HIPAA Notice of Privacy Practices
Effective Date: June 8, 2026
Last Updated: June 8, 2026
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
This Notice of Privacy Practices (“Notice”) applies to protected health information (“PHI”) that HealthKey Labs, LLC doing business as Arxova™ (“Arxova,” “we,” “our,” “us”) receives, maintains, or transmits at your direction through the Arxova™ mobile application and website (collectively, the “Service”) — for example, electronic health records you choose to import through Fasten Health. We are committed to protecting the privacy of your PHI and to handling it in accordance with the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (“HIPAA”), as applicable.
Arxova™ is built around a patient-owned model. You decide what health information enters the Service, where it is stored, and with whom it is shared. Your health information is encrypted on your device, and only you hold the decryption keys.
1.How We May Use and Disclose Your PHI
Because Arxova™ processes your PHI at your direction, the ways we use and disclose it are limited and, in most cases, occur only because you have asked us to. The categories below describe the permitted uses and disclosures.
At Your Direction and With Your Authorization
We use and disclose your PHI to operate the features you choose to use — for example, to import records you request through Fasten Health, to store records you choose to encrypt and save, to display your information back to you, and to share information with recipients you specifically authorize. Most uses and disclosures of your PHI will be made only with your written authorization, and you may revoke that authorization at any time as described in Section 3.
Treatment, Payment, and Health Care Operations
If and where applicable, we may use or disclose your PHI to support your treatment, payment, or health care operations only as you direct or as otherwise permitted by law. Arxova™ does not provide medical care and does not bill insurers; these disclosures occur only at your request.
Service Providers (Business Associates)
We may share PHI with service providers that perform functions on our behalf, such as HIPAA-aligned infrastructure providers. Where required, we enter into Business Associate Agreements (BAAs) that obligate these providers to safeguard your PHI and to use it only for the purposes for which they were engaged.
As Required by Law
We may use or disclose your PHI when required to do so by federal, state, or local law, or in response to a valid legal process, to the extent and in the manner the law requires.
2.Uses and Disclosures That Require Your Authorization
The following uses and disclosures will be made only with your written authorization:
- Most sharing of your PHI with any third party.
- Any sharing of your health information for research, which is offered only as an opt-in feature with a separate, explicit consent process and only after de-identification, as described in our Privacy Policy.
- Any use or disclosure for marketing, and any disclosure that would constitute a sale of PHI. Arxova™ does not sell your PHI.
Any authorization you provide may be revoked at any time, in writing, except to the extent we have already acted in reliance on it.
3.Your Rights Regarding Your PHI
You have the following rights with respect to your PHI:
- Right to access. You may inspect and obtain a copy of the health information you have stored in the Service. You may request a complete export of your data at any time through the app.
- Right to amend. You may request that we amend health information you believe is incorrect or incomplete.
- Right to an accounting of disclosures. You may request a list of certain disclosures we have made of your PHI. Access and consent events in the Service are recorded in your in-app audit log.
- Right to request restrictions. You may request a restriction on how your PHI is used or disclosed. You control which data sources are connected and may revoke access to any of them at any time through the app.
- Right to confidential communications. You may request that we communicate with you in a specific way or at a specific location.
- Right to revoke authorization. You may revoke an authorization at any time, and revocation is logged.
- Right to a paper or electronic copy of this Notice. You may request a copy of this Notice at any time.
Please note: health records you choose to store permanently on the Arweave network are immutable by the nature of that network and cannot be deleted, even upon request. This is disclosed before any such storage occurs and requires your explicit, separate consent.
4.Our Duties
- We are required by law to maintain the privacy and security of your PHI.
- We will let you know promptly if a breach occurs that may have compromised the privacy or security of your information, in accordance with HIPAA's Breach Notification Rule and applicable law.
- We must follow the duties and privacy practices described in this Notice and provide you with a copy of it.
- We will not use or share your PHI other than as described here unless you tell us we can in writing. If you tell us we can, you may change your mind at any time.
5.Changes to This Notice
We may change this Notice from time to time. Any change will apply to PHI we already maintain as well as information we receive in the future. The revised Notice will be posted on this page with an updated “Last Updated” date, and, where a change is material, we will notify you through the app.
6.How to File a Complaint
If you believe your privacy rights have been violated, you may file a complaint with us using the contact details below. You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, by calling 1-877-696-6775, or by visiting www.hhs.gov/ocr/privacy/hipaa/complaints. We will not retaliate against you for filing a complaint.
7.Contact Us
Email: contact@arxova.health
Operated by: HealthKey Labs, LLC d/b/a Arxova™
Address: 382 NE 191st St PMB #924568, Miami, FL 33179
See also our Privacy Policy.
Arxova™ is a trademark of HealthKey Labs, LLC. This Notice is provided to describe our HIPAA privacy practices for protected health information received through the Service.