PRIVACY POLICY

Health X Systems LLC d/b/a Health X Institute

Updated October 17, 2026

This policy explains how Health X Institute (HXI, we, us) handles personal information in the Clinical Adherence System (CAS), including inquiries, consultations, onboarding, individual coaching, CAS Flex and CAS Flex Plus, and sponsored programs. It describes our responsibilities and your choices. It does not authorize research, publicity, or unrestricted disclosure to a sponsor.

1 Who is responsible and how to contact us

Health X Systems LLC operates CAS under the trade name Health X Institute. Direct privacy questions, record requests, corrections, and consent withdrawals to HXI through your Practice Better Client Portal. If you do not have portal access, use the business contact method displayed on the CAS booking page or your booking confirmation. Please identify your request without sending unnecessary health details through ordinary email or a public website form.

2 Information we collect

We collect identifying and contact information, such as your name, contact details, date of birth when needed for eligibility or identification, communication preferences, and accessibility needs. We also maintain enrollment, service selection, scheduling, attendance, cancellation, payment-status, agreement, acknowledgment, and signature records.

Coaching records may include your goals; information you choose to share about diagnoses and instructions received from your healthcare professionals; medications and treatment routines; relevant observations or monitoring records; implementation barriers; support systems; action plans; coaching notes; messages; referrals; and progress reviews. Brain Snacks™ Adherence Index (BSAI) records may include defined behaviors, measurement periods, expected and completed opportunities, missing-data information, and client-reported context.

We request information relevant to coaching and service administration. Sensitive contextual questions may be declined. If missing information prevents us from delivering a particular service safely or effectively, we will explain the concern and discuss an alternative. Do not submit Social Security numbers, full payment-card details in messages, or unrelated medical records.

3 Where information comes from

Information comes primarily from you and your interactions with HXI. With appropriate permission, it may also come from a caregiver, healthcare professional, or another person you designate. A sponsoring organization may provide limited eligibility, enrollment, or payment information needed to administer its program. Website and service providers may collect technical data such as device, browser, connection, and transaction information when you use their services.

4 How we use information

We use information to respond to inquiries, assess coaching fit, deliver and personalize agreed services, organize client-reported healthcare instructions, document participation, support behavior-change work, administer appointments and payments, communicate with you, and prepare requested summaries. We also use necessary information to address complaints, protect account and service security, maintain business records, and meet applicable legal obligations.

Internal quality review uses the minimum information reasonably needed. Coaching information is not used to diagnose disease, determine treatment, evaluate medical or employment fitness, or make automated eligibility decisions based on a BSAI result.

5 Service providers and payment processing

Practice Better is the intended client-management environment for CAS forms, scheduling, portal communications, and related service administration. Other providers may support payment processing, website hosting, communications, or business administration. We limit access to what is needed for the service and use appropriate contractual and operational safeguards.

Payment information entered into a payment provider's secure checkout is processed under that provider's practices. HXI may receive transaction identifiers, payment status, and limited billing information. Do not send card numbers or account passwords to your coach. Third-party websites and services have their own privacy terms; this policy governs HXI's handling of information, not every independent action of those providers.

6 When we share information

We share necessary information with personnel and service providers supporting CAS, with recipients you specifically authorize, and when disclosure is required or otherwise lawfully permitted. We review legal requests and disclose only information appropriate to the valid request and applicable law. When lawful and appropriate, limited information may be disclosed to respond to a serious safety concern or protect legal rights.

Listing a clinician, caregiver, emergency contact, or sponsor on an intake form is not blanket permission to share your coaching record. Routine coordination involving identifiable coaching information requires a specific authorization unless another lawful basis applies. We do not sell coaching information or disclose identifiable coaching information for third-party targeted advertising.

7 Sponsored programs and group sessions

A sponsor's payment does not give it access to private coaching notes, diagnoses, medication details, personal barriers, or individual BSAI responses and results. The participant notice and program reporting plan identify what the sponsor may receive. Program-level reporting uses aggregate information with safeguards against identification; small groups, unusual circumstances, and combinations of details may require suppression or broader grouping.

Identifiable disclosure beyond a disclosed lawful administrative purpose requires a separate, specific permission or other valid legal basis. We do not provide coaching records for employment discipline or medical-fitness decisions. In group sessions, other participants hear what you choose to share. We require respectful confidentiality but cannot guarantee what other participants will do. Share only what you are comfortable disclosing in that setting.

8 Optional uses and separate permissions

Enrollment is not consent to research, testimonials, photographs, recordings, marketing messages, or publication of your story. These uses require their own appropriate permission and, where applicable, additional legal or ethics review. Declining optional uses does not reduce your purchased coaching benefits.

We do not record sessions or introduce optional automated transcription or AI analysis of identifiable coaching content without first explaining the proposed use and obtaining any required permission. You may decline optional recording. We do not place identifiable coaching records into public generative AI services for general model training.

9 Communications and website technologies

Use the Practice Better Client Portal for sensitive coaching information. Ordinary email, SMS, shared devices, calendar notifications, and lock-screen previews can expose information. Tell us if a communication method is unsafe for you. Administrative reminders may disclose that you have an appointment even when they contain no health details.

Marketing communications are separate from service messages. You may unsubscribe from marketing without stopping necessary administrative communications. Public website forms should not be used for detailed health histories. Website cookie or analytics disclosures must describe the technologies actually used; this policy does not grant permission for undisclosed advertising trackers on coaching forms or portal pages.

Family and emergency-contact privacy

The client chooses who participates. Family may include blood relatives or chosen family confirmed by the client. Listing an emergency contact does not itself authorize disclosure or attendance. HXI shares only the specific information authorized, for the specified visit/purpose. All attendees sign the attendance and confidentiality acknowledgments; HXI cannot guarantee independent participants will maintain confidentiality. A Family Authorization form will be emailed upon booking the CAS-Family Service. 

Consent and special uses

Separate specific permission is needed where applicable for sharing with family or providers, optional BSAI participation, recordings, testimonials, research or publicity. Refusing optional sharing does not automatically prohibit other appropriate coaching services. Consent may be withdrawn prospectively subject to law and information already disclosed.

10 Security and incident response

We use administrative, technical, and physical safeguards appropriate to the information and our operations, including limiting authorized access and managing records responsibly. No system or transmission can be guaranteed completely secure. Protect your credentials, use device security, and notify HXI promptly if you suspect unauthorized access. We assess suspected incidents and provide notifications when required by applicable law.

11 Retention and disposal

We retain information for the periods reasonably needed to deliver services, document agreements and transactions, meet legal obligations, resolve disputes, and maintain required records. Relevant factors include the record type, purpose, applicable retention requirements, and any legal hold. We do not promise deletion of every record immediately upon request. When information is no longer needed, we arrange appropriate deletion, destruction, or de-identification; backup deletion may follow the provider's retention cycle. You may ask us about the retention period applicable to your records.

12 Your requests and choices

You may ask to access or receive a copy of your information, correct inaccurate details, restrict a proposed optional use, withdraw a permission, or request deletion. We verify identity using information proportionate to the request, consider applicable rights and exceptions, and explain material limits. Corrections may be recorded as an amendment to preserve the integrity of an existing record.

Withdrawal applies prospectively and does not undo a disclosure already made in reliance on valid permission. If a request affects information necessary for a service, we will explain the effect. We do not penalize you for exercising applicable privacy rights. Rights and response deadlines may depend on your location and the nature of the information.

13 Health information and legal scope

Health-related information can be sensitive even when HIPAA does not apply. Use of a platform designed to support HIPAA requirements does not by itself establish HXI's legal status. Where an engagement makes HXI a covered entity or business associate, applicable HIPAA obligations and required notices or agreements apply. This policy is not represented as a HIPAA Notice of Privacy Practices or a business associate agreement. Other applicable privacy, consumer-protection, and security requirements remain relevant.

This individual-service package is designed for adults aged 21 and over. Services involving minors require a separate enrollment and consent arrangement before information is collected. Cross-border delivery or materially different data practices require review and any additional disclosures before that service begins.

14 Changes and acknowledgment

We identify each policy version and provide the version applicable to your enrollment. Material changes will be communicated through an appropriate channel. We obtain additional permission when a new use requires it; publication of a revised policy alone does not authorize an incompatible use of previously collected information.

Acknowledgment of this policy confirms receipt. It is not consent to research, publicity, sponsor access, or all future uses of your information. The separate CAS Privacy Acknowledgment records the version you received.