Website Privacy Policy

1.Introduction

As a California-based medical wellness practice, we recognize our responsibilities under applicable federal and California privacy laws, including:

• Health Insurance Portability and Accountability Act of 1996 (HIPAA)
• HIPAA Privacy, Security, and Breach Notification Rules
• California Confidentiality of Medical Information Act (CMIA)
• California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), where applicable
• Other applicable California medical privacy and consumer protection laws

This Privacy Policy explains how information collected through our website and related online communications may be collected, used, maintained, and disclosed.

2.Information We Collect

Depending on how you interact with our website and services, we may collect:

• Full name
• Email address
• Telephone number
• Date of birth
• Appointment and consultation requests
• Information voluntarily provided through contact forms
• Health-related information submitted through approved patient systems
• Billing and payment information
• Website usage and technical information, including IP address, browser type, and cookies

Medical records, laboratory results, prescriptions, and treatment documentation are maintained through our designated clinical systems rather than being made publicly accessible through our website.

3.How We Use Information

We may use information for legitimate business and healthcare purposes, including:

• Responding to inquiries
• Scheduling consultations and appointments
• Coordinating medical services
• Communicating with patients
• Processing authorized transactions
• Supporting treatment, payment, and healthcare operations
• Maintaining required records
• Improving website functionality
• Meeting applicable legal and regulatory obligations

Protected health information is used and disclosed only as permitted or required by applicable law or pursuant to a valid authorization when required.

4.HIPAA and Medical Privacy

Coastal Wellness MC is committed to protecting medical information in accordance with HIPAA and applicable California law.

Where HIPAA applies, protected health information may be used or disclosed for treatment, payment, healthcare operations, and other purposes permitted or required by law.

Certain uses and disclosures require written patient authorization.

Patients have rights concerning their protected health information, as described in our separate HIPAA Notice of Privacy Practices.

California law may provide additional confidentiality protections beyond federal HIPAA requirements.

5.California Confidentiality of Medical Information Act

Coastal Wellness MC recognizes the requirements of California’s Confidentiality of Medical Information Act (CMIA).

Medical information is treated as confidential and is not disclosed except as authorized by the patient or otherwise permitted or required by applicable law.

We maintain safeguards intended to prevent unauthorized access, use, alteration, or disclosure of confidential medical information.

6.Patient Privacy Rights

Depending on applicable law, patients may have the right to:

• Access and obtain copies of medical records
• Request amendments to certain medical information
• Request confidential communications
• Request restrictions on certain uses or disclosures
• Receive an accounting of certain disclosures
• Obtain a copy of our HIPAA Notice of Privacy Practices
• Request information regarding applicable privacy practices
• File a privacy complaint without retaliation
• Receive notification of certain reportable privacy breaches

Requests may be submitted using the contact information provided at the end of this policy.

7.Website Contact Forms and Email Communications

Information voluntarily submitted through our website may be used to respond to requests for services, consultations, or general information.

Visitors should avoid submitting sensitive medical information through general website forms or unsecured email.

When appropriate, patients may be directed to approved clinical communication systems.

We take steps to protect confidential information and follow applicable privacy requirements when communicating electronically.

8.Third-Party Service Providers

Coastal Wellness MC may work with third-party providers supporting:

• Website hosting and maintenance
• Appointment scheduling
• Electronic medical records
• Payment processing
• Laboratory coordination
• Clinical communications
• Administrative operations

Where required by HIPAA, we enter into Business Associate Agreements with vendors that create, receive, maintain, or transmit protected health information on our behalf.

Third-party providers are expected to protect information in accordance with applicable contractual and legal requirements.

9.Cookies, Analytics, and Advertising

Our website may use cookies and similar technologies to improve functionality, measure website activity, and support communications or marketing.

We recognize that information collected through healthcare websites may be subject to HIPAA, California medical confidentiality laws, or other privacy requirements depending on the circumstances.

We do not authorize the use or disclosure of protected health information for advertising or marketing purposes that require patient authorization unless that authorization has been obtained.

Visitors may adjust certain cookie preferences through their browser settings.

10.Information Security

Coastal Wellness MC maintains reasonable administrative, physical, and technical safeguards designed to protect confidential information.

These may include:

• Access controls
• Secure clinical information systems
• Staff confidentiality practices
• Appropriate vendor safeguards
• Procedures for responding to suspected privacy or security incidents

No electronic transmission or storage method can be guaranteed completely secure.

11.California Consumer Privacy Rights

California residents may have additional rights concerning personal information under applicable California privacy laws.

Where the CCPA/CPRA applies, these rights may include access, correction, deletion, and other rights subject to statutory exceptions.

Certain medical information regulated by HIPAA or California’s CMIA may be exempt from particular CCPA provisions.

Individuals may contact Coastal Wellness MC regarding applicable privacy requests.

12.Medical Record Retention

Coastal Wellness MC retains medical records and related documentation in accordance with applicable California and federal recordkeeping requirements.

Retention periods may vary based on the type of record, patient age, and applicable legal obligations.

Records are maintained and disposed of using appropriate confidentiality and security procedures.

13.Children’s Privacy

Our general website is not directed toward children under 13 years of age.

We do not knowingly collect children’s personal information through our general website in violation of applicable law.

Information involving minors receiving healthcare services is handled according to applicable federal and California confidentiality requirements.

14.Privacy Incidents and Breach Notification

Coastal Wellness MC investigates suspected unauthorized access, use, or disclosure of confidential information.

When required by HIPAA or California law, affected individuals and appropriate regulatory authorities will be notified of reportable breaches within applicable legal timeframes.

15.Changes to This Privacy Policy

Coastal Wellness MC reserves the right to update this Privacy Policy to reflect changes in applicable laws, business operations, technology, or privacy practices.

Any revisions will be posted on our website with an updated effective date.

16.Contact Information

For questions regarding this Privacy Policy, privacy rights, or confidential information, please contact:

Individuals may also file HIPAA privacy complaints with the U.S. Department of Health and Human Services, Office for Civil Rights:

https://www.hhs.gov/ocr

Coastal Wellness MC prohibits retaliation against individuals who exercise their privacy rights or submit privacy complaints in good faith.