Qare Privacy Policy

Including the Notice of Privacy Practices

This Privacy Policy explains what information is collected through the getqare.com website and the Qare telehealth platform (together, the "Services"), how it is used and protected, and the rights you have. Section 8 is the Notice of Privacy Practices required by the Health Insurance Portability and Accountability Act ("HIPAA").

1. Who Handles Your Information

Ibby Health Solutions ("Qare," "we," "us," "our") operates the Platform. Qare is a technology and administrative services company and does not practice medicine.

Medical care is provided by Qare Medical Group, P.C. (the "Medical Group") and its affiliated licensed clinicians. Under HIPAA, the Medical Group is the covered entity responsible for your medical record. Qare acts as the Medical Group's business associate and handles your health information on its behalf under a written business associate agreement that requires HIPAA-level protection.

The Services are available to patients located in New Jersey and Pennsylvania. Additional states are added as licensure permits.

2. Information We Collect

Information you give us

Account information: name, email address, phone number, date of birth, and the state where you are located
Health information: symptoms, medical history, current medications, allergies, and other information you provide during intake, during a visit, or in secure messages
Identity verification: a government-issued photo identification, used to confirm your identity and age
Payment information: collected and processed by our payment processor. Qare does not store full payment card numbers

Information collected automatically

Device and usage information: browser type, device type, IP address, pages visited, and general location at the city or state level
Cookies strictly necessary for the site to function, such as keeping you signed in and protecting against fraud

3. How We Use Information

To provide the Services, including connecting you with a Provider and transmitting prescriptions to your chosen pharmacy
To verify your identity, your age, and the state you are located in
To process payment and send communications about your visit
To operate, secure, monitor and improve the Platform
To comply with legal obligations, including health care regulations and record retention requirements

4. What We Do Not Do

We do not sell your personal information. We do not share your health information with advertisers or advertising platforms. We do not use your health information for marketing without your written authorization. No advertising, analytics or session-recording technology operates on the intake flow or on any page behind your account login.

5. How We Share Information

With your Provider and the Medical Group, to deliver and document your care
With pharmacies you select, to fill prescriptions
With service providers who help operate the Platform, including secure hosting, video consultation, electronic prescribing and payment processing, each under a contract that limits how they may use your information and, where health information is involved, a business associate agreement
When required by law, including responses to lawful process and mandatory reporting obligations
In a corporate transaction, such as a merger or acquisition, in which case this Policy continues to apply to your information and you will be notified of any material change

6. Cookies and Tracking

We use only cookies that are strictly necessary for the Services to function, including session, authentication and security cookies. We do not use advertising cookies, advertising pixels, cross-site tracking, session replay or heat-mapping technology anywhere that health information is collected or displayed. If this changes, this Policy will be updated before the change takes effect and, where consent is required, we will ask for it first.

7. How We Protect Information

Your information is encrypted in transit and at rest. Access is limited to the workforce members and Providers who need it to deliver the Services, enforced through individual accounts, multi-factor authentication and role-based permissions, and recorded in audit logs that are reviewed on a regular schedule. Access is removed promptly when a person's role ends. No system is completely secure, so please also protect your own account credentials.

8. Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

This Notice is issued by Qare Medical Group, P.C., the covered entity responsible for your protected health information ("PHI").

How your health information may be used and disclosed

Treatment. Your Provider uses your PHI to evaluate, diagnose and treat you, and may share it with other clinicians, pharmacies or facilities involved in your care.
Payment. Your PHI may be used to obtain payment for your visit.
Health care operations. Your PHI may be used for quality assessment, clinical review, credentialing, training, compliance auditing and similar operational activities.
As required or permitted by law. This includes public health reporting and disease control, reporting suspected abuse, neglect or domestic violence, health oversight activities, judicial and administrative proceedings, certain law enforcement requests, coroners and funeral directors, organ donation, workers' compensation, specialized government functions, research subject to approval, and averting a serious and imminent threat to health or safety.

Uses that require your written authorization

Most uses and disclosures of psychotherapy notes, any use of your PHI for marketing, and any sale of your PHI require your written authorization. Any other use or disclosure not described in this Notice will be made only with your written authorization. You may revoke an authorization in writing at any time, except to the extent it has already been acted on.

Your rights

Access. You may inspect and obtain an electronic or paper copy of your medical record. We will respond within the time required by law and may charge a reasonable, cost-based fee for copies.
Amendment. You may ask us to correct PHI you believe is inaccurate or incomplete. We may deny the request, and you may submit a statement of disagreement.
Accounting of disclosures. You may request a list of certain disclosures of your PHI made in the six years prior to your request.
Restrictions. You may request limits on how your PHI is used or disclosed. We are not required to agree, except that if you pay for a service in full out of pocket, you may require that information about it not be disclosed to a health plan.
Confidential communications. You may ask us to contact you at a particular address or by a particular method, and we will accommodate reasonable requests.
Breach notification. You will be notified if a breach compromises the privacy or security of your unsecured PHI.
Paper copy. You may request a paper copy of this Notice at any time, even if you agreed to receive it electronically.
Complaint. You may complain to us or to the federal government without penalty.

Our responsibilities

We are required by law to maintain the privacy and security of your protected health information.
We are required to notify you promptly if a breach occurs that may have compromised the privacy or security of your information.
We must follow the duties and privacy practices described in this Notice and give you a copy of it.
We will not use or share your information other than as described here unless you tell us we may in writing. If you tell us we may, you may change your mind at any time in writing.
We reserve the right to change the terms of this Notice, and the changes will apply to all information we hold. The revised Notice will be posted on getqare.com and available on request.

How to complain

If you believe your privacy rights have been violated, contact our Privacy Officer:

Haroon Arshad, Privacy Officer
Qare Medical Group, P.C.
Email: info@getqare.com

You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, at 200 Independence Avenue SW, Washington, D.C. 20201, by calling 1-877-696-6775, or at hhs.gov/ocr/privacy/hipaa/complaints. You will not be penalized or retaliated against for filing a complaint.

Effective date of this Notice: September 9, 2026.

9. How Long We Keep Information

Medical records are retained for the period required by the law of the state where you received care, which in some states is longer than seven years. Account and usage information is retained while your account is active and afterward as needed to meet legal, tax and compliance obligations, then deleted or de-identified. Deleting your account does not delete your medical record, which must be retained by law.

10. Age Requirement

The Services are for adults 18 and older only. We do not provide care to patients under 18 and do not knowingly collect information from anyone under 18. You must confirm your date of birth during intake. If we learn that we have collected information from someone under 18, we will delete it promptly. A parent or guardian who believes we may hold information about a minor can contact us at info@getqare.com.

11. State Privacy Rights

Health information held by the Medical Group is governed by HIPAA and by the medical confidentiality laws of the state where you received care, several of which provide protections beyond HIPAA, including for reproductive health and mental health information.

Residents of states with comprehensive consumer privacy laws, including Connecticut and Virginia, may have rights regarding personal information that is not protected health information, such as the right to access, correct, delete or obtain a copy of that information, to opt out of targeted advertising or sale, and to appeal a denied request. Information governed by HIPAA is exempt from these laws. To make a request, contact info@getqare.com. We will verify your identity before responding and will respond within the time your state requires.

12. Changes to This Policy

If we make material changes, we will post the updated Policy with a new effective date and notify you through the Platform or by email before the changes take effect. Prior versions are retained and available on request.

13. Contact Us

Privacy questions and requests to exercise any of the rights above: info@getqare.com

Please do not include medical details in email. Email is not a secure channel. For anything involving your health, use the secure messaging inside your Qare account.