Privacy Policy

1. HIPAA Compliance Statement

WellLife Integrative Health is a HIPAA-covered entity. We maintain comprehensive administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of all protected health information (PHI) entrusted to us. Our privacy and security practices comply with the HIPAA Privacy Rule (45 CFR Parts 160 and 164, Subparts A and E), the HIPAA Security Rule (45 CFR Parts 160 and 164, Subparts A and C), and the HITECH Act provisions governing breach notification and business associate agreements.

All clinical staff, administrative personnel, and contracted business associates receive annual HIPAA privacy and security training. Our designated Privacy Officer oversees compliance, investigates potential incidents, and serves as the point of contact for patient privacy inquiries.

2. Health Information We Collect

In the course of providing integrative medical care, we collect and maintain the following categories of information:

• • Demographic Information: Name, date of birth, address, phone number, email address, emergency contacts, insurance details, and government-issued identification when required for identity verification.
• • Clinical Health Information: Complete medical history, family health history, medication and supplement lists, allergy records, lab and diagnostic test results, imaging reports, clinical examination findings, diagnoses, treatment plans, and progress notes.
• • Lifestyle & Functional Health Data: Dietary patterns, exercise habits, sleep quality assessments, stress level questionnaires, environmental exposure history, and detailed symptom tracking logs submitted through our patient portal.
• • Financial Information: Credit card or debit card numbers (processed via PCI-DSS compliant payment processors), HSA/FSA account information, and insurance claim data necessary for superbill generation.

3. How We Use & Disclose Your Information

Your health information is used for the following HIPAA-permitted purposes:

• • Treatment: To provide, coordinate, and manage your integrative medical care, including sharing relevant clinical information with referring physicians, specialists, or laboratories involved in your treatment with your written authorization.
• • Payment: To process payments, generate superbills, and support your insurance reimbursement claims. We share only the minimum necessary information required for billing purposes.
• • Healthcare Operations: To conduct quality assessments, staff training, compliance auditing, and practice management activities that improve the safety and quality of care we provide.
• • As Required by Law: We may disclose PHI when required by federal, state, or local law, including mandatory public health reporting, court orders, and law enforcement requests that meet legal standards.

All other uses and disclosures of your health information require your specific written authorization, which you may revoke at any time by submitting a written request to our Privacy Officer.

4. Your Rights Regarding Health Records

Under HIPAA and Oregon state law, you have the following rights concerning your protected health information:

• • Right to Access: You may request a copy of your complete medical records in electronic or paper format. Requests are fulfilled within 30 days.
• • Right to Amendment: You may request corrections to factual inaccuracies in your health records. Requests are reviewed and responded to within 60 days.
• • Right to Accounting of Disclosures: You may request a list of instances in which your PHI was disclosed for purposes other than treatment, payment, or operations.
• • Right to Restrict: You may request restrictions on certain uses or disclosures, though we are not required to agree to all restriction requests.
• • Right to File a Complaint: You may file a complaint with our Privacy Officer or with the U.S. Department of Health and Human Services if you believe your privacy rights have been violated.

5. Electronic Health Records & Data Security

WellLife uses a SOC 2 Type II certified electronic health records (EHR) platform with AES-256 encryption at rest, TLS 1.3 encryption in transit, multi-factor authentication for all staff access, and comprehensive audit logging that records every access event. Automated daily backups are stored in geographically redundant, HIPAA-compliant data centers. Physical workstations within our clinic are protected by automatic session timeouts, encrypted hard drives, and restricted physical access controls.

In the unlikely event of a data breach affecting your PHI, we will notify affected individuals within 60 days in accordance with the HITECH Act breach notification rule, and will simultaneously report the breach to the HHS Office for Civil Rights and the Oregon Department of Justice as required by law.

6. Website Analytics & Cookies

Our website (welllifehealth.org) uses minimal, privacy-respecting analytics to understand how visitors navigate our site and improve content relevance. We do not use invasive third-party tracking pixels, Facebook Pixel, Google Ads remarketing tags, or any advertising-driven analytics platforms. Essential cookies are used solely for basic website functionality (session management, form state preservation) and do not track personally identifiable information.

No health-related information entered into our website tools (such as the Wellness Assessment or Treatment Estimator) is stored on our servers, transmitted to third parties, or linked to your identity. These tools operate entirely within your browser using client-side processing.

7. GDPR & CCPA Compliance

California Residents (CCPA): Under the California Consumer Privacy Act, California residents have the right to know what personal information we collect, request its deletion, and opt out of its sale. WellLife affirms that we never sell, rent, lease, or trade your personal information or protected health information to any third party for any purpose, including marketing, advertising, or data brokerage. This guarantee is absolute and unconditional.

EU/EEA Residents (GDPR): If you are a resident of the European Union or European Economic Area, you have additional rights including the right to data portability, the right to erasure (“right to be forgotten”), and the right to lodge a complaint with your local Data Protection Authority. We process your data on the legal basis of legitimate interest (healthcare provision) and explicit consent where applicable. To exercise any GDPR rights, please contact our Privacy Officer using the information below.

8. Third-Party Services & Zero Data-Selling Guarantee

We engage a limited number of HIPAA-compliant business associates who require access to PHI to support our operations, including our EHR vendor, payment processor, laboratory partners, and online supplement dispensary (Fullscript). Each business associate has executed a HIPAA Business Associate Agreement (BAA) that contractually obligates them to maintain the same privacy and security standards we uphold.

9. Privacy Officer Contact Information

For questions, concerns, or requests related to this Privacy Policy or your health information rights, please contact our designated Privacy Officer:

10. Policy Updates & Revision History

WellLife reserves the right to update this Privacy Policy as necessary to reflect changes in federal or state regulations, clinical practice standards, or our operational procedures. Material changes will be posted on this page with a revised effective date. Patients will be notified of significant changes via the patient portal or email within 30 days of the update taking effect.