1. Practice & Privacy Policy for CannaVerde Health

Scope: This policy covers the CannaVerdeHealth.com website, any mobile applications, as well as the telehealth platform.

Effective Date: 9/30/2026.

Updates: Patients will be notified of material changes via email from info@cannaverdehealth.com.

Contact Information

  • Practice Name: CFPMG LLC, DBA CannaVerde Health
  • Privacy Officer / Contact: Keith Matthews, CEO CannaVerde Health
  • Email: info@cannaverdehealth.com
  • Address: CFPMG LLC, 313 Canadian TX, 79014

2. Notice of Privacy Practices (HIPAA Compliance)

Under HIPAA, a telehealth provider must present a formal Notice of Privacy Practices (NPP) detailing how Protected Health Information (PHI) is handled.

Information We Collect

  • Personal Identifiers: Name, date of birth, contact details, government-issued IDs. CannaVerde Health is strictly a platform for those over the age of 18 and WILL NOT cater to or market to minors.
  • Protected Health Information (PHI): Medical history, current symptoms, treatment plans, prescriptions, laboratory/diagnostic results, and vital signs recorded or uploaded during virtual visits.
  • Virtual Session Data: Audio/video session feeds, chat messaging logs within the portal, and patient-submitted photos or files.
  • Technical & Usage Data: IP address, device type, browser information, login timestamps, and cookies used to secure session connections.

Permitted Uses & Disclosures of PHI

PHI is primarily used for Treatment, Payment, and Health Care Operations (TPO):

  • Treatment: Coordinating care with referring physicians, specialists, laboratories, or pharmacies.
  • Payment: Processing credit, debit, or HSA card payments. This information WILL NOT be retained for future use or renewals.
  • Operations: Quality assurance, auditing, compliance monitoring, and platform reliability assessments.

Special Disclosures Without Patient Consent

Specified mandatory or legal situations where PHI may be shared without prior authorization:

  • Judicial or administrative proceedings (e.g., court orders, subpoenas).
  • Public health reporting (e.g., communicable disease reporting).
  • Mandatory child/elder abuse reporting or threats of self-harm / harm to others.

3. Telehealth Platform & Security Practices

  • Technical Safeguards: All audio, video, and data transmissions are encrypted in transit using industry-standard protocols (e.g., TLS/HTTPS and AES-256 encryption at rest).
  • Business Associate Agreements (BAAs): All third-party vendor platforms (e.g., video conferencing providers, EHR platforms, billing portals, cloud hosting) have executed signed Business Associate Agreements (BAAs) to ensure HIPAA compliance.
  • Recording Policy: Telehealth video and audio sessions are live-streamed and not recorded unless required for clinical reasons, in which case explicit written patient authorization will be obtained prior to recording.

4. Patient Rights Under HIPAA & Privacy Laws

Outline the specific rights guaranteed to patients regarding their health records:

  • Right to Inspect and Copy: Patients may request copies of electronic health records (EHR) and telehealth session notes.
  • Right to Amend: Patients may request corrections to inaccurate or incomplete medical records.
  • Right to Request Restrictions: Patients may ask to limit how PHI is used or shared for treatment, payment, or operations.
  • Right to Confidential Communications: Patients may specify alternative communication methods (e.g., requesting calls to a specific phone number or messaging through a secure patient portal).
  • Right to an Accounting of Disclosures: Patients may request a list of certain non-routine disclosures of PHI.
  • Right to File a Complaint: Patients may file an internal complaint with CannaVerde Health at info@cannaverdehealth.com, or an external complaint with the State of Texas Medical Board Complaint Portal, or by calling their hotline at 800-201-9353 without fear of retaliation.

5. Website Cookies, Analytics & State Regulations

  • Tracking & Ad Pixels: Cookies are used for authentication and site security purposes only and versus general web analytics, not for marketing purposes.
  • State Privacy Laws: CFPMG LLC will ensure compliance with state-level medical privacy laws (e.g., Texas Medical Records Privacy Act), which may require stricter consent or data deletion rights for non-PHI data.