Privacy Policy
Privacy Policy
1. Introduction
Alchemical Transformations Health Services, P.C. (“ATHS,” “we,” “us,” or “our”) is a Texas professional corporation that provides telemedicine services to patients located in Texas. This Privacy Policy describes how we collect, use, store, and disclose information when you visit our website, communicate with us, or receive care through our telemedicine platform (together, the “Platform”).
Two documents govern information on the Platform, and they divide the work. This Privacy Policy applies to information collected through the Platform generally, including information from visitors who have not become patients. Our Notice of Privacy Practices (the “Notice”) governs protected health information (“PHI”) that we create or receive as a healthcare provider, as required by the Health Insurance Portability and Accountability Act (“HIPAA”) and the Texas Medical Records Privacy Act. If this Privacy Policy conflicts with the Notice with respect to PHI, the Notice controls. Nothing in this Privacy Policy expands our obligations, or creates rights, beyond what HIPAA, Texas law, and the Notice provide with respect to PHI.
Patients also receive our Telehealth Informed Consent, which explains how telemedicine care works and its limitations.
By accessing or using the Platform, you acknowledge this Privacy Policy. If you use the Platform on behalf of another adult, you represent that you are authorized to act for that person and that they have reviewed this Privacy Policy.
2. Who We Serve
The Platform and our services are available only to individuals who are at least eighteen (18) years of age and located in Texas. We do not offer services in other states at this time.
3. Information We Collect
Some information is necessary for us to provide care. If you choose not to provide it, we may be unable to offer some or all of our services.
Identity and contact information. Name, date of birth, sex, home address, phone number, email address, and emergency contact details.
Government-issued identification. Before your consultation, you provide a copy of a government-issued photo ID so your physician can verify your identity, as Texas telemedicine standards require. The copy becomes part of your patient record.
Health information. Medical history, conditions, symptoms, medications, allergies, laboratory results, clinical notes, and treatment plans. This information is PHI and is governed by the Notice.
Financial information. Payment card details are collected and processed by third-party payment processors; we do not store your card number. We retain transaction records such as amounts, dates, and billing details.
Technical information. Limited data about your visit, such as device type, browser, IP address, and access times, collected to keep the Platform functional and secure.
4. How We Collect Information
Most information comes directly from you: the forms you complete, the documents you provide before your consultation, what you share during visits, and your messages, calls, and emails. Some technical information is collected automatically when you use the Platform, limited to what operation and security require. We also receive information from others involved in your care, such as pharmacies confirming a prescription was filled, laboratories returning your results, payment processors confirming a transaction, and prior providers when you authorize a records transfer.
5. How We Use Information
We use your information to provide care: reviewing your history, conducting consultations, ordering laboratory testing, prescribing when clinically appropriate, and coordinating with the pharmacies and laboratories serving you. We use financial information to process payments, maintain accurate records, and resolve billing questions. We use contact information to send appointment confirmations, results notifications, follow-ups, and responses to your inquiries.
We use technical information to operate, secure, and improve the Platform, including monitoring for unauthorized access. We use information as needed to meet legal obligations, including record retention and breach notification. We use aggregated or de-identified information to evaluate and improve our services. Marketing uses are described in Section 14, and any use of PHI for marketing that requires written authorization under HIPAA will not occur without it. Patient testimonials appear only with the patient’s written authorization.
6. Artificial Intelligence
Your diagnosis and treatment decisions are made by your physician. Any use of artificial intelligence in your diagnosis or treatment will be disclosed to you by your physician, as Texas law requires.
7. How We Share Information
We disclose information in the following circumstances, limited in each case to what the purpose requires:
- With physicians and other licensed professionals involved in your care.
- With pharmacies, to fill your prescriptions, and with laboratories, to perform your testing.
- With payment processors, to process transactions you initiate.
- With service providers and business associates that perform administrative, technical, or operational functions for us. These parties are bound by confidentiality obligations and, wherever health information is involved, by business associate agreements requiring HIPAA compliance.
- With individuals you authorize, such as a family member or legal representative. You may modify or revoke an authorization at any time.
- With government agencies and regulators when the law requires it, including public health reporting and responses to lawful subpoenas, court orders, and audits, which we review before responding.
- With emergency personnel when necessary to protect your health or safety.
- In connection with a sale, reorganization, or similar transaction involving the practice, subject to the laws governing medical records and to this Privacy Policy.
8. No Sale of Personal Information
We do not sell personal information, including health information. As used here, “sell” means exchanging information for money or other valuable consideration. Texas law separately prohibits the sale of protected health information, and our practice matches the prohibition. Disclosures to the service providers and care partners described in Section 7 are made so they can perform services for us or for you, under contractual limits on their use of the information, and are not sales.
9. Notice Regarding Electronic Disclosure of Health Information
Texas law requires us to notify you that your health information may be disclosed electronically. We may disclose PHI electronically for treatment, payment, or health care operations, or as otherwise authorized or required by state or federal law. Other electronic disclosures of your PHI require your authorization. This posting serves as our general notice under Texas Health and Safety Code § 181.154.
10. Cookies and Tracking
We do not use analytics services, advertising pixels, or behavioral tracking on the Platform. The companies that operate portions of the Platform on our behalf, such as our electronic health record system, intake forms, scheduling, and payment processing, may collect technical data through their own systems in connection with providing and securing those services; where health information is involved, they do so under business associate agreements. Because we deploy no tracking, there is no advertising or analytics activity for browser signals such as “Do Not Track” or the Global Privacy Control to disable, and the Platform does not respond to those signals.
11. Data Security
We protect your information with encryption in transit and at rest, unique user credentials, multi-factor authentication, and role-based access limited to personnel who need the information to do their jobs. Patient records are maintained on HIPAA-compliant systems hosted on servers located in the United States. We monitor our systems for unauthorized activity and periodically assess our safeguards. If a breach affects your information, we will contain it, notify you and the appropriate authorities within the timeframes required by HIPAA and Texas law, and take corrective measures.
Reasonable safeguards lower the likelihood of a breach without eliminating it. Information transmitted over the internet or stored electronically carries some residual risk despite the measures described above, and we cannot guarantee absolute security. We maintain and update our safeguards as threats evolve.
You have a part in this as well. Keep your login credentials confidential; you are responsible for activity under your account. If you believe your account has been compromised, contact us immediately.
12. Data Retention
Medical records are retained for at least seven years from the date of your last treatment, as Texas Medical Board rules require, and longer where the law or your care requires it. Financial and tax records are retained for at least seven years. Other information is retained as long as needed for the purposes described in this Privacy Policy, to comply with legal obligations, to resolve disputes, and to maintain security; actual periods vary with the type and sensitivity of the information and the obligations that apply to it. When information is no longer needed, we dispose of it securely.
13. Text Messaging
If you provide your mobile number and opt in, we may send you text messages related to your care, such as appointment reminders and notifications. Promotional text messages are sent only if you separately opt in to receive them. Message frequency varies, and message and data rates may apply. Reply STOP to cancel and HELP for assistance. Mobile opt-in information and text messaging consent are not shared with or sold to third parties for marketing purposes.
14. Marketing Communications
We send promotional or educational email only to people who have asked for it. You may unsubscribe at any time using the link in any message or by contacting us. Unsubscribing from promotional email does not affect communications about your care, appointments, results, or account. Where HIPAA requires written authorization before PHI is used for marketing, we obtain that authorization first.
15. Children
The Platform is intended for adults. We do not provide services to anyone under eighteen (18), do not direct the Platform to children, and do not knowingly collect personal information from anyone under eighteen. If we learn that we hold such information, we will delete it unless the law requires retention. If you believe a minor has provided information to us, contact us at the address in Section 20. This section describes our voluntary practices and is not an admission that the Children’s Online Privacy Protection Act or any similar law applies to the Platform.
16. Your Rights
Your rights in your PHI are set out in the Notice and in law. They include the right to access and obtain copies of your records; the right to request amendment of information you believe is incomplete or inaccurate, with a written explanation and a process for noting your disagreement if we deny the request; the right to an accounting of certain disclosures; the right to request restrictions on uses and disclosures; the right to request communications by particular means or at particular locations, which we will accommodate where reasonable; and the right to a copy of the Notice.
Under HIPAA, we provide access within thirty (30) days of a proper request. Where Texas law applies, we provide electronic copies of records held in our electronic health record system within fifteen (15) business days of your written request. We may charge a reasonable, cost-based fee for copies as permitted by HIPAA and Texas rules; you will be told the fee before we proceed.
You may request deletion of information that is neither part of your medical record nor subject to a legal retention obligation. Where the law requires us to retain information, we will tell you so in writing.
You may withdraw consent to marketing communications at any time, as described in Sections 13 and 14.
To exercise any right, contact us as described in Section 20. We will verify your identity before acting on a request, which may require government-issued identification or account verification. We may decline a request where the law requires us to retain the information, where fulfilling it would harm another person’s privacy or reveal confidential information, or where we cannot verify your identity; if we decline, we will explain why in writing, and you may ask us to review the decision.
If you believe your privacy rights have been violated, you may complain to us directly, to the U.S. Department of Health and Human Services, Office for Civil Rights, or to the appropriate Texas authorities. We will not retaliate against you for filing a complaint.
17. De-Identified and Aggregated Information
We may create de-identified or aggregated information in accordance with HIPAA’s de-identification standards and use it for any lawful purpose, such as evaluating and improving our services and producing educational or research materials. We do not attempt to re-identify de-identified information.
18. Third-Party Links
The Platform may link to websites and services we do not operate. This Privacy Policy does not apply to them, and we are not responsible for their content or privacy practices. A link is provided for convenience and does not imply endorsement. Review the privacy policy of any site you visit.
19. Geographic Scope and Governing Law
Our services are offered only to individuals located in Texas, and this Privacy Policy, together with our collection, use, and disclosure of information, is governed by the laws of the State of Texas and applicable federal law.
20. Contact Us
Direct privacy questions, requests, and complaints to our Privacy Officer:
Email: [email protected]
Phone: [PHONE NUMBER]
Mail: Alchemical Transformations Health Services, P.C., Attn: Privacy Officer, [MAILING ADDRESS]
We aim to respond to inquiries within two business days. If your matter requires more time, we will tell you the status and expected timeframe. If you need accommodations to communicate with us, let us know and we will assist.
21. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. Updates will be posted on the Platform with a revised “Last Updated” date. If a change materially affects how we collect, use, or disclose your information, we will provide notice by email or by a prominent notice on the Platform before the change takes effect, or as the law otherwise requires. Your continued use of the Platform after the effective date of an update constitutes acceptance of it.