Privacy Policy

1. Health Information We Collect

We collect health information only as needed to provide, coordinate and bill for your care, and to operate our practice. Depending on the services you use, this may include:

• Identifying and contact information: name, date of birth, address, phone number, email address, emergency contact, and government-issued ID when required (for example, for controlled-substance prescriptions).
• Medical and health information: medical history, symptoms, diagnoses, medications, allergies, vital signs, height, weight and body composition, laboratory and imaging results, health questionnaires and intake forms, photographs submitted for clinical evaluation, and notes from in-person and telehealth visits.
• Prescription information: medications prescribed or recommended to you, including weight-management, hormone and peptide therapies, and pharmacy and shipping details needed to fill them.
• Device and monitoring data: readings from remote patient monitoring devices (such as blood pressure cuffs, glucose meters or scales) when you enroll in a monitoring program.
• Insurance and payment information: insurance carrier, member ID, claims information, and payment card details (processed by our payment processors; see Section 3).
• Communications: messages you send us through the patient portal, by phone, text or email, and records of telehealth sessions.

How we collect it. We collect health information directly from you when you schedule an appointment, complete paper or electronic intake forms, communicate with us, use our patient portal, or participate in an in-person or telehealth visit. We may also receive it from other healthcare providers, laboratories, imaging centers, pharmacies, health plans and health information exchanges involved in your care, and from devices you use in a monitoring program.

Website visits. Simply browsing our public website does not require you to provide health information. Online forms that ask for health information are submitted over an encrypted connection to our HIPAA-compliant systems and are treated as PHI.

2. How We Use and Share Health Information

We use and disclose PHI as permitted by HIPAA, the CMIA and other applicable law, primarily for:

• Treatment: to provide, coordinate and manage your care, including sharing information with physicians, nurses, specialists, laboratories, imaging centers and pharmacies involved in your care.
• Payment: to bill and collect payment from you, your health plan or other payers.
• Health care operations: quality improvement, staff training, compliance, audits, and running our practice.
• As required by law: for public health reporting, health oversight, court orders, law enforcement requests where legally required, and to prevent a serious threat to health or safety.

Service providers (Business Associates). We share PHI with vendors that perform services for us, such as our electronic health record and patient portal provider, laboratories, e-prescribing networks, billing and revenue-cycle companies, payment processors, secure messaging and telehealth platforms, and IT and hosting providers. Each of these vendors is required to sign a HIPAA Business Associate Agreement that obligates it to safeguard your PHI and use it only to perform services for us.

Telehealth services. Certain telehealth programs offered through Elevate, including medical weight-management and hormone programs, may be provided by independent, licensed clinicians affiliated with our telehealth partner medical group. When you enroll in these programs, we share the health information you provide with those clinicians so they can evaluate you and, where clinically appropriate, prescribe treatment, and with the licensed pharmacy that fills and ships your prescription. These clinicians and pharmacies are bound by HIPAA and applicable state privacy laws.

What we do not do. We do not sell your PHI or other health information. We do not share your health information with advertisers, social-media platforms or data brokers. We do not use or disclose your PHI for marketing, or disclose psychotherapy notes, without your prior written authorization, and you may revoke an authorization at any time in writing. Other uses and disclosures not described in this Policy or our Notice of Privacy Practices are made only with your written authorization.

3. How We Store and Protect Health Information

Your PHI is stored in our certified electronic health record system and other HIPAA-compliant systems hosted in secure, access-controlled data centers in the United States. Paper records are kept in locked, access-restricted areas of our offices.

We maintain administrative, physical and technical safeguards required by the HIPAA Security Rule, including:

• Encryption of electronic PHI at rest and in transit.
• Role-based access, so staff can view only the information needed for their job.
• Unique user credentials, multi-factor authentication and automatic log-off on systems containing PHI.
• Audit logs that record who accesses, changes or transmits PHI.
• Annual HIPAA privacy and security training for all workforce members, and a designated Privacy Officer.
• Regular risk assessments, data backups and a disaster-recovery plan.
• Business Associate Agreements with every vendor that handles PHI.

Payment card numbers are processed by PCI-DSS-compliant payment processors and are not stored on our website.

Retention. We retain medical records for at least the period required by California law (generally a minimum of seven years after your last visit, and longer for minors) and other applicable regulations. When records are no longer required, they are destroyed securely, for example by shredding paper and cryptographically wiping electronic media.

No method of storage or transmission is completely secure, but we continuously review and update our safeguards to protect your information.

4. How We Transmit Health Information

When PHI leaves our systems, we use secure methods designed to keep it confidential:

• Website and online forms: all pages and forms on our website use TLS (HTTPS) encryption. Forms that collect health information transmit it directly to our HIPAA-compliant scheduling, intake or patient-portal systems.
• Patient portal and telehealth: messages, results and documents are exchanged through our secure, encrypted patient portal; video visits use encrypted, HIPAA-compliant telehealth platforms.
• Prescriptions: prescriptions are sent electronically to pharmacies through secure, certified e-prescribing networks.
• Other providers, labs and health plans: we exchange PHI through encrypted electronic interfaces, health information exchanges, secure fax or other HIPAA-compliant methods.

Email and text messages. Standard email and text messaging may not be encrypted. We use them for appointment reminders and limited communications, and we send health information by these methods only with your consent. You may ask us at any time to stop communicating with you by email or text, or to use the secure patient portal instead. Please do not send sensitive health information to us through our general website contact form, social media or unencrypted email.

Fax and mail. When PHI is sent by fax or mail, we verify recipient information and use cover sheets or sealed envelopes marked confidential.

5. Website Information, Cookies and Analytics

When you visit our website, we and our service providers may automatically collect certain technical information, including your IP address, browser type, device type, pages visited, referring website, and time of visit. We use cookies, Google Tag Manager, analytics tools, and advertising technologies to operate and improve our website, measure the effectiveness of our marketing campaigns, and understand how visitors interact with our services.

Appointment and Form Submission Tracking. We use tracking technologies to measure website interactions, including appointment bookings and submissions of forms on our advertising landing pages. These technologies help us evaluate advertising performance, measure conversions, and improve the user experience.

We take steps to distinguish website analytics and advertising measurement from the collection and processing of protected health information (PHI). Our intention is to limit information shared with analytics and advertising providers to what is necessary for permitted measurement purposes and to prevent medical histories, diagnoses, treatment details, and other sensitive information entered into patient forms from being transmitted to advertising platforms.

We configure and review our tracking technologies in accordance with applicable privacy laws, including HIPAA and California privacy requirements where applicable. Tracking technologies that involve PHI are subject to applicable legal requirements, including authorization or appropriate contractual safeguards when required.

Your Privacy Choices. You may configure your browser to refuse or delete cookies, although some website features may not function as intended. Our website does not currently respond to "Do Not Track" signals, but we honor Global Privacy Control signals where required by applicable law.

Our website may contain links to third-party websites. We are not responsible for their privacy practices and encourage you to review their privacy policies.

6. Your Rights Regarding Your Health Information

Under HIPAA and California law, you have the right to:

• Inspect and obtain a copy of your medical records, including in electronic form, within the time frames required by law.
• Request an amendment to information you believe is incorrect or incomplete.
• Receive an accounting of certain disclosures of your PHI.
• Request restrictions on certain uses and disclosures, including restricting disclosures to your health plan for services you paid for in full out of pocket.
• Request that we communicate with you by alternative means or at an alternative location.
• Receive a paper copy of our Notice of Privacy Practices.
• Be notified if a breach of your unsecured PHI occurs.

Depending on where you live, you may have additional rights under your state's privacy or consumer health data laws. To exercise any of these rights, contact our Privacy Officer using the information below. We will not retaliate against you for exercising your rights.

7. Breach Notification

If your PHI is accessed, used or disclosed in a way not permitted by law, we will investigate promptly and notify you, and the appropriate regulators, as required by HIPAA and applicable state law.

8. Children's Privacy

Our website is not directed to children under 13, and we do not knowingly collect personal information online from children. Health information about minors who are our patients is handled in accordance with HIPAA and California law, including laws governing a parent's or guardian's access to a minor's records.

9. Changes to This Policy

We may update this Privacy Policy from time to time. The updated version will be posted on this page with a new effective date. Material changes affecting how we handle PHI will also be reflected in our Notice of Privacy Practices.

10. Contact Us and Complaints

If you have questions about this Policy, wish to exercise your rights, or believe your privacy has been violated, please contact:

Katia Sarafian, Elevate Health Group 214 N Central Ave, Glendale, CA 91203 Phone: (818) 246-8000 Email: [katia@elevatehealthgroup.com]

You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, at www.hhs.gov/ocr/complaints. We will not retaliate against you for filing a complaint.