Privacy Policy

1. Who we are and what this policy covers

Central Florida Wellness, LLC ("Central Florida Wellness," "we," "us," or "our") owns and operates Medi-Weightloss® clinics in North Carolina and Florida as an independent franchisee of Medi-Weightloss Franchising USA, LLC. Each clinic is independently owned and operated by Central Florida Wellness, LLC.

This Privacy Policy describes how we collect, use, disclose, retain and protect personal information when you visit our websites (including medicfw.com and its subdomains), complete patient forms we send you, enroll in a subscription or membership, or communicate with your clinic by text message, phone or email (together, our "Services"). It does not apply to websites or services operated by Medi-Weightloss Franchising USA, LLC or by other franchisees, which have their own policies.

By using our Services, you acknowledge that you have read this Privacy Policy. If you do not agree with it, please do not use our websites or forms, and contact your clinic to discuss other ways to receive care.

2. Your health information and our Notice of Privacy Practices

We are a covered entity under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations ("HIPAA"). Health information that identifies you and relates to your care or payment for your care is "protected health information" ("PHI"). We use and disclose PHI only as permitted or required by HIPAA and applicable state law, as described in our Notice of Privacy Practices, which you receive at your first visit and may request from any of our clinics at any time.

If this Privacy Policy and our Notice of Privacy Practices conflict as to PHI, the Notice of Privacy Practices controls. Nothing in this Privacy Policy limits any right you have under HIPAA or state law.

3. Information we collect

Depending on how you interact with us, we collect the following categories of information:

• Identifiers and contact information: name, date of birth, postal address, email address, mobile and other phone numbers, and your patient chart number.
• Health information: medical history, medications, measurements such as weight, program and visit information, and other information you provide on your forms or that your care team records.
• Insurance and identity documents: images of your insurance card or driver's license when you upload them.
• Payment information: billing name and address and the last four digits and expiration date of your card. Full card numbers are entered into our payment processor's secure fields and are not received or stored by our systems.
• Signatures and consent records: your electronic signature and initials, the date and time you signed, and the IP address and browser information used, which we keep as evidence of your consent.
• Communications: the content of text messages you send to and receive from your clinic, the date, time and duration of phone calls with your clinic, voicemails you leave, emails, and your communication preferences, consents and opt-outs.
• Technical information: IP address, browser and device type, and the date and time of your visit, recorded in security logs when you use our websites.

4. Where we get information

• From you, when you complete forms, enroll, upload documents, or contact us.
• From your care team, who record information during your visits.
• From our electronic health record and practice management systems, and from our payment processor about the status of your payments.
• From your phone carrier and our phone and text messaging provider, about the delivery of messages and calls.

5. How we use information

We use personal information to:

• provide, coordinate and document your care;
• schedule appointments and send appointment reminders;
• send you forms to complete and keep signed copies in your record;
• enroll you in and administer your subscription or membership, including billing, payments and account notices;
• respond to your questions and communicate with you about your care and your account;
• verify your identity and protect against fraud and unauthorized access;
• operate, secure, maintain and improve our Services and clinic operations;
• comply with legal, regulatory, accreditation and record-keeping obligations; and
• establish, exercise or defend legal claims.

We do not use your personal information for targeted advertising, and we do not send marketing text messages.

6. How we share information

We do not sell your personal information, and we do not share it with third parties for their own marketing or advertising. We disclose personal information only as follows:

• Service providers. Companies that perform services for us, such as cloud hosting and data storage, electronic health records, phone and text messaging, email, and payment processing, receive information only as needed to perform those services, under written contracts that require them to protect it and prohibit other uses. Service providers that handle PHI do so under a HIPAA business associate agreement.
• Medi-Weightloss Franchising USA, LLC. Our franchisor may receive information as permitted by HIPAA (for example, for quality, compliance and clinical oversight) or as you authorize in your consent forms.
• Your care and payment. Other health care providers, pharmacies, laboratories and health plans, as needed for your treatment and payment and as permitted by HIPAA.
• People you authorize. Anyone you designate, such as a family member or personal representative, and anyone else with your written authorization.
• Legal requirements and safety. Government authorities, courts and others when required by law, subpoena or court order; to respond to public health or health oversight activities; and when we believe in good faith that disclosure is necessary to protect the rights, property or safety of you, our patients, our staff or others.
• Business transfers. A buyer, successor or other party in connection with a merger, acquisition, financing, or sale of all or part of our business or clinics, subject to confidentiality obligations and applicable law, including HIPAA.

7. Text messages

Text messages from your clinic are optional. We text you only if you opt in, by checking the text message consent box on your intake or enrollment form (see how to opt in), or in reply to a message you send to your clinic. Consent to receive text messages is not a condition of any purchase or of receiving care. If you opt in, your clinic may text you at the mobile number you provide about:

• appointment reminders and scheduling messages;
• links to forms you need to complete;
• account notices about your subscription or membership, such as payment and card updates; and
• replies to messages you send to your clinic.

We do not send marketing messages, and our texts never include your diagnoses, lab results, or medication details.

• Message frequency varies.
• Message and data rates may apply.
• Reply STOP to any message to stop receiving texts. We will send one message confirming that you have opted out, and then no more.
• Reply HELP for help, or call your clinic.
• Mobile carriers are not liable for delayed or undelivered messages.
• Full SMS terms: https://terms.medicfw.com

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties.

Text messages are not a secure channel. Please do not text sensitive health information to your clinic; call or speak with your care team instead.

8. Phone calls, voicemail and email

When you call or are called by your clinic, we keep a record of the call (such as the date, time, duration and the staff member involved) and any voicemail you leave, as part of your patient record. Emails we send you about your care or account are service messages; we do not send marketing email. Email may not be secure, so please do not email sensitive health information.

9. Cookies and online tracking

Our websites use only the cookies and similar technologies that are strictly necessary for them to work, such as keeping you signed in to a form you are completing and protecting against misuse. We do not use advertising cookies, third-party analytics, tracking pixels, or session-replay tools, and we do not track you across other websites. Because we do not engage in cross-site tracking, we do not change our practices in response to "Do Not Track" browser signals.

10. How we protect information

We maintain administrative, technical and physical safeguards designed to protect personal information, including encryption in transit and at rest, role-based access limited to workforce members who need the information for their jobs, logging of access to patient records, and form links that expire after 24 hours and require your date of birth to open. Our workforce members are bound by confidentiality obligations.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a breach of your information occurs, we will notify you and the appropriate authorities as required by HIPAA and applicable state law.

11. How long we keep information

We keep personal information for as long as needed for the purposes described in this policy, including to provide care and administer your account, and for as long as required by law. Medical records are kept for at least the periods required by North Carolina, Florida and federal law, and consent and signature records are kept for as long as the records they relate to. When information is no longer needed, we securely delete or de-identify it.

12. Your rights and choices

• Health information. Under HIPAA you may request access to and a copy of your health information, request corrections, request an accounting of certain disclosures, request restrictions, and request confidential communications, as described in our Notice of Privacy Practices.
• Text messages. Opt out at any time by replying STOP to any message, or by asking your clinic.
• Contact details. Ask your clinic to update your phone number, email address or mailing address at any time.
• Other requests. To ask about the personal information we hold about you, contact us as described below. We will respond as required by applicable law, and we may need to verify your identity first. We will not discriminate against you for exercising any of these rights.

13. Children

Our websites are not directed to children under 13, and we do not knowingly collect personal information online from children under 13. A patient under 18 completes our forms with a parent or legal guardian, who signs on the patient's behalf. If you believe a child under 13 has given us information online without a parent's involvement, contact us and we will delete it as permitted by law.

14. Other websites

Our Services may link to websites operated by others, such as our payment processor or Medi-Weightloss Franchising USA, LLC. This policy does not apply to those websites, and we are not responsible for their privacy practices. Please review their privacy policies.

15. Changes to this policy

We may update this Privacy Policy from time to time. The "last updated" date at the top shows when it last changed. If we make a material change, we will post the updated policy here before it takes effect and, where required by law, notify you or ask for your consent.

16. Contact us

Questions about this Privacy Policy or your information, or to make a request:

To file a complaint about the privacy of your health information, see our Notice of Privacy Practices. You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights. We will not retaliate against you for filing a complaint.