Version 2.0 · Effective October 2026
Uplift Path, Inc. ("Uplift Path," "we," "us," or "our") is committed to protecting the privacy and security of visitors to our website and while providing services. This Website Privacy Policy explains how we collect, use, disclose, and safeguard information when you visit our website at upliftpathwellness.com (the "Website").
IMPORTANT: This Website Privacy Policy covers general website browsing and general inquiries. When you submit service requests or intake forms containing health information, that information becomes Protected Health Information (PHI) governed by our separate Notice of Privacy Practices under the Health Insurance Portability and Accountability Act (HIPAA). See the Notice of Privacy Practices section below for important information about this distinction.
Please read this Policy carefully. By accessing or using our Website, you acknowledge that you have read, understood, and agree to be bound by the terms of this Website Privacy Policy.
We may collect personal information that you voluntarily provide when you: submit general contact forms or inquiries through the Website; request general information about our services; subscribe to newsletters or email updates; apply for employment or contractor opportunities; or communicate with us via email or phone through contact information on the Website. This information may include, but is not limited to: name, email address, phone number, message content, employment information (if applying), and any other information you choose to provide.
If you complete an intake, referral, or service request form through our Website to become a Client, you will provide Protected Health Information (PHI) as defined by HIPAA. This information is collected through secure, HIPAA-compliant forms (for example, Zoho Forms under a Business Associate Agreement which is a contract requiring vendors or third parties to follow HIPAA Security and Privacy rules). PHI collected may include, but is not limited to: full name, date of birth, contact information, Medicaid identification number, health conditions, symptoms and diagnoses, medication information, treatment history and current providers, insurance information, emergency contact information, mental health concerns and treatment goals, and any other health-related information requested on intake forms.
IMPORTANT: Once you submit a service request form containing health information, that information is immediately governed by our Notice of Privacy Practices under HIPAA, not this Website Privacy Policy. See the Notice of Privacy Practices section below for complete information about how we protect your Protected Health Information.
When you visit our Website, we may automatically collect certain information about your device and browsing activity, including, but is not limited to: IP address, browser type and version, operating system, pages visited and time spent on pages, referring website addresses, date and time of access, and device identifiers. This information is collected through cookies, web beacons, and similar tracking technologies as described below. This automatically collected information is not PHI.
We use non-health information collected through our Website to: respond to inquiries and provide requested information; communicate about employment/contractor opportunities; process newsletter subscriptions; understand how visitors use our Website and improve functionality, content and user experience; diagnose technical problems and maintain Website security; send communications you requested (e.g., newsletters); and comply with legal obligations and enforce our Terms of Use.
Information collected through service request and intake forms is used for treatment, payment, and healthcare operations as described in our Notice of Privacy Practices. This use is governed by HIPAA regulations and state law, not this Website Privacy Policy. See the Client Notice of Privacy for information about how we use and protect your health information.
We collect and retain only the personal information and PHI that is reasonably necessary to fulfill the purposes described above. Access is limited to Workforce members and vendors who require it to perform their duties.
Cookies, pixels, tags and similar tracking technologies used on the Website are described in a separate document, the Cookies and Tracking Technologies Notice, which is linked from our cookie banner and from the Website footer. That Notice explains each category of technology we use, how to accept or decline non-essential categories, how we honour opt-out preference signals, and the stricter rules that apply to pages that describe or collect health-related information.
Health-related information collected through the Website or through a general inquiry that is not Protected Health Information is governed by a separate document, the Consumer Health Data Privacy Notice. It is published on its own page and linked prominently from the Website homepage and from every page on which we collect personal information, as several state health data laws require. That Notice explains the categories of consumer health data we collect, the sources it comes from, the categories of recipients with whom we share it, and how to exercise the rights those laws provide.
We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following circumstances:
We may share information with trusted third-party service providers who assist us in operating our Website or providing services. Examples include website hosting providers, email service providers, analytics providers (such as Google Analytics), and form management providers (such as Zoho Forms). These service providers are contractually obligated to maintain confidentiality and security and may use the data only for the purposes we authorize.
Business Associate Agreements for PHI Vendors: Any vendor that will handle PHI must execute a Business Associate Agreement (BAA) prior to receiving PHI. The Chief Risk Officer (CRO) maintains the BAA Register, validates BAAs prior to PHI exchange, and conducts vendor risk reviews and audits of vendor access as required.
Authorizations for Release of Health Information: Uses and disclosures of Protected Health Information beyond treatment, payment, and health care operations, and beyond those otherwise permitted or required by law, require a written, HIPAA-compliant authorization. For the release of behavioral health records, we use an authorization consistent with the Ohio Medicaid standard release/authorization form. An individual may revoke an authorization in writing at any time, except to the extent we have already acted in reliance on it.
We may disclose your information when required by law or in response to valid legal processes, such as court orders, subpoenas, government or law enforcement requests, or to comply with applicable laws and regulations. For Protected Health Information, such disclosures are made only as permitted by the HIPAA Privacy Rule (45 CFR 164.512), including any required assurances or authorizations.
We may disclose information to protect the rights, property, or safety of Uplift Path, our Workforce members, or others; to enforce our Website terms of use or other agreements; prevent fraud or illegal activity; or respond to emergencies involving danger to persons.
In the event of a merger, acquisition, reorganization, bankruptcy, or sale of assets, your information may be transferred as part of the transaction. We will notify you via email and/or a prominent notice on our Website of any such change in ownership or control of your personal information.
We implement reasonable administrative, technical, and physical safeguards designed to protect your information from unauthorized access, use, alteration, or disclosure. These measures include SSL/TLS encryption for transmissions, HIPAA-compliant secure forms for health information (e.g., Zoho Forms with an executed BAA), restricted access controls including multi-factor authentication, logging and monitoring, periodic security assessments, and Workforce training on information security and HIPAA compliance. We also monitor forthcoming federal requirements, including the proposed updates to the HIPAA Security Rule, and align our safeguards accordingly.
We maintain an Incident Response Plan and testing program. If we become aware of an unauthorized access, use, or disclosure of PHI, we will promptly investigate, follow our Incident Response Plan, contain and remediate the incident, and notify affected individuals without unreasonable delay in accordance with applicable law. We will also provide required notifications to regulatory authorities (including federal or state agencies) as required by law. For Workforce access issues, we initiate timely access revocation and document the action.
PHI Breach Notifications: If there is an unauthorized access, use, or disclosure of unsecured PHI, we will notify affected individuals without unreasonable delay and no later than 45 calendar days, consistent with Ohio Revised Code 1349.19 and within the timeframes required by the HIPAA Breach Notification Rule, and will provide required notifications to individuals and regulatory authorities in accordance with applicable laws. Where a breach affects 500 or more Ohio residents, a press release will be issued. Where a breach affects over 1,000 Ohio residents, we also notify nationwide consumer reporting agencies as required by Ohio law.
We maintain and test business continuity and disaster recovery procedures and documentation. We perform business continuity/disaster recovery (BC/DR) tests (tabletop or focused tests) and an annual full-scale exercise. Results of full-scale exercises are reviewed by leadership within 30 days.
Workforce members with access to organizational systems or PHI complete initial privacy and security training within 30 days of hire and annual refresher training thereafter. Training completion records and signed acknowledgments are retained and are available for audit by state and federal regulators.
We follow documented procedures to create, modify, and remove user accounts and system access. New accounts and permissions are set up within one business day of authorization. When someone leaves the organization or no longer requires access, their accounts are disabled immediately, and in all cases within 24 hours. All access changes are logged and reviewed.
We perform periodic access reviews of role-based permissions and system access at least quarterly; remediation of any inappropriate access is completed and documented promptly.
PHI and sensitive organizational data are encrypted in transit (TLS/SSL) and at rest, in accordance with HIPAA and our security standards.
Telehealth Privacy and Security: Because services are delivered virtually, before telehealth services begin we disclose the clinical, security, and confidentiality risks of telehealth and document the Client's agreement, and we contractually require any entity that transmits information to protect its confidentiality, consistent with Ohio Administrative Code 5122-29-31. Confidentiality of behavioral health records is further protected under Ohio Revised Code 5122.31 and HIPAA. We also follow HHS telehealth privacy and security guidance and applicable Ohio telehealth standards.
No method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.
The organization maintains a central evidence index (BAA Register, Incident logs, BC/DR test reports, access review records, training logs, asset inventory, network diagram, integration test artifacts). These artifacts are maintained and are available for state or federal regulatory or audit review on request.
We retain personal information collected through our Website only as long as necessary to fulfill the purposes described in this policy, unless a longer retention period is required or permitted by law.
Protected Health Information (PHI): We retain PHI in accordance with federal and state requirements and our Notice of Privacy Practices (for example, a minimum of seven years where required). When records are no longer needed, we securely delete or anonymize them in accordance with our retention schedule and secure disposal procedures.
Our Website may contain links to third-party websites that are not operated by us. This Website Privacy Policy does not apply to those third-party websites. We are not responsible for the privacy practices or content of third-party websites. We encourage you to review the privacy policies of any third-party websites you visit.
Our Website is not directed to children under the age of 18, and we do not knowingly collect personal information from children under 18 through our general Website. Our clinical services are provided to adults aged 18 and older. If you are under 18, please do not provide any information on this Website. If we learn that we have collected personal information from a child under 18 through our Website, we will delete that information promptly.
Depending on your location, you may have certain rights regarding your personal information.
Personal Representatives and Deceased Individuals: A personal representative - an individual with legal authority to act on behalf of a Person Served, such as a person holding a health care power of attorney, a court-appointed guardian, or the executor or administrator of a deceased individual's estate - may exercise privacy rights on behalf of the Person Served, subject to our verification of identity and authority. We protect the health information of a deceased individual consistent with HIPAA.
You may request access to the personal information we hold about you and request corrections if the information is inaccurate or incomplete.
Identity Verification: To protect privacy, we verify requester identity before fulfilling access, amendment, or deletion requests (for example, by requesting a government-issued photo ID). We will acknowledge receipt of a verified request within 5 business days and respond within the timeframes stated in this policy.
To exercise any rights, submit a written request to:
privacy@upliftpathinc.com or through our online contact form at upliftpathwellness.com/contact with:
Your full name and contact information
The right you are exercising
Specific details to help us locate the information
A copy of a government-issued photo ID for verification (we redact and securely dispose of the ID after verification)
For HIPAA requests regarding PHI, we will respond within 30 calendar days. If necessary, we may extend one time by up to 30 calendar days with written notice to you.
For consumer privacy requests under applicable state laws, we will respond within 45 calendar days. We may request additional information to verify your identity or authority to act on behalf of another person.
Where law permits, we may deny requests that conflict with legal obligations; we will explain the reason for any denial and the procedures to appeal.
You may request that we delete your personal information, subject to certain legal limitations and record retention obligations. Requests for deletion of PHI will be processed under HIPAA rules and may be denied in limited circumstances (for example, if retained for treatment or legal obligations).
You may opt out of marketing or promotional emails by following the unsubscribe instructions in those emails or by contacting us through our online contact form at upliftpathwellness.com/contact. We will continue to send non-promotional messages related to your inquiries or, if you are a Client, communications related to your care.
Our Website does not currently respond to Do Not Track browser signals. To opt out of tracking and analytics, manage cookie preferences via the cookie banner or your browser settings as described in the Cookies and Tracking Technologies section above.
Rights available to residents of states with comprehensive consumer privacy laws, including the rights to know, correct, delete, obtain a portable copy, opt out and appeal, are described in a separate document, the State Privacy Rights Notice. That Notice also sets out how to submit a request, how we verify identity, the response timeframes that apply and how the timeframes differ where a request concerns Protected Health Information. It is maintained separately so that it can be updated as we extend services into additional states.
Our Website and services are operated from the United States. If you are visiting from outside the United States, your information may be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your country. By using our Website, you consent to such transfers. We take reasonable administrative, technical, and organizational measures to protect data transferred across borders.
Controller and Processors: Uplift Path, Inc. is the controller of the data collected through the Website. Our service providers act as processors and process data only under our instructions and contractual terms, including BAAs where PHI is involved.
If you have questions, concerns, or requests regarding this Website Privacy Policy or our privacy practices, contact:
Uplift Path, Inc. HIPAA Privacy Officer — Privacy Compliance Contact
Email: privacy@upliftpathinc.com
Phone: (513) 299-4553
Online Contact Form: upliftpathwellness.com/contact
Ohio Business Office: Uplift Path Inc. 20 E Broad St, 2nd & 3rd Floor Columbus, Ohio 43215 United States of America
Accessibility & Language Support: If you need this Policy or other materials in an alternative format (large print, audio, or translated version) or require an accommodation, contact the Accessibility Advocate at advocate@upliftpathinc.com and we will make reasonable efforts to provide the material in the format needed.
This Website Privacy Policy covers: general website browsing and automatically collected data (cookies, analytics); general inquiries submitted through contact forms; newsletter signups and general communications; employment applications; and any non-health information provided through the Website.
Our HIPAA Notice of Privacy Practices covers: service request and intake forms submitted through the Website and all PHI collected for treatment purposes, including: how we use and disclose your health information; your rights regarding health information under HIPAA; and how to exercise those rights. Once you submit a service request or intake form with health information (for example, Medicaid ID, health conditions, treatment needs, or other health-related information), your information is protected under HIPAA and governed by our Notice of Privacy Practices.
Substance Use Disorder (SUD) Records: Uplift Path, Inc. does not provide SUD services at this time, so the federal confidentiality regulations for SUD records (42 CFR Part 2) are not applicable to Uplift Path, Inc. If Uplift Path begins providing SUD services or otherwise creates, receives, or maintains Part 2 records, this Policy and our Notice of Privacy Practices will be updated to reflect the applicable Part 2 protections.
Reproductive Health Care Records: Uplift Path, Inc. does not provide reproductive health care services at this time. The federal HIPAA amendments specific to reproductive health care privacy (2024) were vacated nationwide in 2025 and are not in effect; standard HIPAA and Ohio confidentiality protections continue to apply to all health information we maintain. If Uplift Path begins providing reproductive health care services, this Policy will be updated accordingly.
Request a copy from your service provider during your first contact, download a copy from our secure Client portal, or contact the HIPAA Privacy Officer at privacy@upliftpathinc.com
Acknowledgment and Updates: Individuals are not required to sign an acknowledgment of receipt of our Notice of Privacy Practices unless they become a behavioral health Client. We make a good-faith effort to obtain written acknowledgment of receipt and document any instance in which acknowledgment is not obtained. We revise and re-distribute the Notice when we make material changes, and we retain each version of the Notice for at least six (6) years.
If you believe your privacy rights have been violated, contact the HIPAA Privacy Officer at privacy@upliftpathinc.com
For HIPAA matters, you may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights (OCR) (hhs.gov/ocr).
We may update this Website Privacy Policy at any time. When we make material changes, we will update the "Last Updated" date at the top of the policy, post the revised policy on our Website, and notify you of material changes via email (if we have your email) or through a prominent notice on our Website. We encourage you to review this Website Privacy Policy periodically. Your continued use of the Website after changes are posted constitutes your acceptance of the revised policy.
By using our Website, you signify your acceptance of this Website Privacy Policy. If you do not agree to this policy, please do not use our Website. Your continued use of the Website following the posting of changes will be deemed your acceptance of those changes.
Uplift Path, Inc. — All Rights Reserved