Privacy Policy

Policy Title: Privacy, Confidentiality, and Protection of Personal Information

Organization: Prime Plus LLC

Policy Number: PP-ADM-001

Effective Date: 10/18/2026

Last Reviewed: 10/18/2026

Approved By: Governing Body, Prime Plus LLC

Responsible Official: Administrator

Contact Email: info@primepluspro.com

Telephone: +1 443 673 7240

Business Address: 7918 Jones Branch Dr, Fl 4, McLean, VA 22102 

Website: www.primepluspro.com

1. PURPOSE

Prime Plus LLC is committed to protecting the privacy, confidentiality, integrity, and security of information collected, received, maintained, used, or disclosed in the course of conducting its business and delivering services.

The purpose of this Privacy Policy is to establish the principles and procedures governing the collection, use, storage, access, disclosure, transmission, retention, and secure disposal of personal information, client records, employee records, and other confidential information.

Prime Plus LLC recognizes that individuals who seek healthcare, home-care, personal assistance, companionship, respite care, care coordination, or other related services place significant trust in the organization. The agency is committed to treating all individuals with dignity and protecting their personal information from unauthorized access, use, disclosure, alteration, loss, or destruction.

This policy is intended to:

1. Protect      the privacy rights of clients, prospective clients, representatives,      employees, caregivers, contractors, and website visitors.
2. Establish      clear rules for handling confidential information.
3. Support      compliance with applicable federal and Virginia laws and regulations.
4. Establish      safeguards for paper records, electronic records, communications, and      other information systems.
5. Define      employee, contractor, management, and governing body responsibilities.
6. Provide      procedures for responding to privacy complaints, suspected breaches, and      unauthorized disclosures.
7. Explain      how individuals may request access to their information, corrections,      restrictions, or other available privacy rights.
8. Promote      a culture of confidentiality, accountability, and professional conduct      throughout Prime Plus LLC.

This policy must be implemented in conjunction with the agency's client records policy, personnel policy, information security procedures, incident reporting procedures, emergency preparedness plan, and any applicable Notice of Privacy Practices.

2. SCOPE AND APPLICATION

This policy applies to all Prime Plus LLC operations, locations, departments, service delivery arrangements, information systems, and business activities.

It applies to:

• Current,      former, and prospective clients.
• Clients'      legally authorized representatives and designated contacts.
• Family      members and caregivers whose information is collected by the agency.
• Employees,      nurses, home health aides, personal care aides, administrative staff,      supervisors, and managers.
• Independent      contractors, temporary workers, consultants, and volunteers, as      applicable.
• Vendors,      technology providers, billing companies, referral sources, and business      partners who handle information on behalf of the agency.
• Website      visitors, individuals submitting inquiries, and applicants for employment.
• Any      other person whose confidential information is received or maintained by      Prime Plus LLC.

All persons covered by this policy must follow applicable confidentiality requirements and may access confidential information only when authorized and necessary for their assigned responsibilities.

Where a contract, applicable law, regulation, or separate privacy notice establishes stricter requirements, Prime Plus LLC will follow the applicable stricter requirement.

3. DEFINITIONS

For purposes of this policy:

Personal Information: Information that identifies, relates to, describes, or can reasonably be linked to an individual, such as a name, address, telephone number, email address, date of birth, identification number, or employment information.

Sensitive Personal Information: Personal information requiring additional protection because of its nature, including financial account information, government identification numbers, precise location information, login credentials, and sensitive health or care information.

Protected Health Information (PHI): Individually identifiable health information protected by the Health Insurance Portability and Accountability Act (HIPAA), when applicable. PHI may exist in paper, electronic, or oral form.

Confidential Information: Information that Prime Plus LLC is required or expected to protect against unauthorized access or disclosure, whether or not it qualifies as PHI.

Client Record: Documentation concerning a client's intake, assessment, eligibility, service agreement, care plan, services provided, communications, incidents, complaints, billing, and discharge or termination.

Authorized Representative: A person legally permitted or properly authorized to act on behalf of a client within the scope of that authority.

Privacy Incident: An event involving actual or suspected unauthorized access, use, disclosure, loss, alteration, or destruction of personal or confidential information.

Data Breach: A security incident or disclosure that meets the definition of a breach under applicable law or regulation.

Minimum Necessary: The principle, when required by HIPAA, of limiting the use, disclosure, or request for PHI to the minimum necessary to accomplish the intended purpose, subject to applicable exceptions.

Business Associate: A person or organization that performs certain services for a HIPAA-covered entity involving PHI and is subject to applicable HIPAA business associate requirements.

De-Identified Information: Information that has been processed so individuals are not identifiable under the applicable legal standard. Removing a person's name alone does not necessarily make information de-identified.

4. LEGAL AND REGULATORY FRAMEWORK

Prime Plus LLC will comply with the federal and state privacy requirements applicable to its services, organizational status, contractual relationships, and information practices.

Depending on the circumstances, these requirements may include:

1. The      Health Insurance Portability and Accountability Act of 1996 (HIPAA).
2. The      HIPAA Privacy, Security, and Breach Notification Rules, where applicable.
3. The      Virginia Consumer Data Protection Act (VCDPA), where applicable.
4. Applicable      provisions of the Code of Virginia governing licensed home-care      organizations, client rights, records, complaints, and confidentiality.
5. Applicable      Virginia laws concerning personal information security and breach      notification.
6. Federal      and Virginia requirements governing employment records and      background-check information.
7. Applicable      requirements concerning mandatory reporting of abuse, neglect,      exploitation, or other reportable events.
8. Contractual      confidentiality requirements imposed by referral partners, healthcare      providers, facilities, payers, or other business partners.

The agency will review applicable laws and regulations periodically and revise its practices when necessary.

Important legal distinction: HIPAA does not automatically apply to every organization that provides care-related services. Its application depends on whether Prime Plus LLC is a covered entity or business associate under the applicable definitions. The VCDPA also has specific applicability thresholds and exemptions. The agency will determine which provisions apply to its operations rather than assume that every law applies to every record.

5. INFORMATION PRIME PLUS LLC MAY COLLECT

Prime Plus LLC may collect personal information that is reasonably necessary to provide services, respond to inquiries, administer the business, meet legal obligations, or protect individuals and agency operations.

5.1 Client and prospective-client information

Depending on the services requested, information may include:

• Full      name and preferred name.
• Date      of birth and contact information.
• Home      address and service location.
• Emergency      contact details.
• Names      and contact information of family members or authorized representatives.
• Information      about the services requested.
• Relevant      health, functional, mobility, or care needs.
• Information      about allergies, medications, medical conditions, and treatment, when      relevant to the services and lawfully collected.
• Care      assessments, care plans, service notes, and progress documentation.
• Hospital,      physician, facility, or referral information, where relevant and      authorized.
• Information      concerning accessibility, communication, language, or cultural needs.
• Advance      directives and emergency instructions, where applicable.
• Service      agreements, consents, authorizations, and acknowledgments.
• Complaints,      incidents, service concerns, and follow-up actions.
• Billing,      payment, insurance, or payer information, where applicable.

Prime Plus LLC will seek to collect only information reasonably necessary for the purpose for which it is requested, subject to legal, licensing, and recordkeeping requirements.

5.2 Website and inquiry information

When a person visits the agency website or submits an inquiry, Prime Plus LLC may collect:

• Name      and contact details.
• Information      entered into contact forms.
• The      nature of a service inquiry.
• Preferred      methods and times for contact.
• Website      usage information.
• Internet      Protocol (IP) address and technical device information, where collected.
• Browser      type, operating system, referral source, and pages visited, where      collected through website technologies.
• Cookie      preferences and consent records, where applicable.

Individuals should not submit detailed medical records, Social Security numbers, payment card details, or other highly sensitive information through ordinary website forms or unsecured email.

5.3 Employee and applicant information

For recruitment, onboarding, employment administration, and contractor management, the agency may collect:

• Names      and contact information.
• Resumes,      applications, qualifications, and employment history.
• Professional      licenses, certifications, and training records.
• Reference-check      information.
• Work      eligibility documentation, where legally required.
• Background-check      authorization and legally obtained screening results.
• Work      schedules, timesheets, performance evaluations, and disciplinary records.
• Payroll,      tax, and payment information.
• Emergency      contacts.
• Required      competency, training, and compliance documentation.
• Workplace      injury or accommodation information when legally necessary.

Employment and screening information will be handled according to applicable employment, confidentiality, and recordkeeping laws.

5.4 Business partner and vendor information

The agency may collect business contact information, professional credentials, contractual records, invoices, payment details, compliance documentation, and communications needed to manage business relationships.

5.5 Information obtained from other sources

Where lawful and necessary, Prime Plus LLC may receive information from clients' authorized representatives, healthcare providers, referral sources, facilities, insurers or payers, professional references, background-screening providers, vendors, or government agencies.

The agency will assess whether the information may lawfully be collected and used for the intended purpose.

6. HOW INFORMATION IS COLLECTED

Information may be collected through:

1. Direct      communication with clients, representatives, employees, and applicants.
2. Client      intake forms, assessments, service agreements, and consent forms.
3. Telephone      calls, emails, text messages, and authorized messaging systems.
4. Website      contact forms and other online submissions.
5. Interviews,      assessments, service visits, and supervisory activities.
6. Documentation      prepared by authorized staff during service delivery.
7. Referrals      and lawful information exchanges with other organizations.
8. Payroll,      billing, scheduling, and administrative systems.
9. Professional      licensing and verification sources.
10. Website      cookies, server logs, and analytics technologies, if implemented.
11. Other      lawful sources reasonably necessary for agency operations.

When required, the agency will provide notice of collection and obtain consent, authorization, or another applicable legal basis before collecting or using information.

7. PURPOSES FOR WHICH INFORMATION IS USED

Prime Plus LLC may use personal information for the following purposes, as applicable:

7.1 Client intake and service delivery

Information may be used to assess service requests, determine whether the agency can meet a client's needs, prepare service plans, coordinate care, assign qualified personnel, communicate service instructions, document services, and support continuity of care.

7.2 Safety and emergency response

Information may be used to identify emergency contacts, communicate essential care instructions, respond to emergencies, address safety risks, and coordinate with emergency responders or healthcare professionals when legally permitted or required.

7.3 Scheduling and administration

Information may be used to coordinate staff assignments, service visits, timekeeping, cancellations, staffing changes, supervisory visits, and communication with authorized contacts.

7.4 Billing and payment

Where applicable, information may be used to prepare invoices, verify services delivered, process payments, manage accounts, correct billing errors, and fulfill lawful payer or contractual requirements.

7.5 Quality assurance and compliance

Information may be used to review service quality, investigate complaints, assess incidents, conduct authorized audits, verify compliance, train staff, and meet regulatory reporting obligations.

7.6 Employment and contractor administration

Information may be used for recruitment, credential verification, background screening, onboarding, training, scheduling, payroll, performance management, workplace safety, and legal compliance.

7.7 Website operation and communication

Information may be used to respond to inquiries, provide requested information, maintain website functionality, prevent misuse, improve website accessibility, and administer communication preferences.

7.8 Legal obligations and protection of rights

Information may be used to comply with applicable laws, respond to lawful government requests, investigate suspected misconduct, establish or defend legal claims, and protect clients, employees, the public, and the agency.

7.9 Marketing and outreach

The agency may use appropriate business contact information to communicate about its services, programs, or community activities in accordance with applicable law.

Prime Plus LLC will not use protected health information for marketing purposes when prohibited by HIPAA or other applicable law. Where a legally required authorization is necessary, it will be obtained before the intended use or disclosure.

8. PRIVACY AND CONFIDENTIALITY OF CLIENT INFORMATION

Prime Plus LLC recognizes that information concerning a client's health, personal circumstances, family, residence, care needs, and services is private and must be handled respectfully.

All employees, caregivers, contractors, and other authorized personnel must:

1. Access      client information only for legitimate, authorized work purposes.
2. Use      client information only within the scope of their assigned      responsibilities.
3. Avoid      discussing client information in public areas or with unauthorized      individuals.
4. Refrain      from sharing client photographs, videos, names, diagnoses, care details,      or personal stories on personal social media accounts.
5. Avoid      taking photographs, audio recordings, or videos of clients unless      permitted under agency procedures and supported by any required consent or      authorization.
6. Secure      paper records, devices, and electronic accounts containing client      information.
7. Verify      the identity and authority of persons requesting client information.
8. Report      suspected privacy violations promptly.
9. Return      agency records and equipment when employment or an assignment ends.
10. Continue      to protect confidential information after employment, a contract, or a      service relationship ends.

A family relationship does not automatically grant a person access to all client records. The agency will consider the client's authorization, legal representative status, applicable law, and the particular information requested.

9. USE AND DISCLOSURE OF PROTECTED HEALTH INFORMATION

This section applies when Prime Plus LLC is subject to HIPAA or another applicable health-information privacy law.

9.1 Permitted uses and disclosures

Subject to applicable law, the agency may use or disclose PHI for purposes such as treatment, payment, and healthcare operations, when permitted by HIPAA.

Examples may include:

• Coordinating      services with an authorized healthcare professional.
• Processing      an eligible healthcare payment or claim.
• Conducting      permitted quality assurance or compliance activities.
• Communicating      necessary information to staff involved in a client's care.
• Complying      with applicable reporting or legal obligations.
• Responding      to a valid legal process when disclosure is permitted or required.

The agency will apply the appropriate authorization, notice, documentation, and disclosure requirements to the circumstances.

9.2 Uses and disclosures requiring authorization

Where required by law, the agency will obtain a valid written authorization before using or disclosing PHI for purposes such as certain marketing activities, certain disclosures to third parties, or other uses not otherwise permitted by law without authorization.

An authorization should identify the information to be disclosed, the person or organization authorized to disclose it, the intended recipient, the purpose, an expiration date or event, and the individual's signature or other legally acceptable authorization.

9.3 Minimum necessary access

When the HIPAA minimum-necessary standard applies, Prime Plus LLC will make reasonable efforts to limit access, requests, and disclosures to the amount of PHI needed for the intended purpose.

The standard is subject to applicable exceptions, including certain treatment disclosures. It does not replace the agency's general duty to limit access through role-based permissions and confidentiality procedures.

9.4 Verification before disclosure

Before disclosing confidential information, authorized staff will verify the recipient's identity and authority, determine whether the disclosure is permitted, and document the disclosure when required.

If the request is unclear or questionable, staff must refer it to the Administrator or Privacy Officer before releasing information.

9.5 Business associates

Where HIPAA requires a business associate agreement, Prime Plus LLC will obtain the required written assurances before permitting the business associate to create, receive, maintain, or transmit PHI on the agency's behalf.

Contracts will address applicable confidentiality, safeguards, incident reporting, permitted uses, and other required obligations.

10. DISCLOSURES TO FAMILY MEMBERS AND AUTHORIZED REPRESENTATIVES

Prime Plus LLC understands that family members and representatives may play an important role in coordinating care.

However, information will not automatically be disclosed merely because someone is a relative, friend, caregiver, or person who pays for services.

Before providing information, authorized personnel will:

1. Verify      the identity of the requester.
2. Determine      the client's preferences and applicable consent or authorization.
3. Confirm      any legal authority held by the requester's representative.
4. Determine      whether the specific disclosure is permitted by applicable privacy law.
5. Disclose      only the information that is authorized or otherwise legally permitted.
6. Document      the disclosure when required.

When a client is unable to make a particular decision, the agency will follow applicable rules concerning personal representatives, capacity, emergency circumstances, and disclosures in the client's best interests.

11. WEBSITE PRIVACY AND ONLINE COMMUNICATIONS

11.1 General website use

The Prime Plus LLC website may provide information about the agency, services, career opportunities, community initiatives, and contact options.

The website is intended primarily to provide general information and facilitate communication. Unless expressly stated otherwise, submitting a website inquiry does not establish a client relationship, constitute acceptance for services, or replace an appropriate intake and assessment process.

11.2 Contact forms

Information submitted through website forms may be used to respond to the request, evaluate service inquiries, schedule follow-up communications, or administer related business activities.

The agency will take reasonable steps to protect information submitted through its website. However, ordinary internet communications may involve risks, and the agency does not represent that every communication method is suitable for transmitting sensitive health information.

Individuals should use an agency-approved secure channel for sensitive client information.

11.3 Cookies and tracking technologies

If implemented, cookies and similar technologies may be used to maintain website functionality, remember preferences, measure website performance, improve user experience, and support security.

The agency will review its actual use of cookies, analytics, advertising pixels, and other tracking technologies and provide additional disclosures or consent mechanisms when required.

Prime Plus LLC will not assume that a technology is compliant merely because it is commonly used on other websites. Technologies that collect or transmit sensitive health information must be evaluated for applicable privacy and security requirements.

11.4 Third-party links

The website may contain links to external websites, including government agencies, healthcare resources, social media platforms, or community partners.

Prime Plus LLC does not control the privacy practices of external websites. Users should review the applicable third-party privacy notices before submitting personal information.

11.5 Social media and messaging platforms

If the agency uses social media, WhatsApp, or other messaging platforms, those platforms may process information according to their own terms and privacy policies.

Individuals should avoid posting or sending detailed medical information through public comments or channels that have not been approved for secure health-information exchange.

The agency will use approved communication methods for sensitive information when required.

12. ELECTRONIC COMMUNICATIONS

Prime Plus LLC may communicate by telephone, email, text message, secure electronic messaging, or other approved communication systems.

Before using an electronic channel for sensitive information, the agency will consider the nature of the information, the recipient, the communication method, the recipient's preferences, and applicable legal requirements.

Employees and contractors must:

• Use      agency-approved accounts and systems for work-related confidential      information.
• Verify      email addresses, telephone numbers, and intended recipients before sending      sensitive information.
• Avoid      sending confidential records to personal email accounts or unauthorized      devices.
• Avoid      placing unnecessary sensitive details in subject lines or text-message      previews.
• Use      required encryption or secure transmission methods where applicable.
• Report      messages sent to the wrong recipient or other suspected disclosures      promptly.

Where applicable law requires a specific form of consent or authorization for electronic communications, the agency will obtain and document it.

13. DATA SECURITY SAFEGUARDS

Prime Plus LLC will implement reasonable administrative, technical, and physical safeguards appropriate to the sensitivity of the information it maintains and the risks associated with its operations.

13.1 Administrative safeguards

Administrative measures may include:

1. Written      privacy and confidentiality policies.
2. Designation      of an appropriate official responsible for privacy oversight.
3. Workforce      confidentiality agreements and training.
4. Role-based      access authorization.
5. Risk      assessments and periodic policy reviews.
6. Procedures      for reporting and investigating privacy incidents.
7. Vendor      and contractor confidentiality requirements.
8. Secure      onboarding, transfer, and termination procedures.
9. Disciplinary      procedures for policy violations.
10. Contingency      planning and backup procedures, as appropriate.

13.2 Technical safeguards

Depending on the systems used, technical measures may include:

• Unique      user accounts and appropriate authentication.
• Strong      passwords and multifactor authentication where appropriate.
• Encryption      of information in transit and at rest where required or appropriate.
• Access      permissions based on job duties.
• System      updates and security patches.
• Anti-malware      and endpoint protection.
• Secure      backups and recovery procedures.
• Audit      logs and monitoring where supported.
• Secure      disposal or deletion of electronic records.
• Restrictions      on downloading, copying, or transferring confidential information.

13.3 Physical safeguards

Physical measures may include:

• Locked      filing cabinets and restricted storage areas.
• Controlled      access to offices and record-storage areas.
• Secure      storage of devices and portable media.
• Clear-desk      practices when records are not in use.
• Protection      of records during transportation.
• Secure      shredding or destruction of paper records.
• Procedures      for protecting records during emergencies.

13.4 No guarantee of absolute security

Prime Plus LLC will take reasonable measures to protect information but recognizes that no system, device, network, or transmission method can be guaranteed completely secure.

The agency will respond to security incidents according to applicable law, contractual obligations, and its incident response procedures.

14. EMPLOYEE, CAREGIVER, AND CONTRACTOR CONFIDENTIALITY

All workforce members must complete required confidentiality training and sign appropriate acknowledgments before receiving access to confidential client information.

Personnel may not:

1. Access      records out of curiosity or for personal reasons.
2. Share      passwords or authentication credentials.
3. Photograph      or copy client records without authorization.
4. Discuss      clients with friends, relatives, or other unauthorized individuals.
5. Remove      records from approved locations without permission.
6. Use      client information for personal, financial, or commercial gain.
7. Post      client-related content on personal social media.
8. Use      confidential information after leaving the agency.
9. Circumvent      security controls or access restrictions.
10. Conceal      or fail to report a suspected privacy incident.

Supervisors must explain these requirements, monitor compliance as appropriate, and promptly escalate suspected violations.

Violations may result in retraining, restricted access, disciplinary action up to termination, contract termination, reporting to relevant authorities, or other action permitted by law.

15. DISCLOSURE TO THIRD PARTIES

Prime Plus LLC may share information with third parties when reasonably necessary and legally permitted for agency operations.

Potential recipients may include:

• Healthcare      professionals and facilities involved in care.
• Authorized      family members or representatives.
• Billing,      payment, and accounting service providers.
• Information      technology and secure record-management vendors.
• Insurers,      payers, or referral partners, where applicable.
• Licensing,      regulatory, and government authorities.
• Legal,      compliance, and professional advisers.
• Emergency      responders.
• Other      recipients authorized by the individual or permitted or required by law.

Before sharing confidential information, the agency will determine whether disclosure is permitted, whether consent or authorization is required, whether a written agreement is necessary, and what information may appropriately be shared.

Prime Plus LLC does not intend to sell client medical records or disclose protected health information for a third party's independent marketing purposes without the authorization required by applicable law.

Where the VCDPA or another applicable privacy law grants specific rights concerning personal data, the agency will honor those rights subject to applicable exceptions.

16. CLIENT RIGHTS CONCERNING INFORMATION

Prime Plus LLC will respect all privacy and information rights provided by applicable law.

Depending on the type of information, the agency's legal status, and the applicable law, individuals may have the right to:

1. Request      access to certain personal or health information.
2. Request      copies of eligible records.
3. Request      correction of inaccurate or incomplete information.
4. Request      information about how certain information is used or disclosed.
5. Request      restrictions on certain uses or disclosures, where available.
6. Revoke      a previously given authorization, subject to applicable legal limitations.
7. Request      that communications be made through an alternative method or address,      where required or available.
8. Receive      information about the agency's privacy practices.
9. Submit      a privacy complaint without unlawful retaliation.
10. Exercise      applicable rights under Virginia privacy law, where the law applies.

These rights are not unlimited. For example, certain records may be exempt from access or deletion rights, and a covered entity may be required to retain records even when an individual requests deletion.

The agency will explain any applicable limitation and provide information about available review or complaint procedures.

17. PROCEDURE FOR REQUESTING ACCESS OR CORRECTION

Individuals seeking access to or correction of records should submit a written request to the Administrator or Privacy Officer using the contact details provided in this policy.

The request should include:

• The      individual's name and contact information.
• The      type of record requested.
• The      approximate dates covered by the request, if known.
• A      description of the correction requested, where applicable.
• Evidence      of identity or legal authority, if reasonably necessary.

Upon receipt, the agency will:

1. Record      the date and nature of the request.
2. Verify      the requester's identity and authority.
3. Determine      which records are covered by the request.
4. Review      applicable legal requirements and exceptions.
5. Respond      within the time required by applicable law.
6. Provide      access or copies when required and permitted.
7. Document      any denial or limitation and explain available review rights when      applicable.
8. Maintain      a record of the request and response as appropriate.

The agency will not automatically alter an original record simply because a person disagrees with it. Where appropriate, corrections or amendments will be handled through a documented process that preserves the integrity of the record.

18. VIRGINIA CONSUMER PRIVACY RIGHTS

Where the Virginia Consumer Data Protection Act applies to Prime Plus LLC and the relevant processing activity, eligible consumers may have rights including:

• Confirming      whether the agency processes their personal data.
• Accessing      personal data.
• Correcting      inaccuracies.
• Requesting      deletion of personal data provided by or obtained about them.
• Obtaining      a portable copy of certain personal data.
• Opting      out of certain targeted advertising, sale of personal data, or profiling      decisions that produce legal or similarly significant effects.

The availability of these rights depends on statutory definitions, exemptions, the agency's status, the nature of the information, and the processing activity.

The agency will establish an appropriate request and appeal process if required. Where applicable, it will respond within the statutory period, provide any legally permitted extension notice, and explain a denial and the available appeal process.

Health information subject to HIPAA and other legally exempt information may be treated differently under Virginia privacy law. The agency will evaluate requests under the applicable legal framework rather than apply a blanket rule to every category of information.

19. CONSENT AND WITHDRAWAL OF AUTHORIZATION

Where consent or authorization is required, Prime Plus LLC will explain the intended use or disclosure and obtain the appropriate documentation.

Individuals may withdraw consent or revoke an authorization when permitted by applicable law. A revocation generally does not undo actions already taken in reliance on a valid authorization before the revocation became effective.

Requests to withdraw consent or revoke authorization should be submitted in writing to the Administrator or Privacy Officer.

The agency will document the request, determine its effective scope, communicate relevant limitations, and update its practices and records as appropriate.

20. DATA RETENTION AND RECORD MANAGEMENT

Prime Plus LLC will retain personal information only for as long as reasonably necessary to fulfill the purposes for which it was collected, comply with applicable legal and regulatory requirements, administer services, resolve disputes, and meet contractual obligations.

Retention periods may vary for:

• Client      service records.
• Intake      and assessment documents.
• Service      agreements and authorizations.
• Clinical      or care documentation, where applicable.
• Employee      and contractor personnel files.
• Payroll      and tax records.
• Background-screening      documentation.
• Billing      and financial records.
• Complaint      and incident reports.
• Consent      forms and privacy acknowledgments.
• Website      inquiries and communications.
• Security      logs and privacy incident records.

The agency will maintain a written records-retention schedule consistent with applicable Virginia licensing requirements, other governing laws, contractual obligations, and any applicable HIPAA documentation-retention rules.

When information is no longer required and no retention obligation or legal hold applies, it will be securely destroyed, deleted, or de-identified as appropriate.

A request to delete information will not override a legal requirement to retain records.

21. SECURE DISPOSAL OF INFORMATION

Confidential information must be disposed of in a manner appropriate to its sensitivity.

Paper records must be shredded or destroyed through an approved secure process. Electronic records and storage media must be securely erased, destroyed, or otherwise rendered inaccessible in accordance with applicable procedures.

Personnel must not place confidential documents in ordinary trash or recycling containers where they may be accessed by unauthorized persons.

Where a third-party disposal provider is used, the agency will evaluate applicable confidentiality and security requirements.

22. PRIVACY INCIDENTS AND DATA BREACHES

All employees, contractors, and other workforce members must immediately report actual or suspected privacy incidents to their supervisor, Administrator, or Privacy Officer.

Examples include:

• A      lost or stolen device containing confidential information.
• A      client record sent to the wrong recipient.
• Unauthorized      access to an electronic record.
• An      employee accessing information without a work-related reason.
• A      lost paper file.
• An      email account compromise.
• Unauthorized      photography or posting of client information.
• A      cyberattack, ransomware incident, or suspected data exfiltration.
• Improper      disposal of confidential records.
• A      vendor reporting unauthorized access to agency information.

22.1 Response procedure

Upon receiving a report, the agency will:

1. Document      the incident and the time it was discovered.
2. Take      reasonable steps to contain the incident and prevent further unauthorized      access or disclosure.
3. Preserve      relevant records, logs, communications, and evidence.
4. Notify      appropriate management and technical personnel.
5. Identify      the information and individuals potentially affected.
6. Determine      whether PHI, personal information, or other protected information was      involved.
7. Assess      the incident under applicable legal and contractual requirements.
8. Determine      whether notification to affected individuals, regulators, law enforcement,      or business partners is required.
9. Make      required notifications within applicable deadlines.
10. Document      the investigation, decisions, corrective measures, and closure.
11. Review      whether policies, training, access controls, or systems need improvement.

The agency will not delay an incident report merely because the investigation is incomplete.

22.2 Breach notification

If a breach notification requirement applies, Prime Plus LLC will follow the applicable law, including any relevant HIPAA or Virginia notification requirements.

The agency will determine the applicable notification deadlines, recipients, content, and reporting thresholds based on the type of information, circumstances, affected population, and governing law.

23. PRIVACY COMPLAINTS

Clients, representatives, employees, website visitors, and other individuals may submit a complaint if they believe that their privacy has been violated or that their information has been handled improperly.

Complaints may concern:

• Unauthorized      access or disclosure.
• Inappropriate      discussions about a client.
• Improper      use of photographs or recordings.
• Failure      to respond to a privacy request.
• Inaccurate      information.
• Inadequate      security.
• Suspected      retaliation for raising a privacy concern.
• Other      conduct inconsistent with this policy.

Complaints should be submitted to:

Privacy Officer / Administrator

Prime Plus LLC

Address: InsertOfficialBusinessAddressInsert Official Business Address

Email: InsertOfficialPrivacyEmailInsert Official Privacy Email

Telephone: InsertBusinessTelephoneNumberInsert Business Telephone Number

The agency will acknowledge and investigate complaints as appropriate, document findings, take corrective action when warranted, and communicate the outcome to the extent permitted by law.

Where applicable, individuals may also submit complaints to the U.S. Department of Health and Human Services, Office for Civil Rights, or another appropriate regulatory authority.

Prime Plus LLC prohibits unlawful retaliation against anyone who submits a good-faith privacy complaint or participates in a lawful investigation.

24. PRIVACY TRAINING AND ACCOUNTABILITY

All relevant personnel must receive privacy and confidentiality training appropriate to their roles.

Training may include:

• The      importance of confidentiality.
• Proper      access to client records.
• Authorized      and prohibited disclosures.
• Verification      of recipient identity.
• Secure      use of email, messaging, and mobile devices.
• Password      and authentication practices.
• Safe      handling of paper records.
• Photography      and social media restrictions.
• Incident      reporting and breach response.
• Client      rights and complaint procedures.
• Applicable      HIPAA and Virginia requirements.

Training will occur during onboarding and periodically thereafter, as required by law, agency policy, or role-specific responsibilities.

The agency will maintain appropriate documentation of training completion, policy acknowledgments, and corrective education.

25. THIRD-PARTY SERVICE PROVIDERS

Prime Plus LLC may use third-party providers for website hosting, secure communications, electronic recordkeeping, scheduling, billing, payroll, cybersecurity, storage, and other business functions.

Before engaging a provider that will handle confidential information, the agency will assess the nature of the information, the provider's responsibilities, and applicable security and legal requirements.

Where required, the agency will execute appropriate confidentiality agreements, data-processing terms, or HIPAA business associate agreements.

The agency will review provider access and permissions periodically and remove access when it is no longer required.

26. CHILDREN AND MINORS

Prime Plus LLC may provide or coordinate services involving minors where such services fall within its authorized operations.

Information about a minor will be handled in accordance with applicable consent, parental or guardian authority, confidentiality, and healthcare privacy requirements.

The agency website is not intended to encourage children to submit sensitive personal information independently. Where the agency collects information directly from children through an online service, it will evaluate and comply with applicable children's privacy laws.

27. PHOTOGRAPHS, VIDEOS, AND TESTIMONIALS

Prime Plus LLC respects the privacy and dignity of clients and employees.

The agency will not publish identifiable client photographs, videos, testimonials, or personal stories for marketing purposes without obtaining any consent or authorization required by applicable law and agency policy.

Any authorization should explain the intended use, the information or images involved, the media or audience, and any applicable expiration or withdrawal terms.

Refusal to authorize optional marketing use will not be used as a basis for unlawful discrimination or denial of services.

Staff may not use personal devices or social media accounts to capture or distribute identifiable client images or information except where specifically authorized by agency policy and applicable law.

28. EMERGENCIES AND MANDATORY REPORTING

Privacy protections do not prohibit disclosures that are permitted or required by applicable law.

Prime Plus LLC may disclose information when legally necessary to respond to emergencies, report suspected abuse, neglect, or exploitation, comply with mandatory reporting duties, protect an individual from a serious threat, or cooperate with lawful investigations.

The agency will disclose only what is permitted or required under the circumstances and will document the disclosure when required.

Staff must refer uncertain disclosure decisions to the Administrator or Privacy Officer whenever feasible without delaying a legally required report or urgent safety response.

29. INTERNATIONAL ACCESS AND DATA TRANSFERS

Prime Plus LLC will assess whether its systems or service providers store or process personal information outside the United States.

Where cross-border processing occurs, the agency will review applicable legal requirements, contractual safeguards, security risks, and any necessary notices or consents.

The agency will not represent that all information remains within the United States unless that statement has been verified for its actual systems and vendors.

30. AUTOMATED DECISION-MAKING AND PROFILING

If Prime Plus LLC uses automated systems to evaluate individuals, prioritize inquiries, assess risks, make staffing recommendations, or support other decisions, it will evaluate whether the processing triggers applicable privacy, transparency, or consumer rights requirements.

The agency will not rely on automated processing to make legally significant decisions without appropriate review of the applicable legal obligations and safeguards.

31. POLICY CHANGES

Prime Plus LLC may revise this Privacy Policy to reflect changes in its services, technology, information practices, legal obligations, or operational requirements.

The agency will update the policy's effective or revision date and provide additional notice when required.

Where applicable HIPAA rules require a covered entity to revise and distribute its Notice of Privacy Practices, the agency will follow those requirements separately from ordinary website-policy updates.

Continued use of the website after an updated website policy is posted does not replace any consent or authorization that must be obtained under applicable law.

32. GOVERNING LAW

This policy will be interpreted in accordance with applicable federal law and the laws of the Commonwealth of Virginia, without limiting any mandatory legal protections that apply in other jurisdictions.

Nothing in this policy is intended to waive an individual's rights under applicable privacy, healthcare, consumer protection, employment, or other laws.

33. CONTACT INFORMATION AND PRIVACY REQUESTS

Questions about this policy, requests concerning personal information, or complaints about privacy practices should be directed to:

Prime Plus LLC — Administrator

Business Address: 7918 Jones Branch Dr Ste 404, McLean, VA 22102 

Telephone: +1 443 673 7240

Privacy Email: info@primepluspro.com

Website: www.primepluspro.com