Privacy Policy
Your privacy and the security of your personal health information is our highest priority
Introduction
CC Brain & Body Wellness ("we," "us," or "our") is committed to protecting your privacy and maintaining the confidentiality of your personal and health information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, use our services, or interact with us in any way.
As a healthcare wellness provider, we comply with all applicable privacy laws, including the Health Insurance Portability and Accountability Act (HIPAA), to ensure your protected health information (PHI) remains secure and confidential.
By using our services, you consent to the collection and use of your information as described in this Privacy Policy.
Information We Collect
Personal Information
We may collect the following types of personal information:
- Contact Information: Name, email address, phone number, mailing address
- Demographic Information: Age, gender, occupation, emergency contact details
- Account Information: Username, password, preferences, communication settings
- Payment Information: Credit card details, billing address, insurance information
- Communication Records: Emails, messages, phone call records, appointment notes
Health Information
As a healthcare wellness provider, we collect protected health information (PHI) including:
- Medical History: Previous treatments, medications, allergies, medical conditions
- Session Data: Neurofeedback results, therapy session notes, progress tracking
- Assessment Information: Initial intake forms, wellness questionnaires, goal assessments
- Treatment Records: Service dates, session durations, treatment plans, outcomes
- Insurance Information: Policy details, authorization numbers, claims data
Technical Information
When you visit our website, we automatically collect:
- Device Information: IP address, browser type, operating system, device identifiers
- Usage Data: Pages visited, time spent, click patterns, referral sources
- Location Data: General geographic location based on IP address
- Cookies and Tracking: Website preferences, session tokens, analytics data
How We Use Your Information
We use your information for the following purposes:
Healthcare Services
- Providing neurofeedback, red light therapy, and other wellness services
- Creating and maintaining treatment plans
- Monitoring your progress and adjusting treatments
- Scheduling appointments and sending reminders
- Processing insurance claims and payments
- Coordinating care with other healthcare providers (with your consent)
Communication
- Responding to your inquiries and providing customer support
- Sending appointment confirmations and reminders
- Providing updates about your treatment or our services
- Sharing relevant health and wellness information (with your consent)
Business Operations
- Improving our services and developing new treatments
- Analyzing usage patterns to enhance user experience
- Conducting research and quality improvement initiatives
- Complying with legal and regulatory requirements
- Protecting against fraud and ensuring security
Information Sharing and Disclosure
We do not sell, trade, or rent your personal information. We may share your information only in the following circumstances:
With Your Consent
We will share your information when you explicitly authorize us to do so, such as coordinating care with your primary healthcare provider.
Service Providers
We may share information with trusted third-party service providers who assist us in operating our business, including:
- Payment processors for billing and insurance claims
- Technology providers for data storage and security
- Analytics services for website improvement
- Legal and professional advisors
Legal Requirements
We may disclose your information when required by law, including:
- Court orders, subpoenas, or legal proceedings
- Public health or safety emergencies
- Regulatory investigations or audits
- Protection against fraud or illegal activities
Important: All third parties who receive your information are bound by strict confidentiality agreements and are required to protect your information with the same level of security we provide.
HIPAA Compliance
As a healthcare provider, CC Brain & Body Wellness is fully compliant with the Health Insurance Portability and Accountability Act (HIPAA) and its Privacy Rule. This means:
Protected Health Information (PHI)
- Your health information is protected by federal law
- We maintain administrative, physical, and technical safeguards
- Access to your PHI is limited to authorized personnel only
- We conduct regular HIPAA compliance training for all staff
- You have specific rights regarding your health information
Notice of Privacy Practices
You will receive our complete Notice of Privacy Practices during your first visit, which provides detailed information about how we use and protect your health information in accordance with HIPAA requirements.
Business Associate Agreements
Any third-party vendors who may have access to your PHI are required to sign Business Associate Agreements (BAAs) ensuring they maintain the same level of protection for your health information.
Data Security
We implement comprehensive security measures to protect your information:
Technical Safeguards
- SSL encryption for all data transmissions
- Secure, encrypted data storage systems
- Regular security updates and patches
- Firewall protection and intrusion detection
- Multi-factor authentication for staff access
- Regular security audits and vulnerability assessments
Physical Safeguards
- Secure facility access controls
- Locked filing cabinets for physical records
- Security cameras and alarm systems
- Clean desk policy for all workstations
- Secure disposal of sensitive documents
Administrative Safeguards
- Designated privacy officer responsible for compliance
- Regular staff training on privacy and security
- Role-based access controls limiting data access
- Incident response procedures for data breaches
- Regular policy reviews and updates
Data Breach Notification
In the unlikely event of a data breach involving your information, we will notify you within 60 days as required by law and provide information about what happened and steps you can take to protect yourself.
Your Privacy Rights
You have several important rights regarding your personal and health information:
Access and Review
- Right to access and review your health information
- Right to request copies of your medical records
- Right to know who has accessed your information
Correction and Amendment
- Right to request corrections to inaccurate information
- Right to add amendments to your health records
- Right to update your contact information and preferences
Restriction and Limitation
- Right to request restrictions on use or disclosure
- Right to opt-out of marketing communications
- Right to request alternative communication methods
Deletion and Portability
- Right to request deletion of certain information (subject to legal requirements)
- Right to receive your information in a portable format
- Right to transfer your information to another provider
How to Exercise Your Rights
To exercise any of these rights, please contact our Privacy Officer using the contact information provided at the end of this policy. We will respond to your request within 30 days.
Third-Party Services
We may use third-party services to enhance our operations:
Payment Processing
Credit card transactions are processed through secure, PCI-compliant payment processors. We do not store your complete credit card information on our servers.
Email Communications
We may use email service providers to send appointment reminders and communications. These providers are bound by confidentiality agreements and privacy policies.
Social Media
Our website may include social media features. These features may collect information about your visit and are governed by the privacy policies of the respective social media platforms.
External Links
Our website may contain links to external sites. We are not responsible for the privacy practices of these external sites and encourage you to review their privacy policies.
Children's Privacy
We provide services to children and adolescents with appropriate parental consent. When treating minors:
- We obtain proper parental consent before collecting any information
- Parents have the right to review their child's information
- We limit collection to information necessary for treatment
- We comply with all applicable laws regarding minor privacy
- Special protections apply to sensitive health information
Changes to This Privacy Policy
We may update this Privacy Policy periodically to reflect changes in our practices, technology, or legal requirements. When we make significant changes:
- We will update the "Last Updated" date at the top of this policy
- We will notify you via email or prominent website notice
- We will provide 30 days advance notice for material changes
- Your continued use of our services constitutes acceptance of changes
Contact Information
If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact us:
Privacy Officer
Contact Methods
Mailing Address
CC Brain & Body Wellness
Attn: Privacy Officer
123 Wellness Way
Denver, CO 80202
Response Time
We will respond to your privacy-related inquiries within 30 days. For urgent matters, please call us directly at (303) 555-1234.
State-Specific Privacy Rights
California Residents (CCPA)
If you are a California resident, you have additional rights under the California Consumer Privacy Act:
- Right to know what personal information we collect and how it's used
- Right to delete personal information (subject to exceptions)
- Right to opt-out of the sale of personal information (we do not sell information)
- Right to non-discrimination for exercising your privacy rights
Other States
Residents of other states may have additional privacy rights under their state laws. Please contact us to learn about rights specific to your state.