The General Data Protection Regulation 2016 (GDPR) and the Health Insurance Portability and Accountability Act (HIPAA) are among the most significant pieces of legislation affecting the way that FMLA Doctor, operating as DBA Founder Manage LLC, carries out its medical data processing activities. Significant fines are applicable if a breach is deemed to have occurred under GDPR and HIPAA, which are designed to protect the personal data and protected health information of patients. It is FMLA Doctor’s policy to ensure that our compliance with HIPAA, GDPR, The California Consumer Privacy Act (CCPA), and other relevant healthcare legislation is clear and demonstrable at all times.
There are a total of 26 definitions listed within Article 4 – Definitions of the GDPR, and it is not appropriate to reproduce them all here. However, the most fundamental definitions with respect to this policy are as follows:
FMLA Doctor collects several types of information to provide and improve our telehealth and medical certification services:
Account Information: When you register, we collect your name, email address, password, and billing details for patients and healthcare providers.
Medical Consultation Recordings: We collect video recordings and audio during telehealth consultation sessions to enable clinical documentation, medical evaluation, and continuity of care.
Protected Health Information (PHI): We store medical history, health conditions, symptoms, treatment responses, and clinical assessments provided during consultations.
Clinical Assessment Data: We collect standardized assessment responses, psychometric tool results (PHQ-9, GAD-7, DASS), and biopsychosocial evaluation data for medical certification purposes.
Usage Information: We collect information about how you interact with our Service, including log data, device information, IP address, browser type, and consultation session data.
Communications: We store communications you have with our healthcare team, clinical correspondence, and medical documentation.
Under HIPAA, GDPR, and applicable healthcare regulations, we rely on the following legal bases to process your personal health information:
Healthcare Service Delivery: We process account information, medical consultation recordings, and clinical assessments as necessary to provide telehealth services and FMLA medical certifications.
Healthcare providers using FMLA Doctor are responsible for ensuring they have appropriate medical licensing and patient consent for conducting telehealth consultations and clinical assessments.
FMLA Doctor provides comprehensive telehealth services and clinical assessments for FMLA medical certification:
Clinical Evaluation: Our licensed healthcare providers conduct standardized biopsychosocial assessments, mental health evaluations, and clinical interviews to determine medical conditions and functional limitations.
Medical Documentation: During consultations, we document clinical findings, diagnostic assessments, and medical reasoning to support FMLA certification decisions and ensure proper medical records.
Psychometric Assessment: We utilize validated assessment tools (PHQ-9, GAD-7, DASS) and standardized evaluation criteria to conduct objective clinical assessments for mental health conditions.
Privacy-First Medical Practice: All clinical data is processed solely for legitimate medical purposes and FMLA certification. We do not use medical information for any purpose beyond the specific healthcare services provided.
Licensed Provider Review: Medical consultations and assessments are conducted exclusively by licensed healthcare providers (LCSWs, Psychologists, Psychiatrists). All FMLA certification decisions are made by qualified medical professionals based on clinical evaluation.
Our telehealth platform includes measures to ensure safe and compliant medical practice:
Medical Practice Compliance: We maintain compliance with state medical licensing requirements, telehealth regulations, and standard of care guidelines for remote medical consultations.
Patient Responsibility: Patients are responsible for providing accurate medical information and following medical guidance provided. Providing false medical information may impact the validity of medical assessments.
Reporting Mechanisms: We provide ways for patients and providers to report technical issues, privacy concerns, or clinical safety issues related to telehealth consultations.
Consultation Security: All telehealth sessions use HIPAA-compliant secure connections, encrypted communications, and strict access controls to protect patient privacy and medical data.
Medical Privacy Protection: We implement comprehensive safeguards to ensure patient health information is protected according to HIPAA requirements and is accessed only by authorized healthcare providers for legitimate medical purposes.
We implement and maintain appropriate technical and organizational security measures to protect your personal data:
Encryption: All data is encrypted both at rest and in transit using industry-standard encryption protocols (AES-256 and TLS 1.3).
Access Controls: We enforce strict role-based access controls and multi-factor authentication for all staff accessing systems containing personal data.
Monitoring and Testing: We conduct regular security monitoring, vulnerability scanning, and penetration testing of our systems.
Incident Response: We maintain a comprehensive incident response plan with designated responsibilities to quickly address any potential security events.
Vendor Assessment: We thoroughly vet all third-party service providers for appropriate security practices before engaging them.
These security measures are regularly reviewed and updated to address new threats and vulnerabilities. While we implement best practices for security, no system can guarantee absolute security. We encourage users to help by maintaining strong passwords and reporting any suspicious activities.
Personal data shall be:
FMLA Doctor must ensure that it complies with all these principles both in the processing it currently carries out and as part of the introduction of new methods of processing such as new IT systems. We implement HIPAA-compliant security practices and healthcare industry best practices for medical information security management as part of that commitment.
FMLA Doctor retains different types of medical data for varying periods based on healthcare requirements and legal obligations:
Account Information: We retain your account information for as long as your account is active and for a period thereafter to comply with medical practice requirements, legal obligations, and continuity of care needs.
Medical Consultation Records: Video recordings and audio from telehealth consultation sessions are retained according to medical record retention requirements, typically 7-10 years as required by state medical practice laws and HIPAA.
Clinical Assessments: Medical evaluations, diagnostic assessments, and FMLA certification documentation are retained according to medical record retention standards to support continuity of care and legal compliance.
Patient Health Information: Complete medical consultation data and PHI are retained according to HIPAA requirements and state medical practice laws for the legally required retention periods.
Clinical Documentation: Psychometric assessment results, clinical notes, and medical reasoning documentation are retained as part of the medical record for the full legal retention period.
System Logs: For security, compliance, and operational integrity purposes, system logs are retained for 10 years. These logs contain technical information about service operation but do not include medical consultations or patient health information.
Upon account termination, medical records will be retained according to legal requirements for medical record retention (typically 7-10 years). You may request copies of your medical records by contacting support@fmla.doctor. Deletion of medical records may only occur after the legally required retention period has expired.
When you request access to or deletion of your medical records:
Verification: We will verify your identity through appropriate means, which may include confirming through your registered email address, requesting government-issued ID, or other verification methods required for medical record access.
Confirmation: We will provide confirmation of medical record access or explain legal limitations on deletion requests.
Medical records serve important legal, clinical, and continuity of care purposes and must be retained according to healthcare regulations.
The data subject also has rights. These consist of:
“To protect the integrity and security of our internal systems, we may limit access to specific details about how your data is processed, where such disclosure would compromise proprietary methods or allow for system manipulation. We are committed to balancing transparency with the need to maintain secure and reliable services.”
Each of these rights must be supported by appropriate procedures within Founder Manage LLC that allow the required action to be taken within the timescales stated in the regulations.
Under applicable privacy laws, you have the right to receive your personal data in a structured, commonly used, and machine-readable format:
Data provided through our portability process is designed to be easily transferable to other services where technically feasible.
If you have concerns about any automated processing of your medical data, please contact us at support@fmla.doctor.
If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with specific rights regarding your personal information:
Right to Know: You have the right to request information about the personal information we collect, use, disclose, and sell.
Right to Delete: You have the right to request deletion of personal information we have collected about you, subject to certain exceptions necessary for providing our service or legal compliance.
Right to Opt-Out: While FMLA Doctor does not sell personal health information as traditionally defined, California residents have the right to opt-out of certain data sharing practices classified as “sales” under the CCPA.
Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights, and will continue to provide medical services without discrimination.
To exercise these rights, please contact us at support@fmla.doctor. We will respond to verifiable consumer requests within 45 days. You may make a request up to twice within a 12-month period.
For verification purposes, we may need to request specific information to confirm your identity. This is a security measure to ensure personal information is not disclosed to unauthorized individuals.
FMLA Doctor’s services are designed for patients who are at least 18 years of age. We do not knowingly collect medical information from individuals under 18 years old without appropriate parental or guardian consent.
If we learn that we have collected medical information from a person under 18 without proper consent, we will promptly address the situation according to healthcare regulations. If you believe we might have collected information from a person under 18, please contact us at support@fmla.doctor.
For EU users, where the age of consent for data processing may vary between 13-16 years depending on the member state, we require parental consent for users under 16 years of age.
Unless it is necessary for a reason allowable in the regulations, consent must be obtained from a data subject to collect and process their data. In the case of children below the age of 16 (Note – this age may be lower in individual EU member states), parental consent must be obtained. Transparent information about our usage of their personal data must be provided to data subjects at the time that consent is obtained, and their rights regarding their data explained, such as the right to withdraw consent. This information must be provided in an accessible form, written in clear language, and free of charge.
If the personal data are not obtained directly from the data subject, then this information must be provided within a reasonable period after the data are obtained and definitely within one month.
FMLA Doctor uses cookies and similar technologies to enhance your experience, analyze usage, and deliver content and advertisements:
Essential Cookies: These cookies are necessary for the website to function and cannot be disabled. They help with basic functionality and security features.
Analytical/Performance Cookies: These cookies allow us to recognize and count visitors, understand how visitors navigate our site, and improve the website’s functionality.
Functionality Cookies: These cookies enable the website to provide enhanced functionality and personalization based on your preferences and choices.
Targeting/Advertising Cookies: We may use these cookies to deliver advertisements relevant to you and your interests.
Other Tracking Technologies: We also use web beacons, pixels, and local storage to collect information about how you interact with our services.
You can manage your cookie preferences through your browser settings or our cookie preference center. Please note that disabling certain cookies may affect the functionality of our Service.
For more information about cookies, including how to see what cookies have been set and how to manage or delete them, visit www.allaboutcookies.org.
FMLA Doctor has adopted the principle of privacy by design and will ensure that the definition and planning of all new or significantly changed systems that collect or process medical data will be subject to due consideration of HIPAA compliance and privacy issues, including the completion of one or more privacy (also known as data protection) impact assessments.
The privacy impact assessment will include:
Use of techniques such as data minimization and pseudo-anonymization will be considered where applicable and appropriate.
To provide our Service, FMLA Doctor works with trusted third-party service providers who may process your medical data:
Amazon Web Services (AWS): Our primary infrastructure provider hosts all FMLA Doctor services and medical data. AWS maintains industry-leading security practices and complies with major security certifications including ISO 27001, SOC 2, HIPAA, and GDPR requirements.
AWS Services: We utilize various HIPAA-compliant AWS services for secure medical data processing, analytics, and infrastructure management. All medical data processed through AWS services is subject to AWS’s comprehensive security controls and healthcare-grade privacy protections.
Payment Processors: We use industry-standard, HIPAA-compliant payment processors to handle subscription payments. We do not store complete credit card information on our servers.
These service providers are contractually obligated to handle your medical data in compliance with HIPAA, applicable healthcare privacy laws, and our instructions. We regularly review their security and privacy practices to ensure compliance with healthcare standards.
For more information on AWS’s data security and privacy practices, you can visit their privacy policy at AWS Privacy Policy.
FMLA Doctor works with third-party service providers who may process medical data on our behalf to deliver our healthcare services. Our current key sub-processors include:
We maintain a complete and up-to-date list of our sub-processors at [fmla.doctor/subprocessors]. This list includes the name and location of each sub-processor, as well as the healthcare services they provide.
Before engaging any new sub-processor, we conduct due diligence to ensure they provide appropriate HIPAA compliance, healthcare privacy and security guarantees. All our sub-processors are bound by Business Associate Agreements (BAAs) that require them to process medical data only according to our instructions and implement appropriate healthcare security measures.
If you wish to object to our use of a particular sub-processor, please contact us at support@fmla.doctor.
FMLA Doctor is based in the United States and processes medical data on servers primarily located in the United States. However, we may transfer, process, and store medical data in other countries where our HIPAA-compliant service providers maintain facilities:
Transfer Mechanisms: When transferring medical data from the European Economic Area (EEA), United Kingdom, or Switzerland to countries that do not have adequate data protection as determined by the European Commission, we rely on legal mechanisms such as Standard Contractual Clauses (SCCs), adequacy decisions where available, or legitimate medical interests.
AWS Global Infrastructure: As our primary infrastructure provider, AWS operates HIPAA-compliant data centers globally. Your medical data may be replicated across different AWS regions for redundancy and disaster recovery purposes, always maintaining appropriate healthcare safeguards.
Security Measures: Regardless of where your medical data is processed, we maintain appropriate technical and organizational safeguards to protect your health information according to HIPAA and other applicable healthcare laws.
Data Protection Impact Assessments: Where required by law, we conduct data protection impact assessments for cross-border transfers to ensure adequate protection of transferred medical data.
If you have questions about our international medical data practices, please contact us at support@fmla.doctor.
A defined role of Data Protection Officer (DPO) is required under the GDPR if an organization is a public authority, if it performs large-scale monitoring, or if it processes particularly sensitive types of data on a large scale. Given that FMLA Doctor processes protected health information (PHI), we are evaluating the appointment of a Data Protection Officer to ensure comprehensive healthcare privacy compliance.
It is FMLA Doctor’s policy to be fair and proportionate when considering the actions to be taken to inform affected parties regarding breaches of medical data. In line with HIPAA and GDPR requirements, where a breach is known to have occurred which is likely to result in a risk to patient safety or privacy rights, the relevant supervisory authorities (including HHS for HIPAA breaches) will be informed within the required timeframes (72 hours for GDPR, 60 days for HIPAA).
FMLA Doctor maintains comprehensive records to demonstrate our compliance with healthcare data protection principles:
Regular Reviews: We conduct periodic reviews of our privacy practices, typically annually or when there are significant changes to our services or applicable laws.
These accountability measures help ensure consistent application of privacy principles throughout our operations and demonstrate our commitment to responsible data handling.
If you have any questions, concerns, or requests regarding your personal data or this Privacy Policy, you can reach our privacy team through the following channels:
Email: support@fmla.doctor
Postal Address: FMLA Doctor (DBA Founder Manage LLC) Privacy Department [Your physical address] [City, State ZIP]
Medical Record Requests: For formal medical record requests (access, copies, etc.), please use our dedicated form at [fmla.doctor/medical-records] or email support@fmla.doctor with the subject line “Medical Record Request.”
We aim to respond to all privacy inquiries within 30 days. For complex requests or in cases where additional verification is needed, we may extend this response time and will notify you accordingly.
If you are located in the European Economic Area and believe we have not adequately addressed your privacy concerns, you have the right to contact your local data protection authority.
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, and other factors:
Effective Date: The revised Privacy Policy will be effective immediately upon posting, or at a later date as specified in the notification.
Review of Changes: We will include a summary of material changes and maintain an archive of previous versions accessible upon request.
We encourage you to periodically review this Privacy Policy to stay informed about our data practices.
The following actions are undertaken to ensure that FMLA Doctor complies at all times with the accountability principle of HIPAA and GDPR:
These actions are reviewed regularly as part of the information security management process.