Notice of Privacy Practices

Effective date: October 27, 2026

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

About this notice

This Notice of Privacy Practices applies to the telehealth services provided in Florida under the DrWeightPR name by DRWEIGHT LLC. In this notice, “the Practice,” “we,” “us,” “our,” “DRWEIGHT LLC,” and “DrWeightPR” refer to DRWEIGHT LLC and its healthcare professionals, employees, contractors, and authorized staff, as applicable.

Your rights

When it comes to your health information, you have certain rights. This section explains your rights and some of our responsibilities.

1. Get a copy of your medical record

You can ask to see or get an electronic or paper copy of your medical record and other health information we have about you, such as clinical notes, diagnoses, medication lists, laboratory results, orders, prescriptions, treatment plans, documents you sent us, telemedicine records, and billing information related to our services. We will usually provide a copy or a summary of your information within the time required by law. We may charge a reasonable, cost-based fee permitted by law for copying, preparing, or sending the information. In certain limited circumstances, the law allows us to deny access to some information. When that happens, we will tell you in writing why and whether you can ask for a review.

2. Ask us to correct your record

You can ask us to correct or amend health information you think is incorrect or incomplete. Your request must be in writing, identify the information you want corrected, and explain why you think it is incorrect or incomplete.

We may deny your request when:

• We did not create the information, with certain exceptions.
• The information is not part of the record available for inspection.
• The information is accurate and complete.
• The law allows it to be excluded from the right of access or amendment.

If we deny your request, we will tell you in writing, and you may submit a statement of disagreement.

3. Request confidential communications

You can ask us to contact you in a specific way or at a different address, for example by calling only a certain number, sending mail to another address, not leaving detailed messages, or using email instead of the phone. We will agree to reasonable requests. You are responsible for keeping your contact information up to date.

4. Ask us to limit what we use or share

You can ask us to limit how we use or share your health information for treatment, payment, healthcare operations, or communications with family members or others involved in your care. We are not required to agree to every request. However, if you pay for a service in full out of pocket and ask us not to share information about that service with your health plan for payment or plan operations, we will generally agree, unless the law requires the disclosure. You must make the request before the information is sent to the health plan.

5. Get a list of certain disclosures

You can ask for a list (an accounting) of certain times we disclosed your health information in the six years before the date of your request. The list generally will not include disclosures for treatment, payment, or healthcare operations, disclosures made to you, disclosures you authorized, and certain other disclosures permitted by law. We will provide one list free of charge every twelve months. We may charge a reasonable fee for additional requests in the same period, after telling you the cost and giving you the chance to withdraw or change the request.

6. Get a copy of this notice

You can ask for a paper copy of this notice at any time, even if you agreed to receive it electronically. This notice is also available on this website, through the patient portal, and by email on request.

7. Choose someone to act for you

If you have given someone medical power of attorney, or if someone is your legal guardian or holds another valid authorization, that person can exercise your rights and make certain decisions about your health information. Before they act, we will reasonably verify the representative’s identity, legal authority, and that the document is still in effect. For minors or incapacitated persons, we will apply Florida law and applicable federal law.

8. File a complaint

You can file a complaint if you believe your privacy rights have been violated. You can file it directly with DRWEIGHT LLC (see “Privacy contact” below), or with the U.S. Department of Health and Human Services Office for Civil Rights. We will not retaliate against you for filing a complaint in good faith.

Your choices

For certain health information, you can tell us your choices about what we share.

9. Family, friends, and others involved in your care

You can tell us to share information with a family member, close friend, caregiver, person responsible for paying for your care, or another person involved in your treatment. When you are present and able to make decisions, we will normally ask your permission before sharing information. If you cannot tell us your preference, for example if you are unconscious or in an emergency, we may share information if we believe it is in your best interest and the law allows it. We will only share information reasonably related to that person’s involvement in your care or payment.

10. Disaster relief

We may share limited information with disaster relief organizations to locate you, report your general condition, notify family members, or coordinate help. When reasonably possible, we will ask for your authorization or give you the chance to object.

11. Communications about your care

We may contact you to confirm appointments, send reminders, request documents, tell you a prescription was sent, coordinate follow-up care, tell you about treatment alternatives, remind you of pending laboratory tests, share operational changes, or tell you about services related to your care. We may do so by phone, email, text message, WhatsApp, patient portal, or booking platform. You can reasonably request a different method of communication.

12. Fundraising

DRWEIGHT LLC does not currently use protected health information for fundraising. If we ever carry out a permitted fundraising activity, you will have the right to ask us not to contact you again for that purpose.

13. Marketing and sale of information

We will not sell your protected health information. We will not use or share your protected health information for marketing when HIPAA requires your written authorization, except as permitted by law. General communications that do not reveal health information, such as public advertisements or social media posts, are not necessarily uses of protected health information.

14. Psychotherapy notes

If we kept psychotherapy notes protected under HIPAA, we would generally need your written authorization to use or share them, except as permitted by law. DrWeightPR does not primarily provide psychotherapy services.

15. Substance use disorder treatment records

Some records about the diagnosis, treatment, or referral for substance use disorders may have additional protection under federal law, including 42 CFR Part 2. When those protections apply, we will not use or share those records unless the law allows it, your written consent may be required, and a general authorization to release medical information may not be enough. Those records may not be used in certain civil, criminal, administrative, or legislative proceedings against you without valid consent or a court order, as applicable, and any disclosure or redisclosure is subject to the applicable federal protections. DRWEIGHT LLC does not hold itself out as a specialized substance use disorder program under 42 CFR Part 2. However, if we receive records protected by that regulation, we will handle them according to applicable law.

How we may use and share your information

We can usually use or share your health information for the following purposes without additional authorization.

16. Treatment

We can use and share your health information to provide, coordinate, or manage your care. For example, a physician may review your medical history during a visit, we may send a prescription to a pharmacy, share results with your primary care physician, consult a specialist, send an order to a laboratory, coordinate services with another professional, review treatment you received from other providers, contact a pharmacy to clarify a prescription, or document a telemedicine visit in your record. The “minimum necessary” rule generally does not limit disclosures between providers for treatment.

17. Payment

We can use and share your health information to bill, collect, or manage payment for your care. For example, to process payment for a visit, send information to a payment processor, prepare a receipt, verify a transaction, handle a refund, respond to a payment dispute, submit a claim to a health plan when appropriate and authorized, or provide information needed to determine benefits or eligibility. Most DrWeightPR services are self-pay. That does not prevent us from using limited information to process the payment.

18. Healthcare operations

We can use and share your information to run and improve our practice, for example to evaluate service quality, train staff, review clinical documentation, conduct audits, investigate complaints, manage professional credentials, meet regulatory obligations, evaluate performance, improve processes, carry out compliance activities, consult lawyers, accountants, or other advisors, maintain technology systems, detect fraud or abuse, and carry out permitted business and administrative planning.

19. Business associates

We may share health information with vendors that perform functions or services on our behalf and need access to protected health information, such as electronic medical-record systems, telemedicine platforms, billing services, storage services, technology providers, email services, backup services, compliance consultants, lawyers, accountants, transcription services, and secure messaging providers. When HIPAA requires it, we sign a Business Associate Agreement before allowing access to protected health information. Business associates must protect the information and use it only for the authorized purposes.

20. Pharmacies and laboratories

We may share the information needed with pharmacies, electronic prescribing platforms, laboratories, imaging centers, medical equipment suppliers, and other professionals involved in your care. This may include your name, date of birth, contact information, diagnosis, medication, dose, instructions, allergies, relevant results, and the information needed to process an order.

21. Required by law

We can use or share your information when federal or Florida law requires it, for example to comply with valid orders, report certain diseases, meet regulatory obligations, respond to authorized agencies, or comply with laws on abuse or neglect, professional licensing, or public health. We will share only the information required or permitted by applicable law.

22. Public health and safety

We can share information for public health activities, such as preventing or controlling disease, reporting communicable diseases, reporting adverse reactions to medications, reporting defective products, notifying product recalls, preventing injury, reporting births or deaths when applicable, and authorized public health investigations.

23. Abuse, neglect, or domestic violence

We may share information with the appropriate authorities when the law requires reporting abuse or neglect, when there is reasonable suspicion of abuse, when there is domestic violence and the disclosure is permitted, or when it is necessary to protect a vulnerable person. We will follow the conditions and limits of applicable law.

24. Preventing a serious threat

We may share information when we believe in good faith that it is necessary to prevent or lessen a serious and imminent threat to your health or safety, or to the health or safety of another person or the public. We will share it only with people or authorities reasonably able to prevent or lessen the threat.

25. Health oversight

We may share information with authorized agencies for audits, investigations, inspections, licensing, disciplinary actions, certifications, regulatory compliance, fraud investigations, and oversight of government programs.

26. Lawsuits and administrative proceedings

We may share information in response to a valid court or administrative order, a subpoena, a discovery request, or another authorized legal process. Before doing so, we will verify that the conditions required by HIPAA and other applicable law are met. Some types of information may require additional protections.

27. Law enforcement

We may share information with law enforcement officials in the limited circumstances permitted by law, such as complying with a court order, locating a missing person, identifying a victim, investigating certain crimes, reporting a suspicious death, emergencies, or protecting against a serious threat. We will not hand over complete records just because someone says they represent an authority. We will verify the authority and the applicable legal requirements before responding.

28. Coroners, medical examiners, and funeral directors

We may share information with coroners, pathologists, medical examiners, and funeral directors, limited to what they need to carry out their legal duties.

29. Organ and tissue donation

We may share information with authorized organ procurement organizations and entities involved in donation, transplantation, or organ and tissue banking.

30. Workers’ compensation

We may share information to comply with workers’ compensation laws, workplace accident laws, or similar programs, limited to what the law permits or requires.

31. Specialized government functions

We may share information in certain circumstances related to the armed forces, national security, protective services for the President, authorized intelligence activities, correctional institutions, law enforcement custody, and certain government evaluations.

32. Research

We may use or share information for research only when you have signed an authorization, an Institutional Review Board has approved a valid waiver, the information has been de-identified, the law allows limited access to prepare research, and the other applicable protections are met. Taking part in research will not be a condition of receiving care, except in very specific legal circumstances that would be explained to you separately.

33. De-identified information

We may remove identifiers from your health information to create de-identified information, which we may use to analyze trends, evaluate quality, improve services, prepare statistics, and for education, permitted research, and operational planning. De-identified information should not reasonably identify you.

34. Deceased persons

Health information remains protected after death for the period set by law. We may share it with the authorized personal representative, with family members who were involved in the person’s care or payment before death when appropriate, for medical examiner functions, for organ donation, or when required by law. We will respect any preference the patient expressed, when known and applicable.

Uses that generally require your authorization

35. Written authorization

For uses or disclosures not described in this notice, we will generally need your written authorization. A valid authorization must state what information may be shared, who may share it, who may receive it, the purpose, an expiration date or event, your signature, and the date you signed.

36. Revoking an authorization

You can revoke an authorization in writing at any time. A revocation applies from then on. It does not affect disclosures already made in reliance on the authorization, does not require us to retrieve information already shared, and does not prevent uses or disclosures the law allows without authorization.

Our responsibilities

37. Protecting your information

The law requires us to:

• Maintain the privacy and security of your protected health information.
• Follow this notice while it is in effect.
• Give you a copy of this notice.
• Notify you if a breach of unsecured information occurs that may have compromised your privacy or security.
• Honor the valid requests we agree to.
• Not use or share your information except as described here or permitted by law.

38. Minimum necessary

When applicable, we limit the use, disclosure, or request of health information to the minimum reasonably necessary for the purpose. This requirement generally does not apply to disclosures for treatment, disclosures to you, disclosures you authorized, disclosures required by law, or disclosures to the Department of Health and Human Services for HIPAA compliance.

39. Electronic security

We apply reasonable administrative, physical, and technical safeguards to protect electronic health information, such as access controls, passwords, authentication, training, backups, encryption when appropriate, security policies, monitoring, risk assessments, vendor agreements, and incident response procedures. No electronic system can guarantee absolute security.

40. Breach notification

If a breach of unsecured protected health information occurs, we will assess it as the law requires. When notification is required, we will notify you without unreasonable delay and within the applicable legal deadline. The notice may include a general description of the incident, the type of information involved, steps you can take, what we are doing, and contact information.

Changes to this notice

41. Changes

We can change this notice, and the new version will apply to all health information we hold, including information created or received before the change. When we make a material change, we will update the effective date, post the new version on this website, keep copies available at the Practice, provide a copy on request, and meet any additional notification requirement. The current version is always available on this website or on request.

Privacy contact

For questions, requests, access to records, corrections, restrictions, or complaints, contact the privacy contact of DRWEIGHT LLC by WhatsApp, using the link at the bottom of every page of this website. Do not send highly sensitive medical information through ordinary email or messaging without first confirming a secure method.