HIPAA Notice

This is not legal advice or a document, just an initial draft to be reviewed by our legal counsel.

Rehab Ranger™ HIPAA Notice of Privacy Practices

Effective Date: 02/05/2026

THIS NOTICE DESCRIBES HOW PROTECTED HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN ACCESS THIS INFORMATION. PLEASE READ IT CAREFULLY.

1. Introduction

Protonest Labs LLC (“Protonest,” “Company,” “we,” “us,” or “our”) operates Rehab Ranger™, a rehabilitation technology product and platform that may support digital and/or in-person rehabilitation, telehealth, and related services (collectively, the “Services”)

In the course of providing Services, Protonest may collect, create, receive, or maintain protected health information (“PHI”), to the extent Protonest is acting as a covered entity or business associate under the Health Insurance Portability and Accountability Act of 1996, as amended (“HIPAA”), and applicable regulations.

This Notice of Privacy Practices (the “Notice”) describes how PHI may be used and disclosed by Protonest and explains your rights with respect to your PHI.

Rehab Ranger™ is a product and brand of Protonest Labs LLC and is not a separate legal entity.

This Notice applies only to PHI that is subject to HIPAA. Information collected through Rehab Ranger™ that is not subject to HIPAA may be governed by the applicable Privacy Policy and other terms governing the Services.

This Notice may be incorporated by reference into the applicable Terms and Conditions governing your use of the Services. If you have questions, concerns, or wish to exercise any HIPAA rights, please see Section 9.

2. Our Responsibilities

We are required by law to:

  • Protect and maintain the privacy of your PHI.
  • Provide you with this Notice describing our legal duties and privacy practices with respect to PHI.
  • Follow the terms of this Notice currently in effect.
  • Notify you in accordance with applicable law if a breach of your unsecured PHI occurs.

We will use or disclose your PHI as permitted or required by HIPAA and other applicable law, including as described in this Notice. Certain uses and disclosures may require your written authorization.

You may revoke a written authorization at any time, except to the extent we have already relied upon the authorization.

We reserve the right to change our privacy practices and to make the revised Notice applicable to PHI we maintain, as permitted by applicable law. If we make a material change, we will make the revised Notice available as required by law.

3. Your Rights

You have the following rights regarding your PHI. To exercise these rights, contact us using Section 9.

  1. Right to Access
    • You may request to inspect or obtain a copy of PHI contained in a designated record set that we maintain, subject to applicable legal limitations.
    • We may charge a reasonable, cost-based fee for copies where permitted by law.
    • We will generally respond to an access request within 30 days, subject to applicable law and any permitted extension. If we deny your request, we will provide a written explanation and information regarding applicable review or appeal rights.
  2. Right to Amend
    • You may request that we amend PHI that you believe is inaccurate or incomplete.
    • We may deny your request in certain circumstances permitted by law. If we deny your request, we will provide a written explanation.
  3. Right to Request Confidential Communications
    • You may request that we communicate with you about your PHI by a particular means or at a particular location.
    • We will accommodate reasonable requests as required by applicable law.
  4. Right to Request Restrictions
    • You may request restrictions on certain uses or disclosures of your PHI for treatment, payment, or healthcare operations.
    • We are generally not required to agree to a requested restriction, except where applicable law requires otherwise. Where you have paid for a service or item completely out of pocket and in full, you may request that PHI relating solely to that service or item not be disclosed to a health plan for payment or healthcare operations, where HIPAA requires us to honour such a request.
  5. Right to an Accounting of Disclosures
    • You may request an accounting of certain disclosures of your PHI made by us during the six (6) years preceding the date of your request, subject to applicable legal limitations.
    • The accounting generally does not include disclosures made for treatment, payment, or healthcare operations, among other exceptions permitted by law.
    • The first accounting requested during any 12-month period will generally be provided without charge. We may charge a reasonable, cost-based fee for additional requests as permitted by law.
  6. Right to a Copy of This Notice
    • You may request a paper copy of this Notice at any time, even if you have agreed to receive the Notice electronically.
  7. Right to Appoint a Personal Representative
    • If you have authorized someone to act on your behalf in accordance with applicable law, including through a medical power of attorney or legal guardianship, that person may exercise your rights and make decisions concerning your PHI to the extent legally authorized.
  8. Right to File a Complaint
    •  If you believe that your privacy rights have been violated, you may submit a complaint to us using the contact information below.
    • You may also submit a complaint to the U.S. Department of Health and Human Services, Office for Civil Rights (“OCR”).
    • We will not retaliate against you for filing a complaint.

4. Your Choices

Certain uses and disclosures of PHI may require your authorization or may be subject to your preferences under applicable law.

  1. Family, Friends, or Others Involved in Your Care
    • Where permitted by law, we may disclose relevant PHI to a family member, close personal friend, or other person involved in your care or payment for your care when you agree to the disclosure or when applicable law permits us to do so.
    • If you are unable to express a preference, we may disclose relevant PHI when, in our professional judgment, doing so is in your best interests and is permitted by law.
  2. Marketing, Sale of PHI, or Psychotherapy Notes
    • We will not use or disclose your PHI for purposes of marketing, sell your PHI, or use or disclose psychotherapy notes, where applicable, without your written authorization, except where an exception under HIPAA or other applicable law applies.
  3. Fundraising Communications
    • To the extent permitted by law, we may contact you regarding fundraising activities for our benefit. You may opt out of receiving fundraising communications in accordance with applicable law.

5. Information We Collect About You

When you use our Services, we may collect, receive, create, or maintain PHI in various ways, including:

  • Registration and Screening: Name, address, telephone number, email address, date of birth, height, weight, and health information relevant to your use of our programs or Services.
  • Requesting Care: Records or information from your past or current healthcare providers, such as diagnoses, laboratory results, sensor or device readings, or family medical history.
  • Using Our Services: Information generated through your interactions with Rehab Ranger™’s websites, applications, software, sensors, or hardware, including motion-sensor metrics, range-of-motion data, exercise-related information, and exercise compliance details, where such information constitutes PHI.
  • Feedback or Communication: Information contained in telephone calls, videoconferences, text/SMS communications, email communications, or other interactions with our care teams, service providers, or personnel. We may record or retain certain interactions for quality assurance, training, documentation, or other permitted purposes, subject to applicable law.

6. Our Uses and Disclosures

We may use or disclose your PHI in the following ways, as permitted by HIPAA and applicable law:

  1. Treatment
    • We may use or disclose your PHI to coordinate, manage, or provide healthcare services. For example, we may share relevant PHI with your physician, physical therapist, or other healthcare professional involved in your care.
  2. Payment
    • We may use or disclose your PHI to obtain payment for healthcare services, process claims, or facilitate payment for services provided.
  3. Healthcare Operations
    • We may use or disclose your PHI for healthcare operations, including activities necessary to operate our organization, improve the quality of services, conduct audits, perform administrative functions, evaluate programs, and develop or improve our Services, as permitted by law.
  4. Appointment Reminders
    • We may contact you by telephone, email, SMS, or other permitted communication methods to remind you about appointments or provide information concerning your healthcare or Services.
  5. Business Associates
    • We may disclose PHI to third-party service providers that perform services on our behalf and require access to PHI, such as cloud hosting, billing, technology, or administrative service providers, where permitted by law. Where required by HIPAA, we will enter into appropriate business associate agreements with such business associates requiring them to appropriately safeguard PHI.
  6. Health Information Exchanges (HIEs)
    • Where permitted by law, we may participate in health information exchanges or similar electronic health information networks to facilitate the secure exchange of PHI for purposes such as coordinating care. Where applicable law requires an authorization or consent for such exchange, we will obtain it.
  7. De-identified and Aggregated Data
    • We may de-identify PHI in accordance with applicable HIPAA requirements and may use or disclose properly de-identified information for permitted purposes, including research, quality improvement, analytics, and evaluation of our Services. Once information has been properly de-identified in accordance with applicable law, it is no longer considered PHI for purposes of HIPAA.

7. Other Uses and Disclosures

We may use or disclose your PHI without your written authorization when permitted or required by HIPAA or other applicable law, including for:

  1. Public Health and Safety
    • We may disclose PHI for public health activities, including reporting certain communicable diseases, suspected abuse or neglect, adverse events, or information necessary to prevent or reduce a serious threat to health or safety, as permitted by law.
  2. Research
    • We may use or disclose PHI for research purposes when permitted under applicable law, including where applicable requirements relating to authorization, institutional review boards, privacy boards, or other legal safeguards have been satisfied.
  3. Compliance with Law
    • We may use or disclose PHI when required by applicable federal, state, or local law, including in response to lawful requests from government authorities.
  4. Organ Donation
    • We may disclose PHI to organ procurement organizations or other entities involved in organ, eye, or tissue donation and transplantation when permitted by law.
  5. Medical Examiners and Funeral Directors
    • We may disclose PHI to medical examiners, coroners, or funeral directors when permitted by law, including for purposes of identifying a deceased person or determining a cause of death.
  6. Workers’ Compensation or Government Requests
    • We may disclose PHI as authorized by and to the extent necessary to comply with laws relating to workers’ compensation, health oversight activities, law enforcement, or specialized government functions, as permitted by applicable law.
  7. Lawsuits and Legal Actions
    • We may disclose PHI in connection with judicial or administrative proceedings, subpoenas, discovery requests, or other lawful processes when permitted or required by applicable law. Where required by law, we will comply with applicable safeguards before making such disclosures.

8. Notice Regarding Technology

We may use software, cloud systems, internet-based services, email, SMS, video conferencing, sensors, devices, and other technologies to provide, support, or administer the Services and to transmit, store, or process PHI.

We maintain administrative, physical, and technical safeguards designed to protect PHI from unauthorized access, use, or disclosure.

However, certain methods of communication, including unencrypted email or SMS, may involve inherent security and privacy risks. Where permitted by law, you may request alternative methods of communication.

If a breach of unsecured PHI occurs that requires notification under applicable law, we will provide notification in accordance with the applicable legal requirements.

9. Contact Information and Complaints

If you have questions, wish to obtain a paper copy of this Notice, or want to exercise any of your rights described above, please contact:

Protonest Labs LLC
Operating Rehab Ranger™
Attn: Privacy Officer
201 SW Adams St
Peoria, IL 61602
Phone: 309-332-7150
Email: [email protected]

You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, by calling 1-877-696-6775 or visiting https://www.hhs.gov/ocr/privacy/hipaa/complaints/

We will not retaliate against you for filing a complaint.

10. Changes and Effective Date

We reserve the right to revise or update this Notice as permitted by applicable law.

Any revised Notice will apply to PHI we maintain as required by applicable law. If we make a material change to this Notice, we will make the revised Notice available as required by law, including by posting it on our website or otherwise providing it to you.

The effective date shown at the beginning of this Notice indicates the date on which the current version became effective.

Thank you for trusting Rehab Ranger™ with your healthcare information.

Rehab Ranger™ is a product and brand of Protonest Labs LLC.

Thank you for trusting Rehab Ranger™ with your healthcare information.