Individual Access Services

Individual Access Services (IAS)

Theta Health offers Individual Access Services (IAS) so that you can request and retrieve your own health records from healthcare organizations across the United States through the TEFCA health information network, and read them in the Theta Health app. This page explains our role, how to revoke your consent, and what rights you have over your information.

Our IAS Provider Status

Theta Health is a request-only IAS provider. In practice, that means information flows in one direction only — toward you:

• What you can do — Ask Theta Health to request your health records from participating healthcare organizations, and view what comes back in the app.
• What you cannot do — Use Theta Health to send, publish, or otherwise share your health information with other TEFCA participants. We do not offer that capability, in either direction.

Individual Access Services and TEFCA

TEFCA (Trusted Exchange Framework and Common Agreement) enables individuals to securely access their own health information held at healthcare organizations across the United States. Through our IAS integration, Theta Health can request and retrieve your clinical records — such as visit summaries, lab results, medications, and diagnoses — from participating healthcare organizations on your behalf.

Theta Health connects to the TEFCA network through CommonWell Health Alliance, our Qualified Health Information Network (QHIN). CommonWell serves as the gateway through which health record queries are routed. Before any query is made, your identity is verified by our identity verification partner, CLEAR (Alclear Healthcare, LLC), and we submit only verified demographic data for record retrieval.

All data exchanged through TEFCA is subject to the TEFCA Common Agreement and applicable U.S. Department of Health and Human Services (HHS) guidance.

Our Privacy Commitments at a Glance

• Your consent comes first — We do not query the network for your records until you have enabled IAS and given express, documented consent. Your consent is timestamped and stored in an auditable log.
• We do not sell your data — We do not sell your individually identifiable health information, and we do not share it with third parties for their own marketing or advertising purposes.
• We do not use it for advertising — Your health information is not used for targeted advertising or marketing, and never to assert a claim against you (except to collect applicable fees).
• You stay in control — You can revoke consent, disconnect IAS, or request deletion at any time. See the steps below.
• No fees today — Theta Health does not currently charge any fee for IAS. If that ever changes, we will publish the fee schedule and notify you in advance.

How to Revoke Your IAS Consent

You may revoke consent and disconnect IAS at any time, for any reason, at no cost. These same steps are available inside the Theta Health app and on a stand-alone page at thetahealth.ai/theta-ias-revoke-consent.html.

What happens after you revoke. Revocation will not affect actions already taken in reliance on your prior consent. After revocation, Theta Health will stop retrieving new health records on your behalf; you will no longer be able to use IAS to sync new records. Health records already retrieved and stored in the app prior to revocation will remain accessible to you in the app.

Revoking without using the app. You do not have to use the app to revoke your consent. You may also revoke consent and disconnect IAS by contacting us through any of the channels under Questions or Concerns below. Please include the email address or phone number associated with your Theta Health account so that we can locate it.

Revoking is not the same as deleting. Revoking consent does not by itself delete the health records already retrieved for you. You may separately request deletion at any time — see the next section.

Your Individual Rights

You have the following rights with respect to the individually identifiable health information Theta Health holds in connection with IAS:

• Access your data — View your retrieved health records at any time in the Theta Health app under Health Data.
• Export your data — Request a copy in a machine-readable format by emailing support@thetahealth.ai. We will confirm the available format(s) and provide guidance on interpretation on request.
• Delete your data — Request deletion of your individually identifiable health information — whether at the time you disconnect IAS or at any time afterward — to the extent technically feasible, within a reasonable period not to exceed 90 days. Audit log records required by law are exempt and are retained for a minimum of six (6) years.
• Revoke your consent — Disconnect IAS at any time, using the steps above or by contacting us.
• Be notified of an incident — Be notified if your individually identifiable information is reasonably believed to have been affected by a TEFCA security incident or a breach of unencrypted information.
• Complain — Submit a privacy complaint through any channel below. We maintain a documented process for receiving, tracking, and resolving complaints, and we will respond within 45 days.

To exercise any of these rights, contact us using the channels below or visit Settings → Privacy in the Theta Health app. We will inform you if applicable law prohibits us from honoring a request.

How We Protect Your Information

Theta Health is required to act in accordance with our IAS Privacy and Security Notice and will protect the security of the information it holds in accordance with the applicable Framework Agreement.

• Encryption — All individually identifiable information is encrypted in transit (TLS 1.2+) and at rest (AES-256), regardless of whether it is TEFCA data.
• Access controls — Access to your health data is restricted to authorized personnel with a legitimate business need. All access is logged and audited.
• Third-party security — Service providers who handle your information — including Amazon Web Services for encrypted document storage and CLEAR for identity verification — are contractually required to implement commercially reasonable security measures.
• Incident notification — If a TEFCA security incident or a breach of unencrypted individually identifiable information affects your data, we will notify you as promptly as possible by email and/or in-app notification.

Theta Health is not a HIPAA Covered Entity or Business Associate for IAS. Our handling of your information in this context is governed by the FTC Health Breach Notification Rule (16 CFR Part 318), the IAS Privacy and Security Notice, and the TEFCA Common Agreement. We voluntarily maintain security and privacy practices consistent with HIPAA standards.

Questions or Concerns

To ask a question, exercise a right, revoke consent, or file a privacy complaint: