages to you. We do not sell, rent, loan, or share your phone number, opt-in information, or messaging consent data with third parties or affiliates for their marketing or promotional purposes.

5. Telehealth Sessions: Recording, Transcription & AI

Because this is one of the most important questions patients ask about telehealth, we answer it directly:

• We do not record your sessions. Telehealth visits are not video-recorded, and we do not store audio or video recordings of your sessions.
• Transcription and summaries: the audio of your visit may be transcribed and summarized, including through secure automated tools that use artificial intelligence, to help your provider complete clinical documentation. Transcripts and summaries created for this purpose become part of the medical record your provider maintains and are retained as described in Section 9.
• Vendors: any service provider that processes session audio for transcription or summarization does so on our behalf under a Business Associate Agreement and may not use your information for its own purposes.
• No model training: we do not use your identifiable health information, session audio, transcripts, or clinical summaries to train artificial intelligence models.
• No voiceprints or biometrics: we do not create voiceprints or any biometric identifiers from your audio or video. Transcription runs on our own infrastructure, and your audio is not sent to outside transcription services.
• Technical session data: connection and quality logs for telehealth sessions (such as join and leave times and connection quality) are retained for a limited period, generally about thirty (30) days, and then deleted.

You will also see a notice about transcription when you check in for a telehealth visit. If you have questions or concerns, please raise them with your provider before your visit begins.

6. How We Share Your Information

We do not sell your personal information, and we do not "sell" or "share" personal information for cross-context behavioral advertising, as those terms are defined in the California Consumer Privacy Act. We may share your information in the following circumstances:

• Your provider: everything from your visit (audio, video, chat, transcripts, and summaries) is shared with your provider and their care team; that is what the platform is for.
• Service providers: we work with vendors who assist with delivering our Services, such as secure cloud hosting, text-message delivery, and transcription processing. They are contractually obligated to protect your information and may only use it to provide services on our behalf.
• Legal requirements: we may disclose your information when required by law, regulation, subpoena, court order, or other legal process, or when necessary to protect the safety of you or others.
• Public health and safety: as permitted or required by law, we may disclose information to public health authorities, to prevent or lessen a serious and imminent threat to health or safety, or to report suspected abuse, neglect, or domestic violence.
• Business transfers: in the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change in ownership or control.
• With your consent: we may share your information for purposes not described in this Privacy Policy with your explicit authorization.

7. HIPAA & Protected Health Information

The licensed healthcare providers who treat you through our platform are covered entities under the Health Insurance Portability and Accountability Act (HIPAA). When YBT Health handles protected health information (PHI) on their behalf, such as delivering telehealth sessions or processing visit transcripts, it does so as a business associate under written agreements. We protect PHI in accordance with HIPAA and its implementing regulations.

Your provider's own Notice of Privacy Practices governs how they use and disclose your health information. Ask your provider for a copy.

Your rights under HIPAA include, but are not limited to:

• The right to receive a Notice of Privacy Practices describing how we use and disclose your PHI.
• The right to request restrictions on certain uses and disclosures of your PHI.
• The right to access and obtain a copy of your PHI.
• The right to request amendments to your PHI.
• The right to receive an accounting of disclosures of your PHI.
• The right to request confidential communications.
• The right to file a complaint with us or with the U.S. Department of Health and Human Services if you believe your privacy rights have been violated.

To exercise any of these rights, please contact us using the information provided in Section 18 of this Privacy Policy.

8. Data Security

We take the security of your information seriously and implement administrative, technical, and physical safeguards designed to protect your personal and health information, including:

• Encryption of data in transit and at rest using industry-standard protocols.
• Role-based access controls limiting access to authorized personnel only.
• Regular security assessments and vulnerability monitoring.
• Secure authentication mechanisms, including multi-factor authentication.
• Audit logging of access to patient records and sensitive information.
• Business Associate Agreements with third-party vendors who handle PHI.

While we strive to protect your information, no method of electronic transmission or storage is completely secure. If you have reason to believe your account or information has been compromised, please contact us immediately.

9. Data Retention

We retain your personal and health information for as long as necessary to fulfill the purposes described in this Privacy Policy, comply with our legal and regulatory obligations, and resolve disputes. Specifically:

• Transcripts and summaries: made available to your provider and retained on the platform for a limited period.
• Technical session logs: retained for a limited period and then deleted. Session audio and video are not stored.

When information is no longer required, we securely destroy or de-identify it in accordance with applicable laws and our data destruction policies.

10. Data Breach Notification

In the event of a breach of unsecured protected health information, we will notify affected individuals, the U.S. Department of Health and Human Services, and, where required, the media, in accordance with the HIPAA Breach Notification Rule (45 CFR §§ 164.400-414).

Notification will be provided without unreasonable delay and no later than sixty (60) calendar days from the date we discover the breach, and within any shorter period required by applicable state law. Notifications will be sent via first-class mail to your last known address (or by email if you have agreed to receive electronic notices) and will include:

• A description of the breach and the types of information involved.
• Steps you should take to protect yourself from potential harm.
• A description of what we are doing to investigate the breach, mitigate harm, and prevent future breaches.
• Contact information for you to ask questions or obtain additional information.

We also comply with applicable state breach notification laws, which may require additional or faster notification in certain circumstances.

11. Your Rights & Choices

Depending on your state of residence and applicable law, you may have the following rights regarding your personal information:

• Access: the right to request access to the personal information we hold about you.
• Correction: the right to request correction of inaccurate personal information.
• Deletion: the right to request deletion of your personal information, subject to certain exceptions (e.g., legal retention requirements for medical records).
• Data portability: the right to receive a copy of your personal information in a structured, commonly used, and machine-readable format.
• Opt-out of communications: the right to opt out of non-essential communications, including marketing emails and text messages.
• Non-discrimination: we will not discriminate against you for exercising any of your privacy rights.

To exercise any of these rights, please contact us at support@oneybt.com or by calling (310) 575-2649. We will respond to your request within the timeframe required by applicable law.

12. Cookies & Tracking Technologies

Our Services use only essential cookies, meaning those required for the Services to function, such as keeping you signed in and securing your session. We do not use analytics cookies, advertising cookies, tracking pixels, or any third-party advertising or behavioral-targeting technologies.

You can control cookies through your browser settings, but disabling essential cookies may prevent parts of the Services (such as signing in) from working.

Do Not Track Signals

Some web browsers transmit "Do Not Track" (DNT) signals to websites. Because there is no universally accepted standard for how to respond to DNT signals, our Services do not respond to them. As noted above, we do not use analytics, advertising, or cross-site tracking technologies at all.

13. Children's Privacy

Our Services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children under 18 without the consent of a parent or legal guardian. If we become aware that we have inadvertently collected personal information from a child under 18 without appropriate consent, we will take steps to delete that information promptly.

If you are a parent or guardian and believe your child has provided us with personal information without your consent, please contact us at support@oneybt.com.

14. De-Identified & Aggregated Data

We do not create de-identified data sets from patient information for research, marketing, or commercial purposes, and we do not sell or license patient data in any form. We do not use patient information to train artificial intelligence models. Internal operational reporting (such as service quality metrics) is handled as protected health information under this Privacy Policy and HIPAA.

15. Geographic Limitations

Our Services are intended for use within the United States. We do not knowingly collect personal information from individuals located outside the United States. If you access our Services from outside the United States, you do so at your own risk and are responsible for compliance with your local laws. By using our Services, you consent to the transfer and processing of your information in the United States.

16. State-Specific Disclosures

California Residents

If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), including the right to know what personal information we collect and how it is used, the right to request deletion, and the right to opt out of the sale or sharing of personal information. YBT Health does not sell personal information. To exercise your California privacy rights, please contact us using the information in Section 18.

Shine the Light (Civil Code § 1798.83): we do not disclose personal information to third parties for their direct marketing purposes.

Other State Privacy Laws

Residents of other states with comprehensive privacy laws (including but not limited to Colorado, Connecticut, Virginia, Utah, and Texas) may have similar rights. We will comply with applicable state privacy laws. Please contact us to exercise your rights under your state's privacy law.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the services we offer. When we make material changes, we will update the "Last Updated" date at the top of this page and, where appropriate, notify you via email or a prominent notice within our Services.

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information.

18. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

If you believe your privacy rights have been violated, you also have the right to file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights at www.hhs.gov/hipaa/filing-a-complaint.