HabitNu Notice of Privacy Practices (HIPAA)
Effective Date: April 1, 2026
Last Updated: April 1, 2026
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
This Notice of Privacy Practices (“Notice”) applies to Prana Diabetes Inc., d/b/a HabitNu (“HabitNu,” “we,” “us”) as a HIPAA Covered Entity and describes how we may use and disclose your Protected Health Information (“PHI”) and how you can exercise your rights regarding your PHI.
PHI is information about you (including demographic information) that relates to your past, present, or future physical or mental health or condition, the provision of health care to you, or payment for health care, and that identifies you or can reasonably be used to identify you.
Our Responsibilities
We are required by law to:
  • Maintain the privacy and security of your PHI.
  • Provide you with this Notice of our legal duties and privacy practices regarding your PHI.
  • Follow the terms of the Notice currently in effect.
  • Notify you if a breach occurs that may have compromised the privacy or security of your PHI.
How We May Use and Disclose Your PHI (Without Your Written Authorization)
1. For Treatment
We may use and disclose your PHI to provide, coordinate, or manage your health care and related services.
Example: sharing PHI with members of your care team or program staff involved in your care.
2. For Payment
We may use and disclose your PHI to bill and collect payment for health care services and related activities.
Example: verifying coverage/eligibility, billing, claims, and collection activities.
3. For Health Care Operations
We may use and disclose your PHI for our health care operations, such as quality improvement, training, auditing, and business management.
Example: reviewing program effectiveness, conducting internal audits, improving our services.
4. To Business Associates and Vendors
We may disclose PHI to vendors (“Business Associates”) that perform services on our behalf (such as hosting, analytics used for operations, customer support, security monitoring, legal/accounting). Business Associates must protect PHI and may use it only as permitted by our contracts and HIPAA.
5. As Required or Permitted by Law
We may use and disclose PHI as required or permitted by law, including:
  • Public health and safety activities (e.g., reporting certain diseases or adverse events when required).
  • Health oversight activities (e.g., audits, investigations, inspections by government agencies).
  • Abuse, neglect, or domestic violence reporting (as allowed/required by law).
  • Judicial and administrative proceedings (e.g., in response to a court order or lawful process).
  • Law enforcement purposes (as permitted by law).
  • To avert a serious threat to health or safety (as permitted by law).
  • Specialized government functions (as applicable).
  • Workers’ compensation purposes (as applicable).
6. Individuals Involved in Your Care or Payment for Your Care
We may disclose PHI to a family member, friend, or other person you identify who is involved in your care or payment for your care, unless you object (when feasible) or an emergency makes it impractical.
Uses and Disclosures That Require Your Written AuthorizationWe will not use or disclose your PHI for the following purposes unless you give us written authorization (or unless otherwise permitted by law):
  • Marketing (as defined by HIPAA) in most circumstances
  • Sale of PHI
  • Most uses/disclosures of psychotherapy notes (if applicable)
You may revoke an authorization at any time in writing. Your revocation will not affect actions we took before we received it.
Your Rights Regarding Your PHIYou have the following rights. To exercise any right, contact us using the information in the “Contact Us” section.
1. Right to Inspect and Get a Copy of Your PHI
You can ask to see or obtain a copy of your PHI. We will provide it in the form and format you request if readily producible (including electronic form when applicable). We may charge a reasonable, cost-based fee as permitted by law.
2. Right to Request an Amendment (Correction)
You can ask us to amend PHI you believe is incorrect or incomplete. We may deny your request in certain cases (for example, if we did not create the record or if the information is accurate and complete). If denied, we will provide a written explanation and information on how you may submit a statement of disagreement.
3. Right to Request an Accounting of Disclosures
You can ask for a list (accounting) of certain disclosures of your PHI we made during the six years prior to your request (or a shorter time period you specify), excluding disclosures for treatment, payment, and health care operations and certain other exceptions.
4. Right to Request Restrictions
You can ask us not to use or disclose certain PHI for treatment, payment, or health care operations. We are not required to agree to your request. If we agree, we will follow it unless needed to provide emergency treatment.
If you paid out-of-pocket in full for a service, you may request that we not share PHI about that service with your health plan for payment or operations, and we will comply unless a law requires us to share it.
5. Right to Request Confidential Communications
You can ask us to contact you in a specific way (for example, only at work phone) or send mail to a different address. We will accommodate reasonable requests.
6. Right to Get a Paper Copy of This Notice
You can ask for a paper copy at any time, even if you have agreed to receive the Notice electronically.
7. Right to Choose Someone to Act for You
If you have a legal guardian or a person with medical power of attorney, that person can exercise your rights and make choices about your PHI after providing documentation of authority.
Our Duties
We will not use or share your PHI other than as described in this Notice unless you tell us we can in writing (authorization) or unless the law allows it.
Changes to This Notice
We may change this Notice, and the changes will apply to PHI we already have and PHI we receive in the future. The updated Notice will be available:
Complaints
If you believe your privacy rights have been violated, you may file a complaint with us and/or with the U.S. Department of Health and Human Services, Office for Civil Rights (OCR). We will not retaliate against you for filing a complaint.
  • To complain to HabitNu: Contact our Privacy Officer using the information below.
  • To complain to OCR: You may file a complaint with HHS OCR (online, by mail, or by email).
Contact Us (Privacy Officer)
HabitNu Privacy Officer
Email: support@habitnu.com
Mail:
222 W. Merchandise Mart Plaza,
Suite 228, Chicago, IL 60654