Privacy Policy & Notice of Privacy Practices

1. Introduction

The Well—Whole Person Care PLLC ("we," "us," or "our") is committed to protecting your personal health information and privacy. This Privacy Policy describes how we collect, use, disclose, and safeguard your Personal Information and Protected Health Information (PHI) in accordance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the Texas Medical Records Privacy Act (TMRPA) (Tex. Health & Safety Code Ch. 181), and applicable federal and state privacy laws.

By using our services, accessing our website at https://thewelltexas.com, or communicating with us, you acknowledge the terms described in this Policy.

2. Protected Health Information (PHI) & Your Privacy

As a licensed healthcare provider in Texas, we are legally required to maintain the privacy of your PHI and to provide you with notice of our legal duties and privacy practices regarding your health information.

A. How We May Use and Disclose Your PHI Without Written Authorization

We may use and disclose your PHI for the following purposes without obtaining your prior written authorization:

1. Treatment: To provide, coordinate, or manage your healthcare services among doctors, nurses, technicians, or other personnel involved in your care.

2. Payment: To bill and collect payment from you, your insurance company, or third-party payers for services rendered.

3. Healthcare Operations: To support our day-to-day clinical operations, conduct quality assessment/improvement activities, evaluate provider performance, and perform administrative functions.

4. As Required by Law: To comply with federal, state, or local laws, judicial/administrative proceedings, or subpoenas.

5. Public Health & Safety: To report public health matters (e.g., communicable disease tracking, FDA reports, child/vulnerable adult abuse or neglect reporting as required by Texas law).

6. Health Oversight Activities: For audits, investigations, inspections, and licensing activities by state agencies (e.g., Texas Medical Board, Texas Department of State Health Services).

B. Uses and Disclosures Requiring Your Written Authorization

Under Texas law and HIPAA, we must obtain your explicit written authorization prior to:

• Sale of PHI: Selling your PHI or receiving direct/indirect remuneration for disclosures (subject to statutory exceptions).

• Marketing: Using your PHI for marketing communications (except for face-to-face communications or nominal promotional gifts).

• Psychotherapy Notes: Disclosing psychotherapy notes (where applicable) except in limited treatment/legal scenarios.

• Sensitive Records: Disclosing records protected under special Texas privacy statutes (e.g., substance use disorder records under 42 CFR Part 2, genetic information, or certain mental health records).

3. Texas Medical Records Privacy Act (TMRPA) Disclosures

In accordance with Texas Health & Safety Code Chapter 181:

• Electronic Disclosures: If we disclose or transfer your PHI electronically for reasons other than treatment, payment, or healthcare operations (or as required by law), Texas law requires us to provide you with notice and obtain written authorization.

• TMRPA Training: All employees and workforce members are trained on TMRPA requirements regarding the handling and protection of your health data.

• Breach Notification: In the event of an unauthorized access, acquisition, use, or disclosure of your unencrypted PHI, we will notify you in writing without unreasonable delay and within state and federal statutory timeframes (including notifying the Texas Attorney General if required).

4. Website Data Collection & Digital Privacy (TDPSA)

When you interact with our website or digital patient portal, we may collect non-PHI Personal Data governed by general privacy rules and the Texas Data Privacy and Security Act (TDPSA):

Data We Collect Automatically and Voluntarily

• Personal Identifiers: Name, email address, phone number, mailing address, date of birth (when submitted via online forms).

• Technical Data: IP address, browser type, device information, operating system, and website usage statistics via cookies or web beacons.

• Communication Preferences: Marketing opt-ins, appointment request details.

Your Consumer Privacy Rights under Texas Law

Depending on your relationship with us and applicable law, you have the right to:

1. Confirm and Access: Confirm whether we are processing your personal data and request access to it.

2. Correct: Correct inaccuracies in your personal data.

3. Delete: Request the deletion of personal data provided by or obtained about you.

4. Opt-Out: Opt out of the processing of personal data for targeted advertising, the sale of personal data, or profiling.

Note: Data covered under HIPAA/PHI is generally exempt from the scope of the TDPSA, as HIPAA standards apply to your health records.

5. Patient Rights Regarding Health Information

You have the following rights regarding the PHI we maintain about you:

• Right to Inspect and Copy: You have the right to inspect and obtain a copy (in physical or electronic format) of your medical records. Request must be made in writing to our Privacy Officer. Under Texas law, fees for providing copies will comply with established statutory limits.

• Right to Amend: If you feel your PHI is incorrect or incomplete, you may request an amendment in writing. We reserve the right to deny requests under specific statutory conditions.

• Right to an Accounting of Disclosures: You may request a list of certain disclosures of your PHI made by us for purposes other than treatment, payment, healthcare operations, or pursuant to your authorization.

• Right to Request Restrictions: You may request restrictions on how we use/disclose your PHI for treatment, payment, or operations. While we are not required to agree in all cases, we must agree if you request that we not disclose PHI to a health plan for payment/operations purposes for services paid out-of-pocket in full.

• Right to Confidential Communications: You may request that we communicate with you via alternative means or locations (e.g., calling a specific phone number or emailing an alternate address).

6. Use of Artificial Intelligence (AI) Disclosure

We want you to know clearly and up front that we use artificial intelligence (AI) and automated tools as part of our Service. This disclosure is provided to you at or before the time you interact with these tools.

What the AI does

We use AI-assisted software to help organize and interpret the health information you provide — such as your assessment answers, intake forms, and any lab results you choose to upload — and to help generate written reports, summaries, and educational materials. The AI helps surface patterns in your information so that your provider can review them more efficiently.

A licensed human is always responsible

AI does not make clinical decisions and does not replace your provider. All AI-generated information is reviewed by a licensed healthcare professional, who retains full responsibility for any clinical judgment, recommendation, or decision relating to your care. You may ask to speak with a human at any time, and you may request that a human review any AI-generated content about you.

AI is not a diagnosis

Reports and scores generated with the help of AI are informational and are intended to support — not substitute for — the professional judgment of your licensed provider. They are not a diagnosis on their own.

Your choices

• You may ask, at any time, whether you are interacting with AI or with a human.

• You may request that a human review any report, score, or communication generated with AI assistance.

• You may decline AI-assisted processing; tell us and we will discuss available alternatives.

Questions about our use of AI can be sent to [email protected].

7. We Do Not Sell Your Data

We do not sell, trade, or transfer your personally identifiable information to outside parties for marketing or promotional purposes. Your information will not be sold, exchanged, or given to any other company for any reason without your consent, except as needed to deliver the product or service you requested.

8. Limited Sharing with Service Providers

We share your information only with trusted third parties who help us operate our business, and only so they can perform their function. These providers agree to keep your information confidential. They include:

• Payment processors (such as Stripe, PayPal, and Intuit) — solely to process your payments.

• Email service providers — solely to send communications you have opted into.

• Website and application hosting services — solely to host the Service and its content.

• SMS message aggregators and providers — solely to deliver text messages you have opted into receiving.

• Course and content delivery platforms — solely to deliver digital content you have purchased.

• Scheduling tools — solely to schedule the sessions you have enrolled in.

• Scalerize CRM — for customer relationship management and the communications described in this policy.

• AI processing providers — solely to help generate the reports and materials described in the AI Disclosure section, under confidentiality obligations.

9. Retention, Security, and Breach Notification

We retain your Personal Data only as long as necessary for the purposes described here and to meet legal obligations. We use reasonable safeguards to protect your information, though no method of transmission over the internet is completely secure.

If a breach affecting your personal or health information occurs, we will notify you and any applicable regulators as required by law (including, where applicable, the HIPAA Breach Notification Rule and the FTC Health Breach Notification Rule).

10. Children’s Privacy

The Service is not directed to anyone under 18, and we do not knowingly collect information from anyone under 18. If you believe a minor has provided us information, contact us and we will delete it.

11. Complaints & Contact Information

If you believe your privacy rights have been violated, you may file a complaint with us or with the federal or state government. We will not retaliate against you for filing a complaint.

• To File a Complaint with Us:

Contact our Privacy Officer at [email protected] or 210-286-0637, or send written mail to:

The Well—Whole Person Care

Attn: Privacy Officer

28114 George Obrien San Antonio, TX 78260-1459

• To File a Complaint with the U.S. Department of Health and Human Services (HHS):

Office for Civil Rights (OCR)

Website: www.hhs.gov/ocr/privacy/hipaa/complaints/

• To File a Complaint with the Texas Attorney General:

Office of the Attorney General of Texas

Consumer Protection Division / Medical Records Privacy Complaint

Website: www.texasattorneygeneral.gov

12. Changes to This Policy

We reserve the right to revise or modify this Privacy Policy and Notice of Privacy Practices at any time. Any changes will apply to all PHI and personal data we maintain. Revised policies will be posted on our website and made available at our practice office upon request.