Your health information, explained plainly.

What this website collects

The forms on this site ask for contact and routing details only: name, email address, phone number, and state. They are used to reply, to route an enquiry to the right team, and to arrange a conversation.

They do not ask about symptoms, injuries, treatment, or medical history, and this site is not the place to send them. Information sent by email is used for the same purposes: reply and routing.

This site loads no third-party fonts, scripts, analytics, trackers, or advertising, and makes no requests to other companies’ servers. Standard technical information is generated by any web server, such as browser type and pages requested.

Text messaging

If you opt in to InjuryDox account notifications, InjuryDox collects your mobile number and your consent so it can send the messages on the text messaging program page: check-in reminders, appointment notices, portal message alerts, and sign-in verification codes.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties, including attorneys, clinics, medical groups, and affiliates.

You can opt out at any time by replying STOP. Program terms are in the terms of service.

Who holds the clinical record

When clinical care is provided, it is provided by licensed clinicians through an independent, physician-owned medical group. InjuryDox supports technology, coordination, documentation, and administrative workflows and does not itself practice medicine.

The medical group holds the clinical record and issues its own Notice of Privacy Practices, provided at enrollment. That notice governs how health information is handled in care. InjuryDox handles clinical information on the medical group’s behalf, under written agreement.

The sections below describe what to expect once care begins.

How health information is used in care

HIPAA generally permits covered health care providers to use or disclose protected health information for treatment, payment, and health care operations without a separate authorization, subject to applicable limits and safeguards.

• Treatment: providing, coordinating, and managing care, including consultation and appropriate information exchange among providers.
• Payment: billing, collection, financial administration, and related activities.
• Health care operations: quality improvement, care coordination, training, security, auditing, compliance, and other permitted operational activities.
• Other permitted or required purposes: disclosures allowed or required by law, including certain public-health, oversight, safety, or legal obligations.

Those uses apply to health information held for care. They do not apply to text messaging originator opt-in data and consent. That information will not be shared with any third parties.

Official overview: HHS treatment, payment, and health care operations guidance.

When authorization is used

When a use or disclosure is not otherwise permitted by law, the appropriate written authorization is obtained. For example, release of clinical information to a patient's attorney generally follows a patient authorization that describes the information and intended recipient. That authorization does not cover text messaging originator opt-in data and consent, which will not be shared with any third parties.

An authorization can ordinarily be revoked prospectively, subject to actions already taken in reliance on it and other applicable legal limits. Treatment is not conditioned on an authorization except where the law permits.

De-identified information

Information that has been de-identified in accordance with applicable law may be used to improve quality, operations, workflows, analytics, products, and models. De-identified information is not intended to identify an individual.

Your privacy rights

Depending on the entity, record, and applicable law, patients may have rights to:

• access and obtain copies of health information;
• request an amendment of information believed to be inaccurate or incomplete;
• request certain restrictions or confidential communications;
• receive an accounting of certain disclosures;
• receive a paper or electronic copy of the applicable Notice of Privacy Practices; and
• file a complaint without retaliation.

Official overview: HHS medical-record rights.

Security and retention

Administrative, technical, and physical safeguards are used to protect information. No system can guarantee absolute security. Contact details submitted through this site are kept only as long as needed to answer and route the enquiry. Medical-record retention is set by the medical group under the law of the state where care is delivered, and is stated in the documents provided at enrollment.

Questions or complaints

Contact privacy@injurydox.com. Patients may also contact the U.S. Department of Health and Human Services Office for Civil Rights. Filing a privacy complaint will not affect care.

Controlling documents. The medical group’s Notice of Privacy Practices, the patient consents and authorizations signed at enrollment, and any applicable state supplements control over this website summary if they differ.