Rx
MyRxWallet
Notice of Privacy Practices
HIPAA Privacy Notice · 45 CFR § 164.520
This Notice describes how MyRxWallet handles your Protected Health Information and your rights under HIPAA.
Read this Notice carefully. You have the right to a copy of this Notice at any time.
HIPAA / HITECH 45 CFR § 164.520 Patient Rights Effective May 1, 2026
📅
Effective Date: May 1, 2026  ·  Replaces all prior versions.
MyRxWallet reserves the right to change this Notice. Updated versions are posted at myrxwallet.io/hipaa.html and are effective for all health information we maintain. You may request a paper copy at any time.
⚖️
YOUR INFORMATION. YOUR RIGHTS. OUR RESPONSIBILITIES. This Notice applies to all health information we create, receive, maintain, or transmit in connection with the MyRxWallet platform. MyRxWallet North America Corporation operates primarily as a HIPAA Business Associate conduit under 45 CFR § 164.501. We are committed to protecting your health information and will not use or share your information other than as described here without your written authorization.
Section 1 — Who We Are

MyRxWallet North America Corporation ("MyRxWallet," "we," "us") is a digital health technology company headquartered as a Wyoming corporation, operating a patient-sovereign health data infrastructure platform across the United States.

We operate principally as a HIPAA conduit Business Associate under 45 CFR § 164.501. As a conduit, we facilitate the transmission of Protected Health Information (PHI) between covered entities at your direction — similar to how the postal service delivers mail — without creating, receiving, maintaining, or using PHI except as necessary to provide the transmission service.

We also operate as a HIPAA Business Associate to healthcare providers, health plans, and other covered entities that use our platform to access, exchange, or store patient health information. In this capacity, we handle PHI under written Business Associate Agreements (BAAs).

Where we act on behalf of a covered entity, that covered entity's Notice of Privacy Practices governs your rights with respect to that relationship. This Notice covers our own uses and disclosures of your information and your rights in dealing directly with MyRxWallet.

Section 2 — How We Use and Disclose Your Health Information

The following table summarizes all the ways we may use or disclose your health information:

PurposeAuthorization Required?Legal Authority
Treatment — facilitate transmission to your providers at your directionCONSENT ONLY45 CFR § 164.506
Payment — process billing with your insurer at your requestCONSENT ONLY45 CFR § 164.506
Healthcare Operations — internal quality, compliance, trainingMINIMUM NECESSARY45 CFR § 164.506
Required by Law — court orders, subpoenas, law enforcementNOT REQUIRED45 CFR § 164.512(f)
Public Health — disease reporting, FDA safety, CDC surveillanceNOT REQUIRED45 CFR § 164.512(b)
Health Oversight — government audits, inspections, investigationsNOT REQUIRED45 CFR § 164.512(d)
Judicial Proceedings — authorized court orders or legal processNOT REQUIRED45 CFR § 164.512(e)
Serious Threat to Health/Safety — imminent, serious threatNOT REQUIRED45 CFR § 164.512(j)
Research — de-identified or IRB-approved waiverAUTHORIZATION OR WAIVER45 CFR § 164.512(i)
Marketing — use of your PHI to promote products or servicesWRITTEN AUTHORIZATION45 CFR § 164.508(a)(3)
Sale of PHI — disclosing PHI in exchange for remunerationWRITTEN AUTHORIZATION45 CFR § 164.508(a)(4)
Any other use or disclosure not listed aboveWRITTEN AUTHORIZATION45 CFR § 164.508
WHAT WE NEVER DO: We never sell your PHI to data brokers, insurance underwriters, employers, or advertisers. We never use your health information for advertising targeting. We never access the contents of your encrypted MyRx-Vault (only you hold the decryption key). We never share your records without your explicit, revocable consent.
Section 3 — Your Rights Regarding Your Health Information

Under HIPAA and the 21st Century Cures Act, you have the following rights with respect to your health information:

📂
Right to Access Your PHI
You may inspect and receive a copy of your health records we hold. We will provide records in the electronic format you request. Turnaround: within 30 days.
45 CFR § 164.524
✏️
Right to Request Amendment
If you believe your health records are incorrect or incomplete, you may request an amendment. We may deny requests for information not created by us or that is accurate and complete.
45 CFR § 164.526
📋
Right to Accounting of Disclosures
You may request a list of disclosures of your PHI made by us in the past 6 years (excluding Treatment, Payment, Operations, and authorized disclosures).
45 CFR § 164.528
🚫
Right to Request Restrictions
You may request restrictions on how we use or disclose your PHI for Treatment, Payment, or Operations. We must agree to restrict disclosures to a health plan if you have paid for a service out-of-pocket in full.
45 CFR § 164.522
🔐
Right to Confidential Communications
You may request that we communicate with you about your health matters in a specific way or at a specific location (e.g., only by email, only to a specific address).
45 CFR § 164.522(b)
🔔
Right to Breach Notification
If a breach of your unsecured PHI occurs, we will notify you without unreasonable delay and within 60 days of discovering the breach, per the HIPAA Breach Notification Rule.
45 CFR §§ 164.400–414
📄
Right to a Paper Copy of This Notice
You may request a paper copy of this Notice at any time, even if you have agreed to receive it electronically. Email us at privacy@myrxwallet.io and we will mail a copy within 10 business days.
45 CFR § 164.520(c)(1)(i)
↩️
Right to Revoke Authorization
You may revoke any written authorization you have given us at any time. Revocations must be submitted in writing. Revocation is effective immediately and recorded on-chain in our audit ledger.
45 CFR § 164.508(b)(5)
How to Exercise Your Rights: Submit a written request to privacy@myrxwallet.io with subject line "HIPAA Rights Request — [Right Name]". We will respond within 30 days. Most requests can also be submitted through your MyRxWallet patient portal account settings.
Section 4 — Our Responsibilities

MyRxWallet is required to:

  • Maintain the privacy of your PHI and abide by the terms of this Notice currently in effect
  • Notify you promptly if a breach of your unsecured PHI occurs that may have compromised your privacy or security § 164.404
  • Follow the terms of this Notice and any written Authorization you have provided
  • Not use or disclose your PHI other than as described in this Notice or as required or permitted by law
  • Provide you with a copy of this Notice upon request § 164.520
  • Not retaliate against you for filing a complaint with us or with the U.S. Department of Health and Human Services § 164.530(g)
Section 5 — How to File a Privacy Complaint

If you believe your privacy rights have been violated, you may file a complaint with:

📧 MyRxWallet Privacy Office
Email: privacy@myrxwallet.io
Subject: "Privacy Complaint"
Response time: 30 days
Mail: MyRxWallet North America Corp.
Attn: Privacy Officer
[Registered Agent address on file with Wyoming SOS]
🏛️ U.S. Department of Health & Human Services
Office for Civil Rights (OCR):
www.hhs.gov/ocr/privacy
Phone: 1-800-368-1019
TDD: 1-800-537-7697
Mail: Hubert H. Humphrey Building
200 Independence Ave SW, Washington DC 20201
No Retaliation: We will not retaliate against you in any way for filing a complaint, regardless of the outcome. 45 CFR § 164.530(g)
Section 6 — Contact Information
Effective: May 1, 2026  ·  Version 1.0  ·  Supersedes all prior notices.
Print / Save as PDF   Sign Patient Consent Form   Business Associate Agreement
Governing Legal Framework
45 CFR § 164.520 — NPP Requirements
Requires covered entities to provide patients with a Notice of Privacy Practices describing how PHI is used and individual rights.
45 CFR §§ 164.500–164.534 — Privacy Rule
The HIPAA Privacy Rule establishes national standards for the protection of individually identifiable health information.
45 CFR §§ 164.300–164.318 — Security Rule
The HIPAA Security Rule requires covered entities and BAs to protect electronic PHI through administrative, physical, and technical safeguards.
HITECH Act §§ 13400–13423 (42 U.S.C. § 17921 et seq.)
The Health Information Technology for Economic and Clinical Health Act strengthened HIPAA protections and extended BA obligations.
21st Century Cures Act § 4004 — Information Blocking
Prohibits practices that block patients' access to their health information and requires covered entities to provide electronic access.
45 CFR §§ 164.400–164.414 — Breach Notification Rule
Requires notification to individuals, HHS, and (if applicable) media within 60 days of discovering a breach of unsecured PHI.