Privacy Policy & HIPAA Notice of Privacy Practices

1. Who We Are

Holistic Family Practice VA is a private integrative and functional medicine practice established in Virginia in 2009. We operate a Virtual Global Holistic Healthcare Model that provides services including:

• Telehealth and virtual clinical consultations with patients in the United States and internationally
• Integrative, functional, and mind-body medicine evaluation and treatment
• Holistic wellness coaching and non-clinical coaching programs
• Digital health education courses, programs, and content
• Medical records management and release for the practice period January 2009 – present

Practice Address: 5510 Cherokee Avenue, Suite #300, Alexandria, VA 22312
Phone: +1 757-600-6872
Email: info@go.holisticfamilypracticeva.com

2. HIPAA Notice of Privacy Practices

We are a covered healthcare entity subject to the Health Insurance Portability and Accountability Act (HIPAA), 45 CFR Parts 160 and 164. This section constitutes our official Notice of Privacy Practices as required by 45 CFR § 164.520.

What is Protected Health Information (PHI)?

PHI is any individually identifiable health information we create, receive, maintain, or transmit in connection with your healthcare, including your name, date of birth, medical history, diagnoses, treatment records, lab results, billing information, and any other information that could identify you in connection with your health.

How We Use and Disclose Your PHI

We use and disclose PHI for the following purposes without requiring your separate authorization:

• Treatment: To provide, coordinate, and manage your healthcare and related services, including sharing information with other treating providers involved in your care.
• Payment: To bill and collect payment for services rendered, including submission to insurance carriers and processing of invoices.
• Healthcare Operations: For internal quality assurance, training, administrative functions, and practice management.
• As required by law: In response to valid court orders, subpoenas with appropriate patient authorization, public health reporting, and other legally mandated disclosures.

Uses Requiring Your Written Authorization

We will not use or disclose your PHI for the following purposes without your signed, HIPAA-compliant written authorization:

• Release of records to third parties (attorneys, insurers, other individuals)
• Psychotherapy process notes
• Substance use disorder records (42 CFR Part 2)
• HIV/AIDS-related records
• Genetic information (GINA)
• Marketing communications that involve PHI
• Sale of PHI

Your Rights as a Patient

• Right to access your records: You may request a copy of your medical records. Requests are fulfilled within 30 days per Virginia Code § 32.1-127.1:03. Fees apply per our published fee schedule.
• Right to request amendment: You may request correction of inaccurate or incomplete PHI. We will respond within 60 days.
• Right to an accounting of disclosures: You may request a list of disclosures of your PHI made outside of treatment, payment, and operations for the past 6 years.
• Right to request restrictions: You may request restrictions on how we use or disclose your PHI, though we are not always required to agree.
• Right to confidential communications: You may request that we communicate with you by alternative means or at an alternative location.
• Right to a paper copy of this notice: You may request a printed copy of this notice at any time.
• Right to file a complaint: You may file a complaint with us or with the U.S. Department of Health & Human Services, Office for Civil Rights at hhs.gov/ocr. You will not be retaliated against for filing a complaint.

Technology Platforms & Business Associates

We use the following HIPAA-compliant platforms under signed Business Associate Agreements (BAAs) to store, process, and transmit PHI. Each platform is bound by our BAA to protect your information:

• Google Workspace (Google Drive): Secure cloud storage of legacy medical records (2009–2023). BAA in place with Google LLC.
• Heidi Health: Clinical encounter documentation and SOAP notes for current patients (2023–present). BAA in place.
• BodySite: Patient portal, document storage, and secure medical records delivery. BAA in place.
• GoHighLevel (GHL): Patient intake forms, appointment scheduling, invoicing, and HIPAA-compliant communications. BAA in place.

We do not use any platform to store or transmit PHI without a current, executed BAA. We review our BAA agreements annually.

3. Information We Collect

Clinical & Health Information

When you engage with our clinical services — including virtual consultations, intake forms, and medical records requests — we collect health history, diagnoses, treatment information, laboratory results, supplement and medication records, and other clinical data necessary to provide care.

Personal & Contact Information

We collect your name, date of birth, address, phone number, email address, and payment information as necessary to provide services, process invoices, and communicate with you.

International Patients

Our Virtual Global Holistic Healthcare Model serves patients outside the United States. If you are located in the European Union or European Economic Area, you have additional rights under the General Data Protection Regulation (GDPR) described in Section 8 below. If you are located in another country, your information may be transferred to and processed in the United States, where data protection laws may differ from those in your country. By engaging our services, you consent to this transfer.

Website & Technical Information

We collect standard technical data through cookies, web beacons, and log files including IP address, browser type, pages visited, and session duration. This information is used to improve our website and services and is not linked to your PHI.

4. Virtual Global Holistic Healthcare Model — Additional Privacy Provisions

Telehealth Services

Virtual consultations are conducted through HIPAA-compliant telehealth platforms. By participating in a telehealth session, you consent to the electronic transmission of your health information over secure encrypted connections. You acknowledge that you are responsible for ensuring that your device and internet connection are private and secure during sessions.

International Patients — Scope of Practice Notice

Patients located outside the United States are served in a coaching, wellness consultation, or health education capacity unless a specific licensed clinical relationship is established in accordance with applicable laws. International patients acknowledge that the practice operates under Virginia licensure and that the laws of Virginia and the United States govern our clinical and administrative obligations. We do not knowingly establish clinical relationships in jurisdictions where doing so would be unlawful without local licensure.

Non-Clinical Coaching & Wellness Programs

Our wellness coaching and non-clinical programs do not constitute the practice of medicine. Information shared in the context of coaching programs is used to provide personalized wellness guidance and is handled with the same care and confidentiality as clinical information, but it may not constitute PHI as defined by HIPAA. We treat all health-related information you share with us as confidential regardless of its clinical classification.

Digital Courses & Educational Content

When you enroll in a digital course or educational program, we collect enrollment information, learning activity data, and any health information you voluntarily provide in the context of the program. This information is used to administer the program and improve content. It is not used for clinical decision-making unless you are also an active clinical patient.

5. Intellectual Property

Ownership

All content, materials, frameworks, programs, and brand elements created by or for Holistic Family Practice VA are the exclusive intellectual property of the Practice and its principal clinician. This includes, without limitation:

• Clinical Protocols & Treatment Frameworks: All integrative, functional, and mind-body medicine protocols, treatment frameworks, clinical decision trees, root-cause analysis methodologies, supplement protocols, and case summary frameworks developed by the Practice.
• Written Content: All articles, blog posts, patient education materials, newsletters, clinical summaries, intake questionnaires, and any other written materials authored by or on behalf of the Practice.
• Brand Identity: The name "Holistic Family Practice VA," all associated logos, taglines, color schemes, visual identity elements, and the "Virtual Global Holistic Healthcare Model" designation and concept.
• Digital Programs & Courses: All digital health education courses, wellness programs, coaching frameworks, recorded content, presentations, worksheets, and program materials, whether delivered online, in digital format, or otherwise.
• Website Content: All text, graphics, photographs, audio, video, software, and other content appearing on our websites and digital platforms.

Prohibited Uses

Without prior express written permission from Holistic Family Practice VA, you are strictly prohibited from:

• Reproducing, copying, duplicating, or distributing any content, protocols, or materials from this Practice, in whole or in part, in any format or medium
• Modifying, adapting, translating, or creating derivative works based on our intellectual property
• Using our clinical protocols, treatment frameworks, or program content in your own practice, programs, or educational offerings
• Selling, licensing, sublicensing, or commercializing any of our intellectual property
• Removing, obscuring, or altering any copyright, trademark, or proprietary notices
• Using our brand name, logo, or "Virtual Global Holistic Healthcare Model" designation to imply endorsement, affiliation, or association without our written consent
• Scraping, harvesting, or systematically collecting content from our websites or platforms using automated tools

Enforcement

We actively monitor for unauthorized use of our intellectual property. Violations will be subject to immediate legal action including claims for copyright infringement, trademark infringement, and unfair competition under applicable United States federal law (including the Digital Millennium Copyright Act, 17 U.S.C. § 512) and international intellectual property treaties. We reserve the right to seek injunctive relief, actual damages, statutory damages, and attorneys' fees to the fullest extent permitted by law.

Limited License for Personal Use

You are granted a limited, non-exclusive, non-transferable, revocable license to access and view our publicly available website content and patient education materials solely for your personal, non-commercial use in connection with your own healthcare. This license does not grant you any right to download, store, reproduce, transmit, display, or create derivative works from our content except as expressly permitted in writing.

6. Data Security

We implement industry-standard administrative, technical, and physical safeguards to protect your information from unauthorized access, disclosure, alteration, or destruction. These include:

• End-to-end encryption for all telehealth communications
• Encrypted cloud storage with access controls on all platforms holding PHI
• Role-based access controls limiting PHI access to authorized personnel only
• Annual review of all BAAs and third-party vendor security practices
• Secure, HIPAA-compliant invoice and payment processing

In the event of a data breach that affects your PHI, we will notify you as required by the HIPAA Breach Notification Rule (45 CFR §§ 164.400–414) and applicable state law.

7. Data Retention

We retain medical records in accordance with Virginia law and HIPAA:

• Adult patients: 5 years from the date of last service (Virginia Code § 32.1-127.1:03) or 6 years from creation/receipt (HIPAA), whichever is longer.
• Minor patients: Until the patient reaches age 23, or 5 years from the date of last service, whichever is later.
• Disclosure logs: 6 years from the date of creation (HIPAA).
• Non-clinical coaching & course records: Retained for 3 years from last program activity, then securely deleted.

8. International Privacy Rights (GDPR)

If you are located in the European Union, European Economic Area, or United Kingdom, the General Data Protection Regulation (GDPR) grants you the following rights with respect to your personal data:

• Right of access: Request a copy of your personal data we hold.
• Right to rectification: Request correction of inaccurate data.
• Right to erasure ("right to be forgotten"): Request deletion of your data, subject to our legal retention obligations.
• Right to restrict processing: Request that we limit how we use your data.
• Right to data portability: Request your data in a portable, machine-readable format.
• Right to object: Object to certain types of processing, including direct marketing.

To exercise any of these rights, contact us at info@go.holisticfamilypracticeva.com. We will respond within 30 days. We are the data controller with respect to your personal data. Our data processors (listed in Section 2) are contractually bound to comply with GDPR requirements.

9. Cookies & Tracking Technologies

Our websites use cookies and similar tracking technologies to improve your experience, analyze site traffic, and support our communications. You may control cookie preferences through your browser settings. Disabling cookies may limit your access to certain features of our website. We do not use cookies to store or access your PHI.

10. Children's Privacy

Our website and digital programs are not directed to children under the age of 13. We do not knowingly collect personal information from children under 13 without verifiable parental consent. For minor patients under 18, a parent or legal guardian must provide authorization for clinical services and records requests.

11. Changes to This Policy

We reserve the right to update this Privacy Policy and HIPAA Notice of Privacy Practices at any time. Material changes will be posted on this page with an updated effective date. Your continued use of our services following any update constitutes your acceptance of the revised policy. We encourage you to review this page periodically.

12. Contact Us

For privacy-related questions, HIPAA requests, records requests, or intellectual property inquiries, please contact us:

Holistic Family Practice VA
5510 Cherokee Avenue, Suite #300
Alexandria, VA 22312
Phone: +1 757-600-6872
Email: info@go.holisticfamilypracticeva.com

This document does not constitute legal advice. We recommend consulting a licensed healthcare attorney for jurisdiction-specific compliance guidance, particularly regarding international telehealth licensure and cross-border data transfer obligations.