Notice of Privacy Practices
Last updated June 4, 2026
This notice describes how protected health information (PHI) about you may be used and disclosed, and how you can get access to this information. Please review it carefully. Your dermatology practice is the covered entity responsible for your PHI; Constellation processes that information as a business associate.
Uses and disclosures for treatment, payment, and operations
Your practice may use and disclose your PHI to provide and coordinate your treatment, including the clinical photographs and measurements documented in Constellation. PHI may be used to obtain payment for services and to support routine healthcare operations such as quality review.
Other permitted and required disclosures
Your PHI may be disclosed when required by law, for public health activities, to report suspected abuse or neglect, for health oversight, in certain legal proceedings, and for specified law-enforcement or safety purposes. These disclosures are limited to what the law requires or permits.
Disclosures that require your authorization
Most uses and disclosures not described in this notice are made only with your written authorization. In Constellation, photographic consent is recorded per photo, at the time of capture. You may revoke an authorization in writing at any time, except where action has already been taken in reliance on it.
Your rights regarding your health information
You have the right to request access to and a copy of your PHI, to request a correction, to request restrictions on certain uses and disclosures, to request confidential communications, and to receive an accounting of certain disclosures.
You have the right to be notified following a breach of unsecured PHI, and the right to a paper copy of this notice. Requests are made to your practice, which controls your record.
Our security posture
Constellation supports your practice's safeguards. PHI is encrypted in transit and at rest, access is restricted by role and scoped to your own practice, and every access to identifiable information is recorded in an append-only audit trail. Photographic access links are short-lived and are never logged.
Complaints
If you believe your privacy rights have been violated, you may file a complaint with your practice or with the U.S. Department of Health and Human Services Office for Civil Rights. You will not be retaliated against for filing a complaint.
Contact
For questions about this notice or to exercise your rights, contact your dermatology practice's privacy officer. For questions about Constellation's role as a business associate, contact privacy@constellation.example.