Privacy Policy

Archway Medical Equipment & Supply Co. LLC ("Archway Medical," "we," "us," or "our") is a licensed durable medical equipment (DME) supplier. We are committed to protecting the privacy and security of the information you share with us, including protected health information (PHI) governed by the Health Insurance Portability and Accountability Act of 1996 (HIPAA), 45 C.F.R. Parts 160 and 164. This Privacy Policy explains what we collect, how we use it, and the rights you have. It applies to www.archwaymedicalsupply.com and to the intake, referral, and fulfillment services we operate.

1.Who we are

Archway Medical Equipment & Supply Co. LLC is a Georgia limited liability company located at 2470 Windy Hill Road, Suite 206, Marietta, GA 30067. We are a HIPAA "covered entity" acting as a health care provider under 45 C.F.R. § 160.103. For questions about this policy or your health information, use the contact information at the end of this page.

2.Information we collect

We collect the information you give us and information that is automatically generated when you use our website or services.

Information you provide

• Contact details (name, phone, email, mailing address)
• Date of birth and demographic information
• Insurance carrier, member ID, group number, and eligibility information
• Prescribing physician, diagnosis, and clinical information necessary to process your order
• Delivery instructions, communication preferences, and consent to be contacted
• Referral information submitted by clinicians, case managers, or discharge planners on your behalf

Information collected automatically

• Device, browser, and operating system information
• IP address and general geographic location
• Pages visited, links clicked, and time spent on our site
• Cookies and similar tracking technologies used for site functionality and analytics

3.How we use your information

We use your information for the purposes permitted by HIPAA and other applicable law, including:

• Treatment: coordinating with your prescribing provider, verifying prescriptions, fitting and delivering equipment, and providing training or follow-up on your device.
• Payment: verifying insurance eligibility, obtaining prior authorization, billing your insurer, workers' compensation carrier, or you directly, and following up on unpaid balances.
• Health care operations: quality assurance, staff training, accreditation, compliance monitoring, audits, and internal analytics.
• Communication: confirming orders, arranging delivery, requesting missing documentation, and sending service updates. We do not send marketing text messages or emails without your consent.
• Legal and regulatory: responding to court orders, subpoenas, and requests from government agencies, and complying with federal and state DMEPOS supplier standards, including 42 C.F.R. § 424.57 and Ga. Comp. R. & Regs. R. 480-7B.

4.HIPAA and protected health information

Our use and disclosure of PHI is governed by our Notice of Privacy Practices ("NPP"), which describes in detail how we may use and disclose PHI and the rights you have under HIPAA. You may request a copy of our NPP at any time by contacting us. In the event of a conflict between this Privacy Policy and our NPP with respect to PHI, the NPP controls.

5.Who we share information with

We disclose your information only as necessary to provide services to you, to fulfill legal obligations, or with your written authorization. Recipients may include:

• Your prescribing physician, treating clinicians, referring case managers, and discharge planners
• Your insurance carrier, workers' compensation carrier, third-party administrators, and clearinghouses processing claims
• Delivery, shipping, and installation vendors performing services on our behalf
• Business associates who provide billing, IT, accreditation, or compliance support under written Business Associate Agreements meeting 45 C.F.R. § 164.504(e)
• Federal and state agencies, including the Centers for Medicare & Medicaid Services, the Office for Civil Rights, and the Georgia Board of Pharmacy, when required by law
• Auditors, attorneys, or accreditation bodies bound by confidentiality obligations

We do not sell your personal information or PHI to third parties, and we do not share it for third-party marketing.

6.Your rights

Rights for California, Colorado, Connecticut, Virginia, and other state residents

Depending on where you live, you may have additional rights to access, correct, delete, or receive a copy of the personal information we hold about you that is not PHI, and to opt out of certain uses. To make a state-privacy-law request, contact us using the information below. We will verify your identity before responding and will process your request within the timeframes required by law.

7.Cookies and analytics

Our website uses first-party cookies and analytics tools (such as Google Analytics) to understand site usage, improve performance, and remember your preferences. You can control cookies through your browser settings. Blocking cookies may affect site functionality. We do not use cross-context behavioral advertising or targeted advertising cookies on this site.

8.Data security

We maintain administrative, physical, and technical safeguards designed to protect the confidentiality, integrity, and availability of the information we hold, consistent with 45 C.F.R. §§ 164.308, 164.310, and 164.312. These safeguards include workforce training, access controls, encryption in transit for web submissions, secure hosting environments, and periodic risk assessments. No method of transmission over the internet is 100% secure. If you have reason to believe your information is at risk, contact us immediately.

9.Minors

DME is often prescribed for minors. Where a minor is the patient, a parent, legal guardian, or other personal representative under 45 C.F.R. § 164.502(g) submits information and consents on the minor's behalf. Our website is not directed to children under 13, and we do not knowingly collect personal information from a child under 13 outside of a parent- or guardian-initiated intake or referral.

10.Third-party links

Our website may include links to third-party sites (for example, insurance carrier portals or manufacturer product pages). We are not responsible for the privacy practices of those sites. Review the privacy policies of any third-party site before providing information.

11.Retention

We retain records containing PHI for the periods required by federal and state law, including at least seven years for DMEPOS supplier records under 42 C.F.R. § 424.516, and longer where required by Medicare, Medicaid, or Georgia law. We securely destroy records once retention obligations expire.

12.Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will change the "Effective" date at the top of this page and, when required by law, provide additional notice. Continued use of our website after changes take effect means you accept the updated policy.

13.Contact us