Health & Medspa
(A DBA of Health and Psychiatrists Consultants LLC or applicable legal entity)
Effective Date: 1st April, 2026
1. PURPOSE AND LEGAL BASIS OF THIS NOTICE
THIS NOTICE OF PRIVACY PRACTICES (THE “NOTICE”) IS PROVIDED IN ACCORDANCE WITH THE HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996 (“HIPAA”), INCLUDING THE PRIVACY RULE (45 C.F.R. PART 160 AND SUBPARTS A AND E OF PART 164), THE SECURITY RULE, AND THE BREACH NOTIFICATION RULE.
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU MAY ACCESS SUCH INFORMATION.
BY RECEIVING SERVICES FROM HEALTH & MEDSPA, YOU ACKNOWLEDGE RECEIPT OF THIS NOTICE.
2. ENTITY COVERED BY THIS NOTICE
This Notice applies to Health & Medspa (the “Practice,” “Company,” “we,” “us,” or “our”), including all workforce members, licensed medical providers, administrative staff, and business associates acting on behalf of the Practice.
The Practice operates as a hybrid healthcare and aesthetic provider delivering services including, but not limited to, cosmetic injectables, laser treatments, IV therapy, hormone therapy, and medical weight loss programs under medical supervision .
3. PROTECTED HEALTH INFORMATION (PHI)
“Protected Health Information” (“PHI”) refers to any individually identifiable information relating to your past, present, or future physical or mental health condition, the provision of healthcare to you, or payment for such healthcare.
PHI may include, without limitation:
- Medical histories, diagnoses, treatment plans, and clinical notes
- Records related to aesthetic procedures and outcomes
- Laboratory results and hormone therapy records
- Medication and prescription information
- Photographs and imaging used for clinical documentation
- Billing, payment, and insurance information
Certain categories of information, including hormone therapy records and medical weight loss data, may be considered sensitive and are afforded enhanced protections where required by law.
4. OUR LEGAL DUTIES
The Practice is required by law to:
- Maintain the privacy and security of your PHI
- Provide you with this Notice of our legal duties and privacy practices
- Abide by the terms of this Notice currently in effect
- Notify you in the event of a breach involving unsecured PHI
The Practice implements administrative, technical, and physical safeguards designed to protect PHI and comply with HIPAA requirements.
5. USES AND DISCLOSURES OF PHI WITHOUT AUTHORIZATION
The Practice may use and disclose your PHI without your written authorization for the following purposes:
5.1 Treatment
We may use and disclose your PHI to provide, coordinate, and manage your healthcare, including:
- Consultations between providers
- Coordination of aesthetic and medical treatments
- Telehealth services for hormone therapy or weight management
Healthcare delivery in medspa settings often involves coordinated treatment plans across multiple modalities .
5.2 Payment
We may use and disclose your PHI to obtain payment for services rendered, including:
- Billing and claims submission
- Insurance verification
- Payment processing and collection activities
5.3 Healthcare Operations
We may use and disclose PHI for operational purposes, including:
- Quality assessment and improvement
- Staff training and credentialing
- Compliance and auditing
- Business management and administrative functions
6. ADDITIONAL PERMITTED AND REQUIRED DISCLOSURES
We may disclose PHI without your authorization as required or permitted by law, including:
- Public health reporting
- Health oversight activities
- Judicial or administrative proceedings
- Law enforcement requests
- Prevention of serious threats to health or safety
- Workers’ compensation programs
Such disclosures are limited to the minimum necessary information unless otherwise required by law.
7. USES AND DISCLOSURES REQUIRING AUTHORIZATION
The Practice will not use or disclose your PHI without your written authorization except as described above.
Authorization is required for:
- Use of PHI for marketing purposes
- Use of identifiable photographs for promotional content
- Disclosure of psychotherapy notes (if applicable)
- Sale of PHI
You may revoke authorization at any time in writing, except where action has already been taken.
8. PHOTOGRAPHY, IMAGING, AND AESTHETIC RECORDS
As part of treatment, the Practice may create photographic or visual records for clinical documentation, treatment planning, and quality assurance.
Such records are considered PHI when identifiable and are protected accordingly.
No identifiable images will be used for marketing or promotional purposes without your separate written authorization.
9. TELEHEALTH AND ELECTRONIC COMMUNICATIONS
The Practice may provide certain services via telehealth, including consultations for weight loss, hormone therapy, or follow-up care.
You acknowledge that:
- Telehealth involves electronic transmission of PHI
- There are inherent risks associated with electronic communication
- Absolute confidentiality cannot be guaranteed despite reasonable safeguards
The Practice utilizes HIPAA-compliant systems designed to protect the security and integrity of such communications.
10. BUSINESS ASSOCIATES
The Practice may disclose PHI to third-party vendors who perform services on its behalf, including:
- Telehealth platforms
- Cloud storage providers
- Billing and payment processors
- Technology infrastructure providers
Such entities are contractually obligated to comply with HIPAA through Business Associate Agreements.
11. YOUR RIGHTS REGARDING PHI
You have the following rights, subject to applicable limitations:
- You may access and obtain copies of your PHI
- You may request amendments to your PHI
- You may request restrictions on certain uses or disclosures
- You may request confidential communications
- You may receive an accounting of disclosures
- You may obtain a copy of this Notice
Requests must be submitted in writing using the contact information provided below.
12. MINIMUM NECESSARY STANDARD
The Practice limits the use and disclosure of PHI to the minimum necessary to accomplish the intended purpose, except where broader disclosure is required for treatment or by law.
13. BREACH NOTIFICATION
In the event of a breach involving unsecured PHI, the Practice will notify affected individuals without unreasonable delay in accordance with HIPAA and applicable state laws.
Notification will include information regarding the nature of the breach and recommended actions.
14. STATE LAW AND ENHANCED PROTECTIONS
Certain state laws may provide additional protections for medical and aesthetic treatment information, including stricter consent or disclosure requirements.
Where applicable, the Practice will comply with the more stringent legal standard.
15. DATA RETENTION
The Practice retains PHI in accordance with applicable legal, regulatory, and professional requirements.
Retention periods may extend for several years following completion of services.
16. COMPLAINTS AND NON-RETALIATION
If you believe your privacy rights have been violated, you may file a complaint with the Practice or with the U.S. Department of Health and Human Services.
You will not be retaliated against for filing a complaint.
17. CHANGES TO THIS NOTICE
The Practice reserves the right to modify this Notice at any time. Updated versions will apply to all PHI maintained and will be made available on the Platform.
18. CONTACT INFORMATION
For questions, requests, or complaints regarding this Notice:
Health & Medspa
3919 Tampa Road, Oldsmar, FL 34677
Phone: +1 727 444 0995
Email: legal@healthandmedspa.com