ARBOR INFUSION PRIVACY POLICY

Effective Date: August 3rd, 2026

  1. Scope

This Website Privacy Policy explains Arbor Infusion (“Arbor Infusion,” “we,” “us,” or “our”), collects, uses, discloses, and protects information through arborinfusion.com and other public-facing webpages, forms, and digital services that link to this Policy collectively, the “Website”. This Policy may apply to information from patients and prospective patients, caregivers, referring providers, job applicants, vendors, business partners, and other Website visitors. It does not apply to independent third-party websites or services that maintain their own privacy notices.

  1. Relationship to HIPAA

This Policy is separate from Arbor Infusion’s HIPAA Notice of Privacy Practices (“NPP”). Information submitted through a public website is not automatically protected health information (“PHI”) under HIPAA. When Arbor Infusion receives or maintains PHI in its capacity as a healthcare provider, that information may be governed by HIPAA, other healthcare privacy laws, and the NPP. If this Policy and the NPP address the same PHI differently, the NPP and applicable law control.

  1. Emergencies and Provider-Patient Relationship

The Website is not intended for emergency or urgent medical communications. Do not submit urgent symptoms, severe medication reactions, or other time-sensitive medical concerns through Website forms, email, chat, or similar tools. Call 911 or seek appropriate emergency care if you believe an emergency exists. Visiting the Website, reviewing content, or submitting an inquiry or form does not by itself establish a provider-patient relationship, confirm patient acceptance, create a duty to provide care, guarantee a response, or guarantee an appointment, coverage, authorization, medication, or treatment.

  1. Information We Collect

The information we collect depends on how you use the Website.

Information you provide

We may collect:

  • Name, address, email address, telephone number, date of birth, communication preferences, and representative or caregiver information;
  • Patient, referral, or healthcare information, such as referring-provider details, diagnosis or condition, requested therapy, treatment orders, medical records, insurance information, authorization information, scheduling preferences, and relevant medical history;
  • Provider and business information, such as professional contact details, practice information, credentials, National Provider Identifier, referral information, and vendor or contracting information;
  • Recruiting information, such as a resume, work history, education, licenses, credentials, references, work authorization, and interview information;
  • Payment-related information, such as payment amount, payment status, billing name, and transaction identifier. Payment-card information may be collected directly by a third-party processor;and
  • The contents of emails, forms, messages, calls, feedback, and other communications.

Use designated secure submission methods when available. Do not include sensitive medical information in a general contact form or unencrypted email unless Arbor Infusion instructs you to do so.

Information collected automatically

We may automatically collect:

  • Internet Protocol address;
  • Browser, device, operating-system, and language information;
  • Approximate location derived from an Internet Protocol address;
  • Referring and exit pages;
  • Pages viewed, links selected, and dates and times of activity;
  • Cookie, device, or similar identifiers; and
  • Performance, diagnostic, security, and interaction information.

This information may be collected through server logs, cookies, tags, pixels, software development kits, local storage, and similar technologies.

Information from other sources

We may receive information from healthcare providers, caregivers, health plans, benefits administrators, electronic health record and referral platforms, scheduling and payment providers, recruiting platforms, references, vendors, public professional sources, and persons acting at your direction. If you submit information about another person, you represent that you are authorized to provide it for the relevant purpose.

  1. How We Use Information

We may use information to:

  • Respond to questions, requests, referrals, and form submissions;
  • Communicate with patients, caregivers, providers, applicants, vendors, and business contacts;
  • Review referrals, request records or orders, conduct benefits verification and prior authorization, coordinate financial clearance, determine whether services may be available, and schedule or support patient services;
  • Provide treatment, obtain payment, and conduct healthcare operations as permitted by law;
  • Operate, secure, troubleshoot, measure, and improve the Website and related systems;
  • Recruit, evaluate, interview, credential, and communicate with applicants;
  • Manage provider, vendor, and business relationships;
  • Send service information, provider resources, newsletters, or marketing communications where legally permitted;
  • Detect and prevent fraud, misuse, security incidents, and unlawful activity;
  • Enforce agreements and policies, protect rights and safety, maintain records, and comply with legal or regulatory obligations; and
  • Create and use aggregated or deidentified information for lawful business, operational, security, or analytical purposes.

Information submitted through patient, referral, scheduling, or clinical forms will not be used for unrelated third-party advertising without an appropriate legal basis and any authorization or consent required by law.

  1. How We Disclose Information

We may disclose information:

  • To service providers supporting hosting, cybersecurity, forms, cloud services, electronic health records, referral management, communications, scheduling, benefits verification, billing, payments, recruiting, email, analytics, and other operations;
  • To referring, ordering, treating, or consulting providers, health plans, benefits administrators, laboratories, caregivers, authorized representatives, and others involved in treatment, payment, healthcare operations, or requested services;
  • To attorneys, accountants, auditors, insurers, consultants, and other professional advisors;
  • To government authorities, courts, regulators, law enforcement, or other parties when required or permitted by law or reasonably necessary to protect rights, safety, property, or security;
  • In connection with a proposed or completed merger, financing, reorganization, sale, bankruptcy, or similar transaction;
  • At your direction or with your authorization or consent; and
  • In aggregated or deidentified form.

Vendors may process information only for authorized purposes and are expected to protect it under applicable contracts and law. When a vendor receives PHI as Arbor Infusion’s business associate, applicable HIPAA requirements will be addressed.

  1. Cookies and Tracking Technologies

Arbor Infusion may use cookies and similar technologies to operate and secure the Website, remember preferences, measure traffic and performance, understand Website use, and improve content. Arbor Infusion will evaluate tracking technologies used on healthcare-related webpages and forms. Technologies should not be configured to impermissibly disclose PHI or other sensitive information. A cookie banner or general consent does not authorize a use or disclosure prohibited by healthcare privacy law.

You may be able to manage these technologies through a Website preference tool, browser or device settings, vendor opt-out tools, or a legally recognized browser signal. Disabling technologies may affect Website functions.

  1. Communications and Choices

You may unsubscribe from marketing emails through the link in the message or by contacting us. We may still send administrative, transactional, patient-care, security, or legally required communications. Where required, Arbor Infusion will obtain consent before sending automated or marketing text messages or calls. Program-specific terms may apply to recruiting, reminders, or patient communications.

  1. Data Retention

We retain information for as long as reasonably necessary to respond to requests, coordinate services, maintain healthcare and business records, complete recruiting, satisfy contracts, comply with law, resolve disputes, protect security, and enforce rights. Retention periods depend on the information, purpose, sensitivity, legal requirements, and whether it is contained in healthcare, employment, transaction, backup, or security records. PHI is retained under applicable law, Arbor Infusion’s policies, and the NPP.

  1. Security

Arbor Infusion uses administrative, physical, and technical safeguards designed to protect information. These may include access controls, encryption, monitoring, training, vendor oversight, and incident-response procedures. No transmission or storage system is completely secure. Use Arbor Infusion’s designated secure methods when available and contact us if you believe information may have been accessed or used without authorization.

  1. Third-Party Services

The Website may link to or use third-party maps, social media, recruiting, payment, scheduling, communication, or other services. Independent third parties control their own content, security, and privacy practices. Information you provide directly to them is governed by their policies, except when they process information for Arbor Infusion under an applicable agreement.

  1. Children’s Privacy

The public Website is not directed to children under 13, and Arbor Infusion does not knowingly collect personal information directly from children under 13 through general Website features without appropriate parent or guardian involvement. An authorized parent, guardian, caregiver, or healthcare provider may submit information about a minor to request or coordinate care. Information concerning a minor that Arbor Infusion receives as a healthcare provider may be governed by HIPAA, state law, and the NPP.

  1. State Privacy Rights

Depending on applicable law, you may have the right to:

  • Confirm whether we process your personal information;
  • Access, correct, delete, or obtain a portable copy of certain information;
  • Opt out of certain sales, sharing, targeted advertising, or profiling;
  • Limit or withdraw consent for certain sensitive-information processing;
  • Appeal a denied request; and
  • Exercise rights without unlawful discrimination.

These rights are subject to legal exceptions. Some laws exempt PHI, medical information, healthcare entities, employment information, business-to-business information, or other data. Requests concerning medical records or PHI may be handled under the NPP instead of a consumer-privacy law.

Submit a request by:

Email: hi@arborinfusion.com
Mail: 217 6th Ave N Ste 43267, Nashville, TN 37219

Attn: Arbor Infusion Legal Department

We may verify your identity and authority. Authorized agents may submit requests where permitted, subject to verification. Appeals may be submitted to hi@arborinfusion.com.

  1. United States Use

The Website is intended for use in the United States. Information may be processed in the United States and other locations where service providers operate, subject to applicable protections. Arbor Infusion does not represent that its services are available in every jurisdiction.

  1. Changes to This Policy

We may update this Policy to reflect changes in our services, technology, legal obligations, or practices. The revised version will be posted with an updated date. We will provide additional notice or obtain consent when required by law.

  1. Contact Us

Arbor Infusion
217 6th Ave N Ste 43267

Nashville, TN 37219

Attn: Arbor Infusion Legal Department

Email: hi@arborinfusion.com