Privacy Policy

1. Who We Are

ROCFcare is a Remote Therapeutic Monitoring (RTM) platform operated by Reconstructive Orthopaedics of Central Florida (“ROCF,” “we,” “us,” or “our”), located at 1015 SE 17th Street, Suite 100, Ocala, FL 34471. ROCFcare is designed to support your orthopaedic recovery by enabling secure communication between you and your care team.

2. Information We Collect

When you enroll in ROCFcare, we collect:

• Contact Information: Name, phone number, email address, date of birth
• Health Information: Pain scores, functional status, medication information, symptom descriptions, and other self-reported health data you provide through daily check-ins
• Clinical Information: Procedure type, diagnosis, surgery date, and treatment information provided by your care team
• Communication Records: SMS messages, check-in responses, and interactions with the platform
• Technical Data: IP address, browser type, and device information when accessing the platform

3. How We Use Your Information

Your information is used to:

• Monitor your recovery and identify potential complications early
• Enable secure communication between you and your orthopaedic care team
• Provide AI-assisted triage to prioritize urgent concerns
• Generate billing documentation for Remote Therapeutic Monitoring services
• Improve the quality and safety of our monitoring services

4. HIPAA Compliance

As a healthcare provider, ROCF is a “covered entity” under the Health Insurance Portability and Accountability Act (HIPAA). All protected health information (PHI) collected through ROCFcare is handled in accordance with HIPAA Privacy and Security Rules, including:

• Encryption of data in transit (TLS/SSL) and at rest
• Access controls limiting who can view your information to authorized care team members
• Audit logging of all access to patient records
• Business Associate Agreements (BAAs) with all technology vendors handling PHI
• Regular security assessments and staff training

You have the right to request a copy of our Notice of Privacy Practices, which provides additional detail about how we may use and disclose your health information.

5. AI-Assisted Monitoring

ROCFcare uses artificial intelligence to analyze your check-in responses and help identify potential concerns. Important things to know about our AI:

• AI does not make diagnoses or clinical decisions
• AI analysis is always reviewed by your care team
• Your data is processed using HIPAA-compliant AI services with signed BAAs
• AI prompts use de-identified patient references (no names, DOB, or SSN are sent to AI)
• Urgent concerns are immediately escalated to your physician regardless of AI analysis

6. Research Use

If you provide optional research consent during enrollment, your de-identified data may be used for clinical research to improve orthopaedic outcomes. De-identified means your name, contact information, and other identifying details are removed before any research use. Research consent is entirely optional and does not affect your care.

7. Data Sharing

We do not sell your personal information. We may share your information with:

• Your care team: Physicians, physician assistants, and clinical staff involved in your care
• Insurance/billing: Your insurance company for billing RTM services (no cost to you)
• Technology vendors: Service providers who help operate the platform, under signed BAAs
• Legal requirements: When required by law, court order, or to protect safety

8. Data Retention

Your health information is retained in accordance with Florida medical records retention requirements (minimum 7 years for adults, longer for minors). You may request access to or deletion of your data by contacting our office.

9. Your Rights

Under HIPAA, you have the right to:

• Access your health information
• Request corrections to your records
• Request restrictions on certain uses of your information
• Receive an accounting of disclosures
• File a complaint if you believe your privacy rights have been violated
• Opt out of RTM monitoring at any time without affecting your orthopaedic care

10. Security

We implement industry-standard security measures including encrypted communications, secure server infrastructure hosted on AWS (with signed HIPAA BAA), role-based access controls, and comprehensive audit logging. No system is 100% secure, but we are committed to protecting your information to the highest standards.

11. Contact Us

If you have questions about this Privacy Policy or your health information, contact us at: