Privacy Policy and HIPAA Notice of Privacy Practices

Effective Date: 01/01/2026
Last Updated: 01/01/2026

This page explains how Ventress Medical, Inc. collects, uses, shares, and protects information from website visitors, people who contact us, and patients and clients who contract directly with us. When we handle protected health information, we follow HIPAA requirements and apply appropriate confidentiality and security practices.

Privacy Policy

1) Scope

This notice applies to visitors to this website, people who contact us by web form, email, phone, or referral, and patients and clients who contract directly with Ventress Medical, Inc. It also applies to individuals whose information we handle while providing case management, legal nurse consulting, medical record review, care coordination, and related services.

If you have an emergency, call 911. Do not use this website or email for urgent medical concerns.

2) Our role and why this matters

Ventress Medical may operate as a direct service provider working with patients and clients, or as a business associate or subcontractor working for a health plan, provider, employer, insurer, third party administrator, attorney, or other organization. Your rights and the process for requests can vary depending on who controls the official record for the engagement.

3) Information we collect

A. Website and communications

Contact information you submit (name, email, phone, address)
Messages and attachments you send us
Scheduling and intake details you provide
Technical data such as IP address, browser and device type, pages viewed, and approximate location (city/state)
Cookies and similar technologies (see Cookies and analytics below)

B. Health, claim, and service information

Medical records, diagnoses, treatment information, medications, and care plans
Case notes, assessments, functional status, restrictions, and outcomes
Insurance and claim details (claim number, adjuster info, employer info)
Billing and payment information (when you contract directly with us)
Communications with providers, facilities, pharmacies, and other involved parties

4) How we use information

Provide services you request and perform contracted work
Coordinate care and communicate with involved parties as appropriate
Perform medical record review, reporting, and recommendations
Bill for services and process payments when you contract directly with us
Maintain quality, safety, compliance, and operational functions
Secure our systems, prevent fraud, and respond to legal requests

5) How we share information

With you and your authorized representatives, subject to identity verification and legal limits.
For services and coordination with providers, facilities, pharmacies, labs, therapists, and others involved in your care coordination or claim administration as permitted by law, authorization, or the engagement terms.
With payers and related parties when services involve insurance or workers’ compensation, as permitted by law and contract.
With our vendors who support operations, such as hosting, document management, IT, secure storage, and communications (for example Microsoft 365 and SharePoint). Vendors receive only what they need and must protect it.
Legal, safety, and compliance when required by law, court order, subpoena, or to protect rights and safety, investigate fraud, and maintain system security.

We do not sell protected health information.

6) Communication choices and email risk

Email is convenient but not always secure end to end. If you choose to email us, you understand there is some risk of interception or misdelivery. If you prefer secure delivery, ask us for secure options such as encrypted email or a secure link.

7) Your choices for non HIPAA website data

Request access to or deletion of certain website information we maintain, subject to legal and operational limits.
Opt out of marketing emails (if we send any) using the unsubscribe link or by contacting us.
Control cookies through your browser settings.

8) Arkansas notice for security incidents

If we experience a security incident involving certain personal information of Arkansas residents, Arkansas law generally requires notice without unreasonable delay and may require notice to the Arkansas Attorney General in larger incidents. Arkansas law also allows a business to document a determination that no reasonable likelihood of harm occurred and requires retention of the written determination and supporting documentation for five years. Separate HIPAA breach notification rules may apply if unsecured PHI is involved.

9) Data retention

We retain information for as long as needed to provide services, meet professional obligations, satisfy contracts, and comply with law. When information is no longer required, we dispose of it securely.

10) Cookies and analytics

We may use cookies and similar technologies for site functionality, security, and basic analytics to understand site usage and improve performance. You can block cookies in your browser, but parts of the site may not function properly.

11) Third party links

Our website may link to third party sites. Their privacy practices are not under our control. Review their policies before submitting information.

12) Children and minors

This website is not designed for children under 13. We do not knowingly collect information from children under 13 through the website. If we provide services to a minor, we will require appropriate parent or legal guardian consent and authorization consistent with applicable law.

13) Changes to this policy

We may update this notice. The updated version will be posted on this page with a new effective date.

HIPAA Notice of Privacy Practices

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

A) Our duties

Maintain the privacy of protected health information (PHI)
Provide you with this Notice of our legal duties and privacy practices
Follow the terms of the Notice currently in effect
Notify affected individuals following a breach of unsecured PHI

B) How we may use and disclose PHI without your written authorization

Examples below are common in case management and related services. Not every example applies to every engagement.

Treatment and care coordination: Use and share PHI to coordinate care, communicate with providers, and support recommended treatment plans.
Payment: Use and share PHI for billing, coverage, reimbursement, and payment activities, including verifying benefits and responding to payer requests.
Health care operations: Use and share PHI for quality review, training, credentialing, compliance, auditing, and general administration.
As required by law: Disclose PHI when required by law, including to comply with court orders and certain regulatory requests.
Workers’ compensation: Disclose PHI as permitted by HIPAA and applicable workers’ compensation or similar laws to support claim administration and benefits determinations.
Business Associates: Share PHI with vendors that help us provide services, under agreements requiring them to protect the information.

C) Uses and disclosures that require your written authorization

We will obtain your written authorization for uses or disclosures not described in this Notice unless permitted or required by law. You may revoke an authorization in writing, except to the extent action has already been taken based on it.

D) Your HIPAA rights

When HIPAA applies and we maintain the relevant record set, you have the right to:

Get a copy of your PHI (inspect and obtain a copy)
Ask us to correct your PHI (request an amendment)
Request confidential communications (ask us to contact you in a specific way)
Ask us to limit what we use or share (we are not required to agree in all cases)
Get a list of certain disclosures (an accounting)
Get a paper copy of this Notice even if you agreed to receive it electronically

To exercise these rights, contact the Privacy Officer listed below. We may require identity verification and a written request. If another organization controls the official record for your case, we may direct your request to that organization.

E) Complaints

If you believe your privacy rights have been violated, you can complain to us and to the U.S. Department of Health and Human Services, Office for Civil Rights. We will not retaliate for filing a complaint.

F) Acknowledgment of receipt for direct services

When HIPAA applies and we provide direct services, we may ask you to sign an acknowledgment that you received this Notice, and we will document our efforts if we cannot obtain acknowledgment.

Contact and Privacy Officer

Privacy Officer: Jeremy Ventress - CTO, Ventress Medical, Inc.

Email: admin@ventressmedical.com

Phone: 702.703.4466

Mailing Address: 5313 Hwy 5, Suite 305 #1009, Bryant, AR 72022

Note: If a payer, provider, employer, or TPA controls the official record for your case, requests may need to be directed to them.