Last Updated: October 11, 2026
P3P Labs is committed to protecting the privacy, confidentiality, and security of personal health information.
This HIPAA Privacy Policy explains how protected health information (PHI) may be collected, used, disclosed, and safeguarded in connection with healthcare services facilitated through our platform.
The Health Insurance Portability and Accountability Act of 1996 (HIPAA), as amended, establishes privacy and security requirements for covered healthcare entities and their business associates.
HIPAA protections apply to information and activities within the scope of those requirements. Other personal information is governed by our general Privacy Policy and applicable data protection laws.
Protected health information includes individually identifiable health information maintained or transmitted by a HIPAA-covered entity or its business associate in connection with covered activities.
Depending on the services provided, this may include:
Not all health-related information collected through the P3P Labs website is necessarily subject to HIPAA.
Where HIPAA applies, protected health information may be used or disclosed for permitted purposes, including:
To support medical consultations, clinical assessments, prescriptions, laboratory testing, and coordination of care among authorized healthcare professionals.
To process healthcare-related payments, determine payment eligibility, and administer applicable bilfiling activities.
To support quality assurance, compliance, administrative functions, patient services, and other permitted healthcare operations.
Information may also be used or disclosed where permitted or required by applicable law, including certain public health, regulatory, and safety-related activities.
P3P Labs may facilitate access to licensed healthcare providers, pharmacies, laboratories, and other healthcare service providers.
Protected health information may be shared with authorized parties as necessary for permitted treatment, payment, or healthcare operations purposes.
Where P3P Labs acts as a business associate of a HIPAA-covered entity, it handles PHI according to applicable HIPAA requirements and the relevant Business Associate Agreement.
Independent healthcare providers and laboratories may maintain separate privacy notices and legal responsibilities.
Certain uses or disclosures of protected health information require written patient authorization. Where required, authorization will be obtained before information is used or disclosed for purposes such as:
Patients may generally revoke an authorization in writing, subject to applicable legal limitations and actions already taken in reliance on the authorization.
Certain services may involve the collection and processing of genetic information and laboratory results.
Where genetic information qualifies as PHI, it is protected under applicable HIPAA requirements.
Genetic information may be used for authorized healthcare purposes, including clinical interpretation, assessment, and coordination of care.
Secondary uses, including research or other purposes outside permitted healthcare activities, are subject to applicable legal requirements and any necessary authorization or consent.
P3P Labs and applicable healthcare service providers are expected to maintain appropriate safeguards to protect PHI against unauthorized access, use, disclosure, alteration, or loss.
Safeguards may include:
Specific safeguards depend on the systems, providers, and legal responsibilities involved. 8. Patient Privacy Rights
Where HIPAA applies, patients have certain rights concerning their protected health information.
These may include:
Request access to or copies of eligible medical records and other PHI maintained in a designated record set.
Request amendments to information believed to be inaccurate or incomplete.
Request an accounting of certain disclosures of PHI, subject to applicable exceptions.
Request restrictions on certain uses or disclosures of PHI. Some restrictions are mandatory in specific circumstances, while others may be declined as permitted by law.
Request communications through alternative methods or at alternative locations, where applicable.
Request a copy of the applicable healthcare provider's Notice of Privacy Practices.
Requests should be directed to the healthcare entity responsible for maintaining the relevant records. P3P Labs can assist in identifying the appropriate contact where necessary.
Protected health information is retained in accordance with applicable legal, regulatory, and healthcare recordkeeping requirements.
Retention periods may vary depending on the type of information, healthcare provider, jurisdiction, and purpose of processing.
HIPAA does not establish a universal medical-record retention period. Applicable state and other laws may impose additional requirements. Records will be retained, archived, or securely disposed of in accordance with applicable obligations.
If a security incident involving PHI occurs, the responsible entity will investigate and respond in accordance with applicable law.
Where a reportable breach of unsecured PHI occurs, affected individuals and relevant authorities will be notified as required by HIPAA and other applicable regulations.
Business associates must report breaches and other incidents to the responsible covered entity in accordance with applicable legal and contractual requirements.
P3P Labs may use technology platforms to support healthcare administration, clinical workflows, and coordination of services.
Where these systems process PHI, their use must comply with applicable HIPAA requirements, including appropriate access controls, permitted purposes, and Business Associate Agreements where required.
Use of PHI for AI model training, research, or other secondary purposes is subject to applicable legal requirements and any necessary authorization.
Clinical decisions remain the responsibility of appropriately licensed healthcare professionals.
P3P Labs serves customers in the United States, Europe, and the Middle East.
Health information may also be subject to international privacy and data protection requirements, including the General Data Protection Regulation (GDPR) where applicable.
HIPAA compliance does not automatically establish compliance with other applicable privacy laws.
International transfers and processing of sensitive health or genetic information must comply with the relevant legal requirements.
Individuals who believe their HIPAA privacy rights have been violated may submit a complaint to the responsible covered healthcare entity. Complaints may also be submitted to the U.S. Department of Health and Human Services Office for Civil Rights (OCR).
Individuals will not be retaliated against for filing a privacy complaint or exercising rights protected by HIPAA.
Information about submitting a HIPAA complaint is available at www.hhs.gov/hipaa.
P3P Labs may update this policy periodically to reflect changes in healthcare services, privacy practices, technology, or applicable legal requirements.
Updated versions will be published on our website with the applicable revision date.
Where HIPAA requires changes to an official Notice of Privacy Practices, the responsible covered entity will provide the required notice.
For general questions regarding health information privacy or assistance identifying the appropriate healthcare privacy contact, please contact:
P3P Labs | Client Care
Website: www.p3plabs.com
Email: info@p3plabs.com
Requests involving specific medical records, HIPAA rights, or healthcare privacy complaints may need to be directed to the responsible healthcare provider or covered entity.