Privacy Policy

This is your Notice of Privacy Practices from PRC-Saltillo. This notice contains our privacy policy and describes how information about you, including your medical information, may be used and disclosed and how you can get access to and amend this information. Please review it carefully.

This notice has been updated to comply with the California Consumer Privacy Act.

Prentke Romich Company, doing business as, PRC-Saltillo (“PRC-Saltillo”, “us”, “we”, “our”) is a manufacturer and supplier of speech generating devices which are durable medical equipment, and associated products and services. We strive to achieve the following:

Our mission:
Enable individuals with speech and language impairments to successfully communicate and interact in their environment.

Our method:
Enable individuals with speech and language Provide products & services that promote success for individuals who use AAC, their families and their support teams.

Our manner:
Enable individuals with speech and language Treat everyone with whom we interact with the highest respect. Empower employees to embrace their individual roles in helping our customers achieve success.

PRC-Saltillo respects your right to privacy and the security of your information. The Health Insurance Portability and Accountability Act of 1996 (HIPAA) requires health care providers to provide you with a Notice of Privacy Practices (Notice), which is a written notice describing the uses and disclosures of your protected health information (PHI), your privacy rights, and our legal duties with respect to your PHI. PRC-Saltillo is a health care provider because the communication solutions we provide include medical devices and the use and disclosure of PHI is necessary to provide services to our clients. We hold any information you give us with the utmost care and security.

The purpose of this Notice is to describe to you, PRC-Saltillo customers and visitors to our websites, how personal information about you, including health information, that has been provided to PRC-Saltillo by you or others may be used and disclosed by us and how you can request access to and/or the correction of your personal information in our records. This policy also explains how you may contact us with questions about this policy, our privacy practices or our management of your personal information.

This Notice applies to all PRC-Saltillo websites, equipment, and software applications. It applies only to PRC-Saltillo, our websites, our products and services (devices, software applications and mobile applications) and does not apply to the products, applications, or websites of third parties that you may be able to access from our products or from any of PRC-Saltillo’s websites. Our web sites contain links to other web sites. We are no responsible for the privacy practices or content of those web sites. We encourage you to review the privacy statements of any web sites you visit to better understand how they use and share your information.

This policy is reviewed and updated from time to time to time to reflect changes in applicable law or our business, and our information management practices. Please review it periodically and if you have any questions or concerns regarding this privacy policy statement, please contact the PRC-Saltillo Privacy Officer at beth.mulcahy@prentrom.com.

The effective date at the top of this Notice is the last amendment date. Please review the Notice if the date indicates that it has been amended since the last time you transacted with us or visited our site as by doing so, your agreement to the amendments is confirmed. Any amendments to this policy will be effective for all personal information that we maintain.

Personal information means information about an identifiable individual.

Protected Health Information (PHI) is any information:

• individually identifiable (i.e., contains your name or other distinguishing information);
• created, transmitted, or maintained by PRC-Saltillo, whether in oral, written, or electronic form; whether created or received by PRC-Saltillo from health care providers, payors or customers;
• relates to (i) your past, present, or future physical or mental health or condition, (ii) the provision of healthcare to you, or (iii) the past, present or future payment for the provision of healthcare to you.

This Notice does not apply to information that has been de-identified. De-identified information is information that does not identify an individual and with respect to which there is no reasonable basis to believe that the information can be used to identify an individual. PHI does not generally include information available or reported in a summarized or grouped manner, such as aggregate information and statistics. In this policy, the acronym “PHI” will be used to mean personal information and protected health information.

PRC-Saltillo only collects, uses and discloses your information, including PHI, in accordance with applicable law. We will not collect any personal information from you without your specific knowledge and consent. We hold any information you give us with the utmost care and security. We do not sell, rent, or loan any customer information. When you order or purchase a product or service from us, fill out a form, or browse our websites, you are accepting the conditions of our privacy policy which means that you are consenting to our collection, use, disclosure and storage of your information, including PHI, in accordance with this Notice.

Customer Service. We may collect certain information to better serve you, including in the event you have questions about a product you have purchased from us. Examples of such PHI are: name, address, e-mail address, phone number and product serial number.

PRC-Saltillo may contact you to provide you with introductory and support information, product or service offering that may be of interest to you or to let you know about important changes at the company. If you receive such information, you have the option to unsubscribe by changing your personal preferences.

Security. PRC-Saltillo makes safety while shopping in our on-line store a priority. We do not store your credit card information on our servers and our site is secured using DigiCert SSL Certificates. This ensures encryption of all information sent to us via the World Wide Web and demonstrates our commitment to your security.

Cookies. We may use your browsing activity on our website to customize the information we provide to you. Cookies are used to provide you with the best experience on our website. A cookie is a small piece of data stored on your hard drive containing some anonymous demographic information that does not reveal your specific identity. Examples include: zip code, time zone, user preferences, web visits, IP address, browser and device information, domain name and referring website. Cookies are also used for security purposes when logging into a portal on the website such as Funding Assistant, e-store, AAC Language Lab®, Realize Language™, iShare and iShare PRC®.

We use Google Analytics to help us better serve customers who visit our websites. Google Analytics employs the use of cookies. We do not use the remarketing or advertising features and do not sell your information or share it with any other third parties through the use of Google Analytics. For more information on how Google Analytics collects and processes data see How Google Uses Data When You Use Our Partners' Sites or Apps.

PRC-Saltillo may collect PHI indirectly through interactions with your health care providers through applications, interviews, surveys, and other forms. PHI may be obtained in writing, in person, by telephone, and electronically. The information we collect varies depending on the purpose for the collection, but generally includes information needed to process a request for purchase of our durable medical equipment through a third party insurance agency. PRC-Saltillo may collect your name, address, telephone number, date of birth, medical history, diagnoses, treatment, provider identification and treatment information, financial responsibility and payment information, and family and advocate contact information.

The privacy rules generally allow the use and disclosure of your PHI without your permission (known as an authorization) in the following circumstances:

(The amount of PHI used or disclosed will be limited to the "Minimum Necessary," as defined under the HIPAA rules. Therefore, we will only disclose the information that is reasonably necessary to serve the purpose of the disclosure.)

• For Treatment. We may use or disclose your PHI for treatment purposes to provide health care services, which include providing, coordinating, or managing health care by one (1) or more health care providers or doctors. Treatment can also include coordination or management of care between a provider and a third party, and consultation and referrals between providers. For example, we may share PHI about you with your speech language pathologist or treating doctor.
• For Payment. We may use or disclose your PHI for payment purposes, which include activities by health PRC-Saltillo, or providers to obtain insurance information, make coverage determinations and provide reimbursement for health care. This can include eligibility determinations, review of services for medical necessity or appropriateness, utilization-management activities, claims management, billing, and collection. For example, we may share information about your coverage or the expenses you have incurred with your health plan in order to coordinate payment of benefits.
• For Health Care Operations. We may use or disclose your PHI for health care operations, which includes quality assessment and improvement activities, customer service, and internal­ grievance resolution. Health care operations also include vendor evaluations, credentialing, risk adjustment and utilization review activities, training, and accreditation, medical review and audit activities, and business planning and development, and in the event of a corporate reorganization or merger. For example, we may use information about your order to review the effectiveness of our customer service.
• To Business Associates. We may disclose PHI to our business associates to assist us in the provision of health care services. For example, business associates may include distributors, translators, consultants, and attorneys. Business associates may receive, create, maintain, and/or disclose your PHI without your authorization, but only after the business associate agrees in writing with PRC-Saltillo to limit its uses and disclosures to proper purposes and to implement appropriate safeguards regarding your PHI.
• To Personal Representatives. We may also disclose your PHI to individuals authorized by you, or to an individual designated as your personal representative, so long as you provide us with a written notice or authorization and any supporting documents (i.e., healthcare power of attorney or designation of personal representative}. However, we do not have to disclose information to a personal representative if we have a reasonable belief that (1) you have been, or may be subjected to domestic violence, abuse or neglect by such person; (2) treating such person as your personal representative could endanger you; or (3) it is not in your best interest to treat the person as your personal representative.

Log into your web account or call us at 800-262-1984 to access and edit your account information.

TouchChat™ and LAMP Words for Life®
TouchChat™ and LAMP Words for Life® (and all associated apps, e.g., TouchChat with WordPower) are language system applications (apps) downloaded for use on mobile Alternative and Augmentative Communication (AAC) Devices to enable independent communication for people with disabilities. The apps require no sign-in, log-in, or any information to use the app once it is downloaded. The apps only collect any information voluntarily provided when registering for an account. Account registration is not required to use the app and your registration does not link directly to your app or any device that you use to access the app. If you choose to register for an account, the information requested should be that of the app purchaser/owner and includes basic information: first and last name, email address, home or work address, and phone number. Upon account registration, you may receive emails from PRC-Saltillo regarding the use and implementation of the app. All purchases are done through Apple iTunes and neither the apps nor PRC-Saltillo receive any customer information from Apple.

Saltillo apps use the TrueDepth camera system to track the movement of the user’s head and eyes. This allows for the Head Tracking feature which permits the user to select and activate buttons with their face. In order for this functionality to be possible, the app requires access to the device's camera. This access can be toggled on or off at any time in the device's settings. While using Head Tracking, the camera images and resulting depth data are used only for tracking the position of the user’s head and face. None of the information collected by the TrueDepth system is ever transmitted or stored by the app.

PRC-Saltillo does not collect any data containing Protected Health Information (PHI) of the account owner or person using the AAC device at any time through use of the apps. The only data sharing options for app account holders and users is through the use of additional optional on-line subscription services used in conjunction with the apps such as Realize and iShare.

Realize Language™
Realize Language™ (RL) is a server-based file storage system (hereinafter “The Service”) that provides a space for Account Holders to store and review client-generated text data created on a client’s speech generating device or software (hereinafter “Content”). Account Holders can perform analyses of this data to show word types, frequencies, and distribution over time.

For more information about Realize Language please see:

• realizelanguage.com/info/faqs
• realizelanguage.com/info/terms

iSharePRC®
iSharePRC® is a quick and convenient way to securely save and share copies of the LAMP Words for Life® iPad vocabulary files with your team.

For more information about iSharePRC®, please see:

• ishareprc.com/help

iShare
iShare is a subscription that gives a TouchChat device access to a large server, through the wireless connection on the iPod®, iPhone®, or iPad®. You are given access to a private section that only you can access. This is where you can store your personal files.

For more information, please see:

• ishareservices.com

Dialogue AAC
Dialogue AAC is a message banking app that stores audio recordings and associated metadata generated and managed by the account holder. This data is stored on a secured sever and fully encrypted using server-side AES-256 bit encryption. Encryption keys are accessible only to administrators and are equally stored in secured locations. No sharing of this data is currently available and PRC-Saltillo does not use this data for any purpose.

PRC-Saltillo does not collect any student personal information. None of the PRC-Saltillo software applications or other products used by students in schools encourage students to in any way make their personal information public. PRC-Saltillo does not disclose any student information or school materials to third parties or partners. Schools do have a right to review, have deleted, and/or refuse to permit any suspected collection or use of a student’s information by PRC-Saltillo. PRC-Saltillo will allow for inspection, review, and amendment or changes to any student data via authorized request from the school. Please contact PRC-Saltillo privacy officer at the information provided below if there is a concern about this and for guidance on how to make such a request.

Residents of the state of California have a right to what personal information a business collects about them. Under California law, the definition of Personal Information is information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. California residents have the right to know whether a business has sold this personal information or disclosed it for a business purpose and to whom, the right to say no to the sale of personal information, and the right to equal service and price regardless of any requests for information or directed the business not to sell personal information. PRC-Saltillo does not sell any consumer personal information. This Notice of Privacy practices list the types of personal information that PRC-Saltillo collects. PRC-Saltillo safeguards the personal information of consumers. You may request information the collection of personal information by contacting our privacy officer at beth.mulcahy@prentrom.com or calling PRC-Saltillo at (800) 262-1984.

We have comprehensive policies and procedures in place to protect your PHI against unlawful access, use and disclosure. Access to PHI is restricted to only those employees and business associates who need it to provide services, products, or benefits to our customers or respond to inquiries of website visitors. PRC-Saltillo may contact you about a product or service offering that may be of interest to you or to let you know about important changes at the company. If you receive such information, you have the option to unsubscribe by changing your personal preferences. All newsletters and special offers are sent via e-mail and include an opt-out link if you no longer wish to receive this from us. We maintain physical, technical, and procedural safeguards to protect your PHI against unauthorized access, use and disclosure. We have a Privacy Officer and a Security Officer who are responsible for developing, educating PRC-Saltillo personnel about, and overseeing the implementation and enforcement of our policies and procedures designed to safeguard PHI. The contact information for our Privacy and Security Officers is provided below.

PRC-Saltillo respects your privacy and will not sell, rent, or loan PHI to any third party without your consent. The following may be necessary to effectively provide service to you:

• Reminders. We may contact you to give you information about your device purchase.
• Required by Law. We may use or disclose PHI to the extent such use or disclosure is required by law (including laws of the United States) and it complies with and is limited to the requirements of that law. We also use and disclose PHI for certain law enforcement purposes and in response to subpoenas, court orders, discovery requests, and other legal processes when required to do so. In addition, we use and disclose PHI in connection with health oversight activities (e.g., government audits of our compliance with certain laws and regulations; oversight of government-funded health benefits programs, etc.).
• Safety. We may also disclosure your PHI if we believe, in good faith, that disclosure is necessary to prevent serious threat to health or safety.
• Withdrawal of Consent/Opting-Out. You may withdraw your consent to the use and disclosure of your PHI, however such withdrawal may not be retroactive, and PRC-Saltillo may need to continue to hold and use your PHI to comply with applicable law. For information about the implications of withdrawing your consent or to withdraw your consent, please contact our Privacy Officer as indicated below.

You have the following rights regarding your PHI that PRC-Saltillo maintains. These rights are subject to certain limitations, as explained below. This section of the notice describes how to exercise your rights.

• Right to request restrictions on certain uses and disclosures of your PHI
  You have the right to ask PRC-Saltillo to restrict the use and disclosure of your PHI for treatment, payment, or health care operations, except for uses or disclosures required by law. You have the right to ask us to restrict the use and disclosure of your PHI to family members, close friends or other persons you identify as being involved in your care or payment for your care. You also have the right to ask us to restrict use and disclosure of PHI to notify those persons of your location, general condition or death - or to coordinate those efforts with entities assisting in disaster-relief efforts. If you want to exercise this right, your request to us must be in writing. We will consider your request, but are not required to agree to your request for restrictions. To request restrictions, your request must be in writing and you must provide us (i) with the information you want to limit; (ii) whether you want to limit our use, disclosures, or both; and (iii) to whom you want the limits to apply (for example: your spouse). If we can agree to your request, a restriction may later be terminated by your written request, by agreement between you and PRC-Saltillo (including an oral agreement) or unilaterally by PRC-Saltillo for PHI created or received after you are notified that we have removed the restrictions. We may also disclose PHI about you if you need emergency treatment, even if we have agreed to a restriction. In compliance with student privacy laws, parents have a right to request deletion of any student data.
• Right to receive confidential communications of your PHI
  You have the right to request that we communicate with you about medical matters in a certain way or at a certain location. For example, you can ask that we only contact you at work or by mail. To request confidential communications, you must make your request in writing. We will not ask you the reason for your request. We will accommodate all reasonable requests. Your request must specify how or where you wish to be contacted.
• Right Access your PHI
  With certain exceptions, you have the right to inspect or obtain a copy of your PHI in a "Designated Record Set." This may include medical and billing records, benefit enrollment information, payment, and claims information. However, you do not have a right to inspect or obtain copies of psychotherapy notes or information compiled for civil, criminal or administrative proceedings. In addition, the PRC-Saltillo may deny your right to access, although in certain circumstances you may request a review of the denial. If you want to exercise this right, your request to PRC-Saltillo must be in writing. For PHI for which you have a right of access, you have the right to receive your PHI in an electronic format if it is readily producible in such format, and to direct PRC-Saltillo to transmit a copy of your PHI to an entity or person you designate, provided the designation is clear, conspicuous and specific. PRC-Saltillo may charge a fee for the costs of copying, mailing or other supplies associated with your request.
• Right to amend your PHI that is inaccurate or incomplete
  With certain exceptions, you have a right to request that PRC-Saltillo amend your PHI in a Designated Record Set. PRC-Saltillo may deny your request for a number of reasons. For example, your request may be denied if the PHI is accurate and complete, was not created by the PRC-Saltillo (unless the person or entity that created the information is no longer available), is not part of the Designated Record Set or is not available for inspection (e.g., information compiled for civil, criminal or administrative proceedings). If PRC-Saltillo denies your request for an amendment, you have the right to file a statement of disagreement with PRC-Saltillo and any future disclosures of the disputed information will include your statement of disagreement.
• Right to receive an accounting of disclosures of your PHI
  You have the right to a list of certain disclosures PRC-Saltillo has made of your PHI. This is often referred to as an "accounting of disclosures." You generally may receive an accounting of disclosures if the disclosure is required by law, in connection with public health activities, or in similar situations, unless otherwise indicated below.

You do not have a right to receive an accounting of any disclosures made:

• For treatment, payment or health care operations;
• To you about your own PHI;
• Incidental to other permitted or required disclosures;
• Where authorization was provided;
• To family members or friends involved in your care (where disclosure is permitted without authorization);
• For national security or intelligence purposes or to correctional institutions or law-enforcement officials in certain circumstances; or
• As part of a "limited data set" (PHI that excludes certain identifying information).

In addition, your right to an accounting of disclosures to a health oversight agency or law-enforcement official may be suspended at the request of the agency or official.

Your request must be in writing and state a time period, which may not be longer than six (6) years nor start more than six (6) years before the date of your request. Your request should indicate in what form you want the accounting (for example, paper or electronic). The first list you request within a 12-month period will be provided free of charge. Additional lists will be subject to a reasonable charge.

• Right to obtain a paper copy of this notice from the PRC-Saltillo upon request
  You have the right to obtain a paper copy of this Notice of Privacy Practices at any time by contacting the PRC-Saltillo' HIPAA Privacy Officer at the address or phone number listed below. Even individuals who agreed to receive this notice electronically may request a paper copy at any time.
• Right to Notification in Event of a Breach of Unsecured PHI
  A data breach is any instance in which there is an unauthorized release or access of information not suitable for public release. In the event of any breach of unsecured PHI, PRC-Saltillo shall fully comply with the HIPAA Breach Notification Rule, which will include notification to you of any impact that breach may have had on you and/or your family member(s) and actions PRC-Saltillo undertook to minimize any impact the breach may or could have on you.

Many customers ask us to disclose their PHI to people in ways not described above. For example, a customer may want us to make her records available to a neighbor who is helping her resolve a question about her care or payment for that care. You may contact our Privacy Officer to obtain a form to authorize us to disclose your PHI to a person other than you or an organization or for reasons other than those described above.

If you fill out a form and later change your mind about the special authorization, you may send a letter to us at the address listed on the form to let us know that you would like to revoke the special authorization. In any communication with us, please provide your name, address, patient or member identification number, and a telephone number where we can reach you if we need to contact you about your request.

You have a right to request that we correct your PHI in our records for as long as we maintain them. You must make the request in writing to our Privacy Officer and explain the reason why the proposed correction is required. We may deny your request if: (i) we determine that we did not create the PHI, unless the originator of the PHI is no longer available to act on the requested correction; or (ii) if we believe that the PHI is accurate and complete. Note that a correction may take several forms, for example, we may add an explanatory statement to a record of PHI rather than change it. Where we decide we are unable to make a correction you have requested, we will add a note to that effect in your records.

PRC-Saltillo does not necessarily destroy PHI when individuals terminate their relationships with us. The information may be necessary for many of the purposes described in this policy, even after the person stops receiving services through PRC-Saltillo. In many cases, PHI is subject to legal retention requirements. The policies and procedures that protect PHI against inappropriate use and disclosure will continue to apply regardless of the status of the individual to whom it relates.

PRC-Saltillo posts this policy on our websites and provides a copy to individuals who have submitted equipment purchase requests upon the receipt of the submission or, upon contact with a PRC-Saltillo representative for purposes of evaluation, whichever is earlier.

PRC-Saltillo is required by law to provide individuals with notice of its privacy practices. We are required to abide by the terms of the policy currently in effect.

If you would like a paper copy of this policy, have questions about it, or believe its terms have been violated with respect to your PHI, please let us know immediately. If you wish to file a complaint, you can write to or call us at the address and number listed below. You will not be penalized for filing a complaint. You also have the option of filing a complaint online at prentrom.com/feedback or saltillo.com/feedback.

Privacy Officer: Beth Mulcahy beth.mulcahy@prentrom.com
Security Officer: Joe Hartman joe.hartman@prentrom.com

PRC-Saltillo
1022 Heyl Rd.
Wooster, OH 44691
(800) 262-1984

Please include your name, address, and a telephone number where we can contact you, and a brief description of your concern. If you prefer, you may lodge an anonymous complaint online prentrom.com/feedback or saltillo.com/feedback.

You can also file a written complaint with the Office for Civil Rights under the federal Department of Health and Human Services. The written complaint may be on paper or filed electronically. You can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by:

• Sending a letter to Centralized Case Management Operations, U.S. Department of Health and Human Services, 200 Independence Avenue, S.W., Room 509F HHH Bldg., Washington, D.C. 20201; or
• Visiting hhs.gov/hipaa/filing-a-complaint/index.html; Toll Free: 877.696.6775

Please provide as much information as possible so that the complaint can be properly investigated. PRC-Saltillo will not retaliate against a person who files a complaint with us or with the Secretary of the Department of Health and Human Services.