MedCBO, Inc. and Colorado Health and Tech Centers, LLC. Unified Privacy Policy

Purpose

MedCBO, Inc. (“MedCBO,” “we,” “our,” or “us”) is committed to protecting the privacy and security of individuals’ personal information. This Privacy Policy outlines our practices regarding the collection, use, disclosure, and protection of personal data. MedCBO is an S-Corporation organized under the laws of the State of Colorado and conducts business in all 50 states.

In connection with our role as the preferred provider of operational, administrative, and clinical support services for independent physician practices seeking space at Colorado Health and Tech Centers, LLC (“CHTC”), we may share limited personal and professional information with CHTC under the terms of a mutual Business Associate Agreement (BAA). CHTC is a separate legal entity and not owned by or affiliated with MedCBO, but our collaboration supports a streamlined experience for physicians seeking both space and services.

Scope

This Privacy Policy applies to all personal information collected, used, or disclosed by MedCBO through our website, services, communications, and third-party tools such as HubSpot and Microsoft Office 365. This policy complies with applicable federal and state privacy laws, including but not limited to the California Consumer Privacy Act (CCPA), Colorado Privacy Act (CPA), and other similar state-specific privacy laws.

Definitions

• NPI – National Provider Identifier
• PHI – Protected Health Information
• HIPAA – Health Insurance Portability and Accountability Act, enacted 1996
• HITECH – Health Information Technology for Economic and Clinical Health

Procedure

Information We Collect:

We may collect the following types of personal information:

1. Contact information (e.g., name, email address, phone number)
2. Professional details (e.g., practice name, NPI, job title)
3. Technical information (e.g., IP address, browser type, device identifiers)
4. Communications and correspondence
5. Any other information provided voluntarily by users or clients

Use of Personal Information

We use personal information to:

1. Provide, operate, and improve our services
2. Respond to inquiries and provide customer support
3. Communicate important updates and marketing materials
4. Comply with legal obligations
5. Analyze website usage and trends

Sharing of Information

We do not sell personal information. We may share information only as necessary for the following purposes:

1. Service providers (e.g., Microsoft, HubSpot) to perform services on our behalf
2. Legal or regulatory requirements
3. Protection of rights, safety, and property
4. Business transfers or reorganizations
5. Sharing with Colorado Health and Tech Centers, LLC – As a strategic partner supporting independent physician practices, MedCBO may share physician contact and business information with CHTC under a valid Business Associate Agreement. This is done only to coordinate interest in available space and services under the Colorado Health and Tech Centers initiative. No clinical or protected health information (PHI) is shared unless otherwise required under applicable HIPAA-compliant protocols.

Data Retention

We retain personal information only as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law. When information is no longer needed, it is securely deleted or anonymized.

Your Rights

Depending on your state of residence, you may have the right to:

1. Access the personal information we hold about you
2. Request correction or deletion of your information
3. Opt out of data sharing for targeted advertising
4. Lodge a complaint with a supervisory authority
5. Requests can be submitted by contacting us at Legal@medcbo.com

Security

We implement appropriate technical and organizational security measures to protect personal information from unauthorized access, disclosure, alteration, and destruction. However, no method of transmission over the internet is entirely secure.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The latest version will always be available on our website.

Contact Us

If you have any questions or concerns regarding this Privacy Policy or our data practices, please contact:

If to MedCBO:
Legal@medcbo.com

If to CHTC:
ATTN: LEGAL NOTICE
5800 S Quebec St
Greenwood Village, CO 80111

Healthcare and Health IT Compliance

If you believe your HIPAA rights have been violated, you may also contact our HIPAA Privacy Officer at the above email address.

As a company operating in the healthcare and healthcare IT sectors, MedCBO, Inc. complies with the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the Health Information Technology for Economic and Clinical Health (HITECH) Act, and other applicable federal and state laws governing the privacy and security of protected health information (PHI).

In the course of providing services, MedCBO may receive, create, maintain, or transmit PHI on behalf of covered entities and is therefore committed to upholding the highest standards of confidentiality and data protection. We implement administrative, physical, and technical safeguards as required by HIPAA to ensure the integrity and security of PHI.

MedCBO enters into Business Associate Agreements (BAAs) with covered entities, business associates, and strategic partners such as Colorado Health and Tech Centers, LLC, as necessary to comply with HIPAA and HITECH regulations. These agreements define our responsibilities in handling PHI and provide assurances that we will use the information only for permitted purposes and protect it in accordance with the law.

Our systems and processes are designed to support the secure exchange and management of healthcare data in compliance with applicable healthcare privacy and security regulations. MedCBO also adheres to industry best practices for data governance and undergoes periodic audits and assessments to ensure ongoing compliance.

Relevant Links

• U.S. Department of Health and Human Services – HIPAA

Appendices List (attached to Policy)

There are no appendices to this policy.

Compliance Standards

• Evaluation of policy at a minimum annually
• Full legal review at a minimum every five (5) years