Privacy Policy

Introduction

Kassy Wellness, a brand of Kassy Health Company ("we," "us," or "our"), is committed to protecting the privacy and confidentiality of your personal information. This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you visit our website, use our services, or engage with our concierge precision-medicine practice in the Greater Orlando area.

By accessing our services or providing your information to us, you acknowledge that you have read and understood this Privacy Policy.

1. Information We Collect

Personal Information

We may collect personally identifiable information that you voluntarily provide to us, including but not limited to:

• Full name, date of birth, and gender
• Contact information (email address, phone number, mailing address)
• Emergency contact details
• Insurance information (if applicable)
• Payment and billing information

Health And Medical Data

As a medical practice, we collect protected health information (PHI) necessary to provide our clinical services, including:

• Medical history, current medications, and known allergies
• Diagnostic lab results, biomarker data, and imaging reports
• Treatment records, clinical notes, and protocol documentation
• Health intake forms and wellness assessments
• Information related to hormone optimization, peptide therapy, IV treatments, and other precision-medicine protocols

Usage And Technical Data

When you visit our website, we may automatically collect certain technical information, including:

• IP address, browser type, and operating system
• Pages visited, time spent on pages, and referring URLs
• Device identifiers and general geographic location
• Cookies and similar tracking technologies

2. How We Use Your Information

We use the information we collect for the following purposes:

• Clinical care: To provide, coordinate, and manage your precision-medicine treatments and protocols
• Communication: To contact you regarding appointments, treatment plans, lab results, and follow-up care
• Billing and payment: To process payments and manage your account
• Quality improvement: To evaluate and improve our clinical services and patient experience
• Legal compliance: To comply with applicable federal, state, and local laws and regulations
• Website optimization: To analyze usage patterns and improve our website functionality
• Marketing: With your consent, to send educational health content and practice updates

3. HIPAA Compliance

Our clinical operations utilize Practice Better as our electronic health record (EHR) and client management platform. Practice Better maintains HIPAA-compliant data storage and transmission protocols, including encrypted data at rest and in transit. All PHI entered into Practice Better is governed by a Business Associate Agreement (BAA) that ensures your health data is protected in accordance with HIPAA requirements.

We will not use or disclose your PHI without your written authorization except as permitted or required by law, including for treatment, payment, and healthcare operations purposes.

4. Data Security Measures

We implement a comprehensive approach to protecting your information:

• Encryption: All sensitive data is encrypted during transmission (TLS/SSL) and at rest
• Access controls: Role-based access restrictions limit data access to authorized clinical and administrative personnel only
• Secure communications: Patient communications regarding PHI are conducted through HIPAA-compliant channels
• Staff training: All team members receive regular training on privacy practices and HIPAA compliance
• Incident response: We maintain a breach notification and response protocol in accordance with HIPAA and Florida law

While we implement robust security measures, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security but are committed to protecting your information to the fullest extent possible.

5. Third-Party Services

We work with trusted third-party service providers to support our operations. These providers are contractually obligated to protect your information:

• Practice Better: HIPAA-compliant EHR platform used for scheduling, health records, intake forms, treatment documentation, and secure client communication. Protected by a Business Associate Agreement.
• Google Analytics: Used to collect anonymized website usage data to improve our online experience. Google Analytics does not collect PHI. You may opt out by installing the Google Analytics Opt-Out Browser Add-on.
• Payment processors: PCI DSS-compliant processors handle all credit card and payment transactions. We do not store your full payment card details on our servers.
• Email and marketing platforms: Used with your consent to deliver educational content and practice updates. These platforms do not have access to your PHI.

We do not sell, rent, or trade your personal information or health data to third parties for marketing purposes.

6. Cookies And Tracking Technologies

Our website uses cookies and similar technologies to enhance your browsing experience. These include:

• Essential cookies: Required for basic website functionality
• Analytics cookies: Help us understand how visitors interact with our website
• Preference cookies: Remember your settings and preferences

You can control cookie preferences through your browser settings. Disabling certain cookies may affect website functionality.

7. Your Rights Under Florida Law

As a resident of Florida or a patient of our practice, you have the following rights regarding your information:

• Right to access: You may request a copy of your medical records and personal information we maintain
• Right to amendment: You may request corrections to inaccurate or incomplete health information
• Right to an accounting of disclosures: You may request a record of certain disclosures of your PHI
• Right to restrict disclosures: You may request limitations on certain uses and disclosures of your PHI
• Right to confidential communications: You may request that we communicate with you through specific channels or at specific locations
• Right to data portability: You may request your health records be transferred to another provider
• Right to revoke authorization: You may revoke any previously granted authorization for use or disclosure of your PHI at any time in writing

Under the Florida Information Protection Act (FIPA), we are required to notify affected individuals within 30 days in the event of a data breach involving personal information. We comply fully with all Florida-specific privacy and data protection requirements.

8. Data Retention

We retain your personal and health information for as long as necessary to fulfill the purposes outlined in this policy and as required by applicable law. Medical records are retained in accordance with Florida law, which requires a minimum retention period of five years from the date of last patient contact for adult records, and longer for records involving minors.

9. Children'S Privacy

Our services are designed for adults. We do not knowingly collect personal information from individuals under the age of 18 without verifiable parental or guardian consent. If you believe we have collected information from a minor, please contact us immediately.

10. Changes To This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. The updated policy will be posted on this page with a revised effective date. We encourage you to review this policy periodically. Continued use of our services after any changes constitutes your acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy, wish to exercise your privacy rights, or need to report a concern, please contact us: