Health Information Privacy Notice

No Notice of Privacy Practices is effective for the intended production service. Whether a separate notice is required, and the duties and rights it must describe, remain subject to counsel and compliance approval for the final operating model.

Public, paid, health-data-bearing, and licensed-professional features must remain unavailable until the applicable notice is approved, versioned, published, and bound to the launch evidence record. Repository controls and encryption settings do not by themselves establish regulatory status.

The current engineering privacy draft describes the intended fail-closed consent, vendor, access, retention, and incident boundaries.