★ This practice is governed by HIPAA — the Health Insurance Portability and Accountability Act of 1996
CONTENTS
- Protected Health Information (HIPAA Notice)
- Notice of Privacy Practices
- Information We Collect
- How We Use Your Information
- When We May Disclose Information
- Website & Online Information
- Your Rights Under HIPAA
- Minors
- Security Safeguards
- Changes to This Policy
- Contact Our Privacy Officer
1. Protected Health Information (HIPAA Notice)
Chillax Om Foundation, Inc. and Chillax Om Natural Health & Longevity Center (collectively, “we,” “us,” or “the Practice”) are committed to protecting the privacy of your health information. As a healthcare provider operating under the supervision of a Doctor of Acupuncture and Chinese Medicine (DACM) and a Licensed Acupuncturist (LAc), we are a Covered Entity under the Health Insurance Portability and Accountability Act (HIPAA), 45 C.F.R. Parts 160 and 164.
This Privacy Policy, together with our Notice of Privacy Practices (NPP), explains how we handle your Protected Health Information (PHI). By using our services or website, you acknowledge and agree to the terms described herein.
Important: This Privacy Policy is not a substitute for our full HIPAA Notice of Privacy Practices, which you will receive at your first visit or upon request. The NPP describes your legal rights and our legal duties in greater detail.
2. Notice of Privacy Practices Summary
Federal law requires us to maintain the privacy of your PHI, to provide you with notice of our legal duties and privacy practices, and to notify you following a breach of unsecured PHI. We are required by law to follow the terms of this policy currently in effect.
Our Responsibilities
- Maintain the privacy and security of your PHI
- Provide you a copy of this Notice of Privacy Practices upon request
- Notify you in the event of a breach of your unsecured PHI
- Follow the terms of the privacy practices described in this notice
- Not use or disclose your PHI without your authorization, except as described in this notice
3. Information We Collect
Clinical & Health Information
- Name, date of birth, address, phone number, and email address
- Medical history, current health conditions, and symptoms
- Treatment records, acupuncture points, and clinical notes
- Medications, supplements, and allergies
- Mental health information, including stress, anxiety, PTSD, and trauma history
- Insurance information (if applicable)
- Emergency contact information
Website & Digital Information
- Contact form submissions (name, email, phone, message)
- Appointment scheduling information
- IP address, browser type, and pages visited (via standard web analytics)
- Information submitted through Google Ads landing pages
Donation & Volunteer Information
- Donor name, contact information, and contribution amount
- Payment information processed through our secure third-party payment processor
- Volunteer contact and scheduling information
4. How We Use Your Information
We use your Protected Health Information for Treatment, Payment, and Healthcare Operations (TPO) as permitted under HIPAA without requiring your separate authorization:
Treatment To provide, coordinate, and manage your acupuncture, breathwork, mindfulness, yoga, and other integrative health services, including communicating with other treating healthcare providers as appropriate.
Payment To process payments, sliding-scale fee determinations, and to support our free Wellness Hour program funded by charitable contributions. We do not bill insurance as a standard practice; if you authorize us to do so, additional uses may apply.
Healthcare Operations To operate the Foundation, train staff, conduct quality improvement, and fulfill our nonprofit mission of delivering free and low-cost care to Veterans, First Responders, firefighters, teachers, seniors, and community members in need.
Communications To send appointment reminders, health education materials, and Foundation newsletters. You may opt out of non-clinical communications at any time.
5. When We May Disclose Information
We will not sell, rent, or share your PHI for marketing purposes. We may disclose your information in the following circumstances:
- With your written authorization — for purposes beyond treatment, payment, and operations
- As required by law — to comply with federal, state, or local legal requirements, court orders, or public health reporting obligations
- To avert a serious threat — when necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public
- Business Associates — to vendors and service providers (e.g., scheduling software, payment processors, electronic health records) who have signed a HIPAA Business Associate Agreement with us
- Aggregate, de-identified data — we may share non-identifiable, statistical data with grant funders (such as Google for Nonprofits) and community health reports. This data cannot be used to identify you.
- Mental health & substance use records receive heightened protection under federal and Colorado law. We apply additional safeguards before disclosing any sensitive mental health information, including trauma, PTSD, and behavioral health records.
6. Website & Online Information
Our website at ChillaxOm.com collects limited information to facilitate appointment scheduling, donations, and pop-up clinic requests.
Cookies & Analytics We use standard web analytics (such as Google Analytics) to understand how visitors use our site. This data is aggregated and does not identify individual users. You may opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on.
Google Ads We participate in Google’s Ad Grants for Nonprofits program. Google may use cookies to serve ads based on prior visits to our website or related sites. You may opt out of personalized advertising at Google Ads Settings.
Contact Forms Information submitted via contact or intake forms is used solely to respond to your inquiry or schedule services. We do not share this information with third parties for marketing purposes.
Third-Party Links Our website may contain links to third-party sites. We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies.
7. Your Rights Under HIPAA
You have the following rights regarding your Protected Health Information:
- Right to Access — Request a copy of your health records
- Right to Amend — Request corrections to inaccurate or incomplete records
- Right to an Accounting of Disclosures — Request a list of disclosures we have made of your PHI
- Right to Request Restrictions — Request limits on how we use or disclose your PHI (we will consider all requests but are not always required to agree)
- Right to Confidential Communications — Request that we communicate with you in a specific way or at a specific location
- Right to a Copy of This Notice — Request a paper copy of this Notice at any time
- Right to Opt Out of Fundraising — Opt out of receiving fundraising communications from the Foundation
To exercise any of these rights, please contact our Privacy Officer using the information in Section 11. We will respond within 30 days as required by law. We will not retaliate against you for exercising your rights.
Colorado Residents Colorado residents may have additional rights under the Colorado Consumer Protection Act and state health privacy laws. Please contact us to learn more about your state-specific rights.
8. Minors
Our services are available to individuals under the age of 18 with parental or guardian consent. We do not knowingly collect personal information from minors through our website without verified parental consent. If you believe a minor’s information has been provided to us without appropriate consent, please contact our Privacy Officer immediately.
Colorado law grants certain adolescents the right to consent to specific health services independently. We comply with all applicable state laws governing the privacy of minors’ health information.
9. Security Safeguards
We implement administrative, physical, and technical safeguards required by the HIPAA Security Rule to protect electronic PHI (ePHI), including:
- Encrypted electronic health records and communications
- Password-protected systems with access controls limited to authorized personnel
- Secure destruction of paper records containing PHI
- Staff training on privacy and security practices
- Business Associate Agreements with all third-party vendors who handle PHI
In the event of a breach of unsecured PHI, we will notify affected individuals as required by the HIPAA Breach Notification Rule (45 C.F.R. §§ 164.400–414).
10. Changes to This Policy
We reserve the right to change this Privacy Policy and our privacy practices at any time. Material changes will be posted on our website and, when required by law, communicated directly to affected patients. The effective date at the top of this page reflects the most recent revision.
Continued use of our services after the effective date of a revised policy constitutes acceptance of the updated terms.
11. Contact Our Privacy Officer
If you have questions about this policy, wish to exercise your rights, or have a privacy concern, please contact:
Privacy Officer — Chillax Om Foundation Provider: Dr. Andrea Renee, DACM, LAc. Organization: Chillax Om Foundation, Inc. — 501(c)(3) Nonprofit · EIN 87-1829729 Address: 4600 Plettner Ln., #1C, Evergreen, CO 80439 Phone/Text: 310-461-7494 Website: ChillaxOm.com/wellness-hour
You also have the right to file a complaint with the U.S. Department of Health & Human Services Office for Civil Rights at hhs.gov/hipaa/filing-a-complaint or 1-800-368-1019. Filing a complaint will not affect your ability to receive care from us.
Effective Date: May 19, 2019 | Chillax Om Foundation, Inc. | EIN 87-1829729 | 501(c)(3) Nonprofit | Evergreen, CO 80439
and Andrea Renee Acupuncture Mind-Body Medicine Inc. a Professional Corporation, D/B/A Chillax Om, EIN 84-1861779, Evergreen, CO 80439