Notice of Privacy Practices
Effective Date: June 21, 2026 · Last Revised: June 21, 2026
⚠️ THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
Who We Are
GenericContacts.com is a HIPAA-covered entity that handles Protected Health Information (PHI) in the form of contact lens prescriptions and related health data. This Notice applies to all PHI we create, receive, maintain, or transmit.
Our Commitment to Privacy
We are required by law to maintain the privacy of your PHI, to provide you with this Notice of our legal duties and privacy practices, and to notify you following a breach of unsecured PHI. We are required to abide by the terms of this Notice currently in effect.
How We Use and Disclose Your Health Information
Treatment: We use your prescription information to verify and fulfill your contact lens order. We may share your prescription with our licensed opticians and pharmacist staff for verification purposes.
Healthcare Operations: We use PHI for quality assurance, staff training, compliance activities, and improving our services. This includes maintaining audit logs of all PHI access as required by HIPAA.
Required by Law: We may disclose your PHI when required by federal, state, or local law, including in response to a court order, subpoena, or government investigation.
Public Health Activities: We may disclose PHI to public health authorities as required by law.
Business Associates: We share PHI with service providers (Business Associates) who assist in our operations, such as AWS for secure cloud storage. All Business Associates have signed HIPAA-compliant Business Associate Agreements (BAAs).
Uses and Disclosures Requiring Your Authorization
We will not use or disclose your PHI for the following purposes without your written authorization:
- Marketing communications
- Sale of your PHI
- Most uses of psychotherapy notes (not applicable to our services)
- Any other uses not described in this Notice
You may revoke your authorization at any time in writing, except where we have already acted in reliance on it.
Your Rights Regarding Your Health Information
Right to Access: You have the right to inspect and obtain a copy of your PHI that we maintain. Requests may be made to privacy@genericcontacts.com. We will respond within 30 days.
Right to Amend: You may request that we amend your PHI if you believe it is inaccurate or incomplete. We may deny the request under certain circumstances.
Right to an Accounting of Disclosures: You have the right to receive a list of certain disclosures we have made of your PHI within the past 6 years.
Right to Request Restrictions: You may request restrictions on how we use or disclose your PHI. We are not required to agree to all requests, but will attempt to accommodate reasonable requests.
Right to Confidential Communications: You may request that we communicate with you about your PHI using alternative means or at an alternative location.
Right to a Paper Copy of This Notice: You have the right to obtain a paper copy of this Notice at any time. Contact us at the address below.
Data Security Measures
- All PHI is encrypted in transit using TLS 1.2+
- Prescription files are stored encrypted (AES-256) on AWS S3 in a HIPAA-eligible environment
- Access to PHI requires authentication and is logged
- PHI access logs are retained and available for audit
- We have signed a Business Associate Agreement with AWS
Breach Notification
In the event of a breach of unsecured PHI, we will notify you in accordance with the HIPAA Breach Notification Rule, generally within 60 days of discovery of the breach.
Changes to This Notice
We reserve the right to change this Notice and make the revised Notice effective for PHI we already hold as well as any PHI we receive in the future. We will post the current Notice on our website. You may request a copy of the most current Notice at any time.
Complaints
If you believe your privacy rights have been violated, you may file a complaint with us or with the Secretary of the U.S. Department of Health and Human Services. You will not be retaliated against for filing a complaint.
Contact Our Privacy Officer
Privacy Officer, GenericContacts.com
Email: privacy@genericcontacts.com
For HIPAA complaints: U.S. Department of Health and Human Services, Office for Civil Rights
www.hhs.gov/hipaa/filing-a-complaint