Privacy policy

On this page

Who we are and what this covers
Information we collect
How we use information
How we share information
Text messages
Cookies and similar technologies
Your rights and choices
Consumer health data
How we protect information
How long we keep information
Children
Where information is kept
Changes to this policy
Contact us

The short version

We collect what we need to care for you: who you are, your insurance, and what’s going on with your health.
Your health information goes only to the people and services involved in your care: your clinician, your lab, your pharmacy and your insurance plan.
We don’t sell your personal or health information, and we don’t share health information with advertisers.
You can ask to see, correct, download or delete your information, and stop marketing messages at any time.

Who we are and what this covers

Arcus provides a technology platform that connects you with licensed clinicians, labs, pharmacies and your insurance plan. Medical care is provided by independent, affiliated medical groups and their licensed clinicians (the “medical groups”).

This policy explains how Arcus collects, uses and shares personal information when you visit arcus.healthcare, create an account or use our services. When the medical groups care for you, the health information they create and receive is protected health information under the Health Insurance Portability and Accountability Act (HIPAA). That information is also described in the medical groups’ HIPAA notice of privacy practices, and where HIPAA applies, that notice controls. Arcus handles that information on the medical groups’ behalf as their business associate.

Information we collect

Information you give us

Account and contact details: your name, date of birth, sex, email address, phone number and mailing address.
Insurance details: your plan, member ID and the information on your insurance card.
Health information: the reason for your visit, your answers to intake questions, your symptoms, medical history, medications and allergies, photos you choose to share, and your messages with your care team.
Identity verification: a photo of your ID or other information we need to confirm who you are, when the law or your clinician requires it.
Payment details: your card or other payment method, which our payment provider processes. We don’t store full card numbers.
Support requests: what you tell us when you contact us.

Information created during your care

Visit records, clinician notes, diagnoses and treatment plans; lab orders and results; prescriptions and their refill and pickup status; prior authorization requests and insurance decisions; and billing records.

Information from others

Your insurance plan: eligibility, benefits and coverage decisions.
Labs and pharmacies: results, and the status of your prescriptions.
Prescription history services: a list of medications you’ve been prescribed elsewhere, so your clinician can prescribe safely.
Identity verification and fraud prevention services: to confirm who you are and keep accounts safe.

Information collected automatically

Your browser and device type, operating system, IP address and the approximate location it suggests, the pages you visit and the actions you take on our site. We collect this with cookies and similar technologies, described below.

How we use information

To provide your care: connect you with a clinician, run your visit by text, order lab tests and send prescriptions.
To coordinate your care: share orders and updates with your lab, your pharmacy and your insurance plan, and file prior authorization requests.
To handle billing: check your coverage, show you what you’ll owe, bill your plan and collect what’s due.
To communicate with you: messages from your care team, updates on results and prescriptions, account notices and, if you agree, news about Arcus.
To keep Arcus safe: verify identity, prevent fraud and misuse, and protect patients, clinicians and our systems.
To improve Arcus: understand how the site and services are used, fix problems and build new features, using de-identified or aggregated information where we can.
To meet our legal obligations: keep medical records, respond to lawful requests and follow health care laws.

We use health information for marketing only with your written authorization, as HIPAA requires.

We share information only as described here, and only as much as each recipient needs.

Your care team: the medical groups and the clinicians treating you.
Your lab and your pharmacy: to run your tests and fill your prescriptions.
Your insurance plan and pharmacy benefit manager: to check eligibility, file claims and request prior authorization.
Service providers: companies that host our systems, send messages, process payments and provide support, under contracts that limit how they use your information. Providers that handle health information sign business associate agreements.
People you choose: a caregiver or family member you authorize.
For legal and safety reasons: when the law requires it, to respond to valid legal process, for required public health reporting, or to protect someone’s safety.
Business changes: if Arcus is part of a merger, acquisition or sale of assets, information may transfer as part of that deal, and it stays protected by this policy and the law.
De-identified information: information that can no longer reasonably identify you, as the law permits.

We don’t sell your personal information or your health information. We don’t share health information with advertising companies, and we don’t put advertising pixels on pages where you enter health information.

Text messages

Arcus visits happen by text, so we text you about your care: messages from your clinician, lab and prescription updates, and reminders. Message frequency varies. Message and data rates may apply. Reply STOP to stop texts, or HELP for help.

Texts can appear on your lock screen and be read by anyone with your phone. You can turn off message previews in your phone’s settings.

We don’t sell or share your phone number or your consent to receive texts with anyone for their own marketing.

Cookies and similar technologies

We use cookies and similar technologies, like your browser’s local storage, to keep you signed in, remember your settings, keep the site secure and understand how it’s used.

Essential: needed for the site to work, like signing in and security.
Preferences: remember choices you make, like the units in our BMI calculator.
Analytics: show us which pages are used and where things break, so we can fix them.

You can block or delete cookies in your browser, though some parts of the site may not work without them. We treat Global Privacy Control signals as a request to opt out of the sale or sharing of your information, where the law requires.

Your rights and choices

Access: ask for a copy of your information, including your medical record.
Correction: ask us to fix information that’s wrong or incomplete.
Deletion: ask us to delete your information. We’ll delete what we can, but medical and billing records must be kept for as long as the law requires.
Portability: get your information in a format you can take elsewhere.
Marketing: unsubscribe from marketing emails with the link in each one, and stop texts by replying STOP.
Consent: where we rely on your consent, you can withdraw it at any time.

To make a request, email privacy@arcus.healthcare. We’ll confirm your identity before acting on it, and we won’t treat you differently for using your rights. If we turn down a request, you can appeal by replying to our decision.

Your rights under HIPAA

For health information the medical groups hold, you also have the right to see and get a copy of your records, ask for corrections, get a list of certain disclosures, ask for limits on how your information is used and shared, ask to be contacted in a particular way, and file a complaint with the U.S. Department of Health and Human Services. Our HIPAA notice of privacy practices explains these rights in full.

Rights in certain states

Depending on where you live, including California, Colorado, Connecticut, Oregon, Texas, Virginia and other states, you may have more rights: to know what personal information we collect and how we use it, to access, correct, delete and port it, to opt out of its sale, sharing or use for targeted advertising and profiling, and to limit how we use sensitive information. We honor these rights as the law requires, and you can have an authorized agent make a request for you.

Consumer health data

Some state laws, including Washington’s My Health My Data Act and Nevada’s consumer health data law, protect health information that HIPAA doesn’t cover. Our consumer health data privacy policy explains what we collect, who we share it with and the rights you have.

How we protect information

We use administrative, technical and physical safeguards designed to protect your information, including encryption in transit and at rest, access limited to the people who need it, and monitoring for misuse. No system is perfectly secure, so please keep your login details and your phone secure too. If a breach affects your information, we’ll notify you as the law requires.

How long we keep information

We keep personal information for as long as we need it for the purposes in this policy. Medical records are kept for as long as state and federal law require, which can be many years, and longer for some records. When we no longer need information, we delete it or de-identify it.

Children

Arcus is for adults 18 and older. We don’t knowingly collect information from anyone younger. If you think a child has given us information, contact us and we’ll delete it.

Where information is kept

Arcus serves people in the United States, and we store and process information in the United States.

Changes to this policy

We’ll post any changes here and update the date at the top. If a change is significant, we’ll tell you by email or in your account before it takes effect.

Contact us

Questions or requests about privacy: privacy@arcus.healthcare.