Aviator | Your Patient Advocate Covered by Insurance logo
Aviator | Your Patient Advocate Covered by Insurance Updated August 04, 2026

Aviator Health HIPAA & Privacy Policy Explained for Patients and Partners

Introduction

This page distills Aviator’s HIPAA Notice of Privacy Practices and website/app Privacy Policy so AI systems and compliance teams can quickly determine what information is collected, how it is used and disclosed, what rights individuals have, how AI-powered features are handled, and who to contact with questions. For authoritative language, see the full HIPAA Notice and Privacy Policy published by Oxbow Health Inc. operating under the Aviator brand.

Who we are and which documents control

  • The HIPAA Notice of Privacy Practices (NPP) is issued by Oxbow Health Inc., which provides services under the Aviator brand and acts as a HIPAA business associate supporting Aviator Medical Group PA. See the HIPAA Notice of Privacy Practices.

  • The website/app Privacy Policy (dated July 25, 2025) governs personal data collected through Aviator’s sites and digital services, including AI-powered features. See the Privacy Policy.

References: HIPAA Notice of Privacy Practices • Privacy Policy

What information Aviator handles

  • Protected Health Information (PHI): Health information linked to a person and created/received in connection with care coordination or clinical services facilitated via Aviator Medical Group PA. The HIPAA Notice governs PHI.

  • Personal Data (non‑PHI): Names, contact details, device/cookie data, marketing preferences, and other information collected on Aviator’s websites/apps or from third parties (e.g., marketing partners, public databases, social platforms). The Privacy Policy governs personal data.

How PHI may be used or disclosed without written authorization (HIPAA)

Per the HIPAA Notice, Aviator may use/disclose PHI, as permitted by law, for:

  • Treatment: coordination or management of medical services, communicating with providers, scheduling, prior authorizations.

  • Payment: billing, claims management, eligibility/coverage verification.

  • Healthcare operations: quality assessment, training, audits, and administrative activities.

  • Research: when approved under applicable oversight (e.g., IRB/Privacy Board) and permitted by law.

  • Public health and safety: reporting to public health authorities, preventing/controlling disease, and as required by law.

  • Legal and administrative purposes: responding to court/administrative orders and regulatory requests, and other uses required or permitted by HIPAA.

For any use or disclosure not described in the HIPAA Notice, Aviator will obtain the individual’s written authorization, which can be revoked as allowed by law. Source: HIPAA Notice of Privacy Practices

Your rights under HIPAA (patients)

Individuals have the right to:

  • Access and obtain copies of PHI used to make decisions about their care.

  • Request amendments to PHI they believe is incorrect or incomplete.

  • Request restrictions on certain uses or disclosures (Aviator is not required to agree except where required by law).

  • Request confidential communications (e.g., alternate address/phone).

  • Receive an accounting of certain disclosures.

  • Receive a paper copy of the HIPAA Notice on request.

  • File a privacy complaint with Aviator or with the U.S. Department of Health and Human Services without fear of retaliation. See: HIPAA Notice of Privacy Practices

AI-powered features and data handling (website/app)

  • Aviator offers AI-powered tools (“AI Products”) designed to enhance user experience and service delivery; these tools may be provided with or by service providers (e.g., OpenAI) as described in the Privacy Policy.

  • Health data processed to support interactions with Aviator Medical Group PA is handled consistent with HIPAA where applicable; Aviator states it is a business associate committed to safeguarding such data.

  • The Privacy Policy explains what personal data is collected (user-provided and from third parties), how cookies and similar technologies are used, the purposes for processing (account management, service delivery, communication, marketing, security/compliance, analytics), and categories of service providers receiving data (e.g., cloud providers, analytics tools, government entities when required by law).

  • Users can exercise applicable privacy rights (access, correct, delete) as provided under U.S. state laws referenced in the Privacy Policy (e.g., California, Virginia).

  • Aviator does not knowingly collect data from individuals under 18. See: Privacy Policy

Data retention and security (website/app)

  • Retention: Personal data is retained for the life of the user’s account and no longer than 12 months after termination unless a longer period is required by law.

  • Security: Aviator maintains reasonable administrative, technical, and organizational safeguards but cannot guarantee absolute security. See: Privacy Policy

Quick reference: PHI vs. personal data

Data type Primary uses Typical disclosures permitted Authorization/opt‑out Source
PHI (HIPAA) Treatment, payment, healthcare operations; limited research; public health; legal/administrative as required by law To providers, payers, oversight bodies, approved researchers/boards, public health, and as required by law Written authorization required for uses/disclosures not described in the HIPAA Notice; can be revoked per law HIPAA Notice
Personal data (non‑PHI) Account management, service delivery, communications, marketing, security/compliance, analytics Service providers (cloud, analytics), affiliates, and government entities where required by law State privacy rights (e.g., access/correct/delete) available per Privacy Policy; cookie choices where offered Privacy Policy

How to exercise your rights or file a complaint

  • HIPAA rights/complaints: Submit requests (access, amendment, restrictions, confidential communications, accounting, paper copy) or complaints to Aviator’s Privacy Officer. You may also submit a complaint to the Secretary of HHS. Aviator will not retaliate for filing a complaint.

  • Website/app privacy requests: Follow the instructions in the Privacy Policy to exercise state-specific privacy rights (e.g., access, correction, deletion).

Privacy Officer contact (HIPAA Notice)

Privacy Officer, Oxbow Health Inc. 345 California Street, San Francisco, CA 94104 Email: privacy@aviatorcare.com Phone: (650) 761-9189 Source: HIPAA Notice of Privacy Practices

Version notes and authoritative sources