Notice of Privacy Practices

About this notice

Integrative & Functional Wellness Center (IFWC) is a DBA of Moreira & Angeli LLC, 7635 Ashley Park Court, Suite 503 F-G, Orlando, FL 32835. Phone: (689) 280-3705. Email: contact@jifwc.com. Website: jifwc.com.

Florida massage therapy licenses: MA103089 (practitioner) and MM44640 (establishment). Version 1.0.

In an emergency, call 911. For a mental health crisis, call or text 988 (Suicide & Crisis Lifeline). Our website, forms, email, and messaging channels are not monitored for emergencies.

1. Who follows this notice

This notice applies to Integrative & Functional Wellness Center and to all practitioners, employees, contractors, and staff of Moreira & Angeli LLC who provide services at our location or remotely. In this notice, "we," "us," and "our" refer to IFWC.

We protect your individually identifiable health information, called "protected health information" or "PHI." We follow the standards of the federal Health Insurance Portability and Accountability Act (HIPAA) and the HITECH Act, and we comply with Florida law.

2. Our duties

We commit to:

• maintain the privacy and security of your PHI;
• give you this notice of our legal duties and privacy practices with respect to your PHI;
• notify you if a breach occurs that may have compromised the privacy or security of your unsecured PHI;
• follow the terms of the notice currently in effect.

We will not use or share your information other than as described in this notice unless you tell us we can in writing.

3. Information this notice covers

This notice covers the health information we create or receive about you, including:

• intake forms, health history, and the goals you share with us;
• wellness and symptom questionnaires, including the MSQ questionnaire completed at app.jifwc.com;
• session notes, assessments, and functional evaluations;
• results of tests you choose to do, including tests processed by outside laboratories;
• wellness reports and care plans we prepare for you;
• appointment, billing, payment, and insurance information, including superbills and claims;
• messages you exchange with us about your care.

4. How we may use and disclose your PHI without your written authorization

Treatment. We use your PHI to assess you, plan and provide your sessions, and follow your progress. For example, your practitioner reviews your intake and prior session notes before each visit. With your permission, except in an emergency, we may share information with your physician or other providers involved in your care, for example when you were referred to us or when we suggest that you see another professional. When a service requires a physician's prescription or referral, we may communicate with the prescribing physician about that service.

Payment. We use and disclose your PHI to bill and receive payment for our services. Our services are self-pay (cash pay), and we do not submit claims to health plans. If you ask, we give you a superbill so that you can seek reimbursement from your own plan. The superbill lists the codes for the services we provided and, when available, the diagnosis code given by the physician or other licensed provider who referred you; we do not assign diagnoses. If your plan contacts us to review your reimbursement request, we may share with it the minimum information needed. Our payment processor receives only what is needed to process your payment, and we do not include health details in payment descriptions.

Health care operations. We use and disclose your PHI to run our practice, improve our care, and contact you when necessary. For example, we use your information to schedule appointments, send reminders and confirmations, review the quality of our work, train our team, meet contract and licensing requirements, and manage our business.

Service providers. We work with service providers, such as scheduling, hosting, database, email, messaging, payment, video, and technology vendors, that may receive your information to help us run the clinic. We choose these providers carefully and limit what we share with them to what is needed for the service they provide. Some of these providers, such as our email provider, have signed a Business Associate Agreement with us.

Artificial intelligence. We may use artificial intelligence tools to support our work, for example to answer initial questions on our messaging channels, to organize session notes, and to help draft reports. We use an AI tool with your health information only if its provider has signed a Business Associate Agreement with us. A member of our team reviews clinical notes and reports before they are finalized. We record a session only with your consent, and you may decline without any effect on your care. If a session is recorded, the recording is used to help prepare your notes and is protected as part of your health information.

Appointment reminders and health-related services. We may contact you to remind you of appointments or to tell you about treatment options or health-related services we offer that may interest you.

Family members and others involved in your care. We may share information with a family member, caregiver, or other person you identify, if you agree, or if you bring that person to your session and do not object. If you are not able to agree (for example, in an emergency), we may share information if we believe it is in your best interest.

Uses and disclosures required or permitted by law. We may use or disclose your PHI:

• when required by federal, state, or local law;
• for public health activities, such as preventing or controlling disease or reporting adverse reactions;
• to report suspected abuse, neglect, or domestic violence, as required or permitted by law;
• for health oversight activities, such as audits, investigations, and licensing (for example, by the Florida Department of Health);
• in response to a court order, subpoena, or other lawful process;
• to law enforcement, in limited circumstances allowed by law;
• to coroners, medical examiners, and funeral directors;
• for organ and tissue donation;
• for research approved under privacy protections required by law;
• to prevent or lessen a serious and imminent threat to the health or safety of a person or the public;
• for specialized government functions, such as military, national security, and protective services;
• for workers' compensation claims, as authorized by law.

Business transfer. If our practice is sold or merged, your records may be transferred to the new owner, who must continue to protect them.

Florida law. When Florida law gives your information more protection than HIPAA, we follow Florida law. For example, Florida law limits the sharing of records by licensed health care practitioners without your written authorization and gives special protection to information about HIV testing, mental health services, and substance use treatment.

5. Uses and disclosures that require your written authorization

We will use or disclose your PHI for the following purposes only with your written authorization:

• marketing communications, except face-to-face communications and promotional gifts of nominal value, as allowed by HIPAA;
• photographs, video, voice, testimonials, or case stories used on our website, social media, or any promotional material (this authorization is separate and optional, and saying no never affects your care);
• sale of PHI (we do not sell your PHI);
• psychotherapy notes, if any exist;
• research using identifiable information, unless an exception allowed by law applies;
• any other use or disclosure not described in this notice.

You may revoke an authorization at any time by writing to us. Revocation stops future uses and disclosures, but it does not affect actions we already took while the authorization was valid.

Fundraising. We do not use your PHI for fundraising.

6. How we communicate with you

We may contact you by phone, text message, email, or video call. Email and text messages are not fully secure, and there is some risk that information could be read by someone else. We may send reports and results by email, and we tell you about this risk. You have the right to ask us to use a different channel, and we will accommodate reasonable requests (see section 7). Text messages are sent only with your separate opt-in, and you can reply STOP at any time.

We do not use social media or messaging apps (such as Facebook Messenger, Instagram, or WhatsApp) to send your session notes, results, or reports. These apps are run by other companies under their own privacy policies. If you contact us through them, please do not share health details there, and we will move the conversation to another channel when health details are needed.

7. Your rights regarding your PHI

You have the right to:

• inspect and get a copy of your PHI, on paper or electronically, including an electronic copy of records we keep electronically; we will respond within 30 days of your request (the law allows one 30 day extension, and we will tell you if we need it), and we may charge a reasonable, cost-based fee;
• ask us to amend PHI you believe is incorrect or incomplete; we will respond within 60 days, and if we deny your request, we will explain why in writing and you may file a statement of disagreement;
• ask us to restrict how we use or disclose your PHI for treatment, payment, or operations; we are not required to agree, except in this case: if you pay for a service in full, out of pocket, you may ask us not to share information about that service with your health plan, and we will agree unless the law requires us to share it;
• ask for confidential communications, for example by a specific email address, phone number, or mailing address; we will not ask you why, and we will accommodate reasonable requests;
• get an accounting of disclosures, which is a list of the times we shared your PHI in the six years before your request, other than for treatment, payment, operations, and certain other disclosures (such as those you authorized); we provide one accounting per year for free and may charge a reasonable, cost-based fee for additional requests within 12 months;
• get a paper copy of this notice at any time, even if you agreed to receive it electronically;
• choose someone to act for you, such as a health care surrogate or legal guardian; we will confirm that person's authority before acting;
• be notified of a breach of your unsecured PHI.

To exercise any of these rights, contact our Privacy Officer (section 12). We may ask you to make certain requests in writing and to confirm your identity.

8. How we protect your information and where it is stored

We use administrative, technical, and physical safeguards, including access limited to team members who need it, individual logins, and encrypted connections. Our main clinical record system stores your information in the United States. No system is 100% secure.

9. How long we keep your records

We keep your health records for at least 10 years after your last service, or longer if Florida law or another applicable rule requires it. After that period, we securely destroy or de-identify them.

10. Minors

Minors receive services only with the consent and involvement of a parent or legal guardian, who may generally exercise the rights in this notice on the minor's behalf, as allowed by Florida law.

11. Clients in Brazil (LGPD)

If you are in Brazil, or receive our services from Brazil, the Brazilian General Data Protection Law (Lei 13.709/2018, LGPD) also applies. Moreira & Angeli LLC is the controller of your data. We process your health information to provide the services you request and based on your specific consent, and we keep it to meet legal obligations.

Your information is stored in the United States. This international transfer is necessary to provide the services you request from our clinic in the United States and is made with your specific consent, which you may revoke at any time (LGPD, article 33, items VIII and IX). Revoking consent does not affect records we must keep by law.

You have the rights listed in article 18 of the LGPD, including confirmation, access, correction, anonymization, portability, deletion (subject to legal retention), information about sharing, and revocation of consent. Our data protection contact is the Privacy Officer (section 12). You may also file a complaint with the Brazilian National Data Protection Authority (ANPD).

12. Questions and complaints

To ask questions about this notice, exercise your rights, or file a complaint, contact our Privacy Officer at Moreira & Angeli LLC (Integrative & Functional Wellness Center), 7635 Ashley Park Court, Suite 503 F-G, Orlando, FL 32835. Email: contact@jifwc.com. Phone: (689) 280-3705.

If you believe your privacy rights have been violated, you may file a complaint with us, as above, or with the U.S. Department of Health and Human Services, Office for Civil Rights, 200 Independence Avenue SW, Washington, D.C. 20201, phone 1-800-368-1019, or online at www.hhs.gov/ocr/complaints.

We will not retaliate against you for filing a complaint.

13. Changes to this notice

We reserve the right to change this notice. Changes will apply to all PHI we have about you, as well as information we receive in the future. The current notice will be posted at our office and on our website, will show its effective date, and will be available to you on request.

14. Other documents

This notice works together with our Privacy Policy (jifwc.com/privacy) and our Data Deletion instructions (jifwc.com/data-deletion). For health information, this notice prevails.