Privacy Policy

1. Scope and roles

This Privacy Policy applies to the Dr. Miami Clinic Weight Loss Program website and the administrative services we provide in connection with enrollment, subscription billing, care coordination, customer support, and access to independent healthcare professionals. In this policy, “Dr. Miami Clinic,” “we,” “us,” and “our” refer to the operator of these non-clinical program services.

Medical evaluation, diagnosis, prescribing, and treatment are performed by independent, licensed healthcare professionals and medical groups made available through our clinical technology partner, MD Integrations. Those clinicians exercise independent medical judgment. Their separate notices and consent forms may also apply to information they create or maintain.

2. Information we collect

Depending on how you use the program, we may collect:

• Identity and contact information: name, date of birth, sex or gender, email address, telephone number, mailing address, and account identifiers.
• Health and care-coordination information: medication selection, height, weight, body mass index, health history, current medications, allergies, symptoms, photographs, clinician communications, prescriptions, and related intake information.
• Transaction and subscription information: selected plan, purchase and renewal history, billing status, refunds, cancellations, and surgery-credit records. Payment card details are processed by Stripe; we do not receive or store the full card number.
• Device and website information: IP address, browser and device type, pages viewed, referring page, approximate location derived from IP address, cookie and advertising identifiers, and interactions with our website or advertisements.
• Communications: support requests, email and text-message preferences, and records of communications with us or participating providers.

We collect information directly from you and, as needed to operate the program, from participating providers, MD Integrations, pharmacies, manufacturers or fulfillment partners, Stripe, customer-relationship and communications providers, and other service providers.

3. How we use information

We may use information to:

• confirm identity, eligibility, location, and program availability;
• create and maintain your administrative and clinical-platform profiles;
• connect you with an appropriately licensed independent clinician;
• support clinical review, prescribing, pharmacy routing, refills, and care coordination;
• process payments, renewals, refunds, cancellations, and eligible surgery credit;
• send service, safety, billing, refill, appointment, and support communications;
• protect the program, patients, providers, and others from fraud, misuse, or security threats;
• maintain records and comply with legal, regulatory, licensing, tax, and audit duties;
• measure and improve website performance, program operations, and communications; and
• market our services as permitted by law and consistent with your communication choices.

We do not use medical intake answers, medical records, or uploaded clinical photographs to create advertising audiences or to target advertising.

4. How we disclose information

We may disclose information only as reasonably necessary for the purposes below:

• Healthcare and clinical-platform partners: independent clinicians, medical groups, MD Integrations, pharmacies, laboratory providers, and medication fulfillment partners involved in evaluating or serving you.
• Operational service providers: Stripe and other payment vendors, website hosting and database providers, customer-relationship systems, communications services, security vendors, professional advisers, and support contractors.
• Analytics and advertising providers: limited website, device, and conversion information may be disclosed to providers such as Meta as described below.
• Legal and safety purposes: regulators, courts, law enforcement, or others when disclosure is required or permitted by law, needed to protect rights or safety, or necessary to investigate fraud or misuse.
• Business transactions: a potential or completed financing, reorganization, merger, acquisition, or sale, subject to appropriate confidentiality protections and applicable restrictions on health information.
• At your direction: when you ask us to disclose information or provide a valid authorization.

We do not sell medical records or PHI. We require service providers that receive PHI on our behalf to protect it through a Business Associate Agreement when HIPAA requires one.

5. Cookies, analytics, and advertising technology

We use necessary technologies to operate the website and may use analytics and advertising technology to understand visits and measure whether advertising led to an enrollment or purchase. These technologies may collect an IP address, browser details, referring page, cookie identifiers, and events such as page view, lead, checkout, or purchase. Our current advertising tools include the Meta Pixel and Meta Conversions API.

We configure advertising events to avoid sending medical intake answers, diagnoses, medical records, prescription details, or clinical photographs. Advertising providers may process the limited data they receive under their own privacy terms. Use our Your Privacy Choices page to opt out of targeted- advertising and advertising-measurement technology for this browser. We also treat a browser Global Privacy Control signal as an opt-out where legally applicable. You may also limit cookies through browser settings. Blocking cookies may affect parts of the website.

6. Health information, HIPAA, and other medical privacy laws

Some health information handled through the program may be Protected Health Information (“PHI”) under HIPAA. Whether information is PHI depends on who creates or receives it and why. Information held by an independent clinician or medical group may be governed by that provider’s Notice of Privacy Practices. Information handled by Dr. Miami Clinic as a business associate is used and disclosed only as permitted by the applicable contract and law.

We apply HIPAA privacy and security requirements where they apply to our operations. Our HIPAA Notice of Privacy Practices explains permitted uses and disclosures, legal duties, and individual rights concerning PHI maintained under that Notice. If a more protective federal or state medical privacy law applies, we follow the more protective requirement.

7. Retention and deletion

We retain personal information for as long as reasonably necessary to provide the program, maintain transaction and surgery-credit records, resolve disputes, enforce agreements, prevent fraud, and meet legal, tax, regulatory, insurance, and recordkeeping duties. Clinical records may be retained by the treating provider for periods required by federal or state law. Backup copies may remain for a limited period after active records are deleted.

A deletion request does not require deletion of information that we or a provider must retain, or that is needed for permitted legal, security, billing, or medical purposes.

8. How we protect information

We use administrative, technical, and physical safeguards designed to protect personal and health information. Depending on the system, safeguards include encrypted transmission, access controls, authentication, logging, vendor review, workforce access limits, and contractual confidentiality and security requirements.

No website, transmission, or storage system can be guaranteed completely secure. You are responsible for protecting passwords, devices, and access to your email and patient portal, and for notifying us promptly of suspected unauthorized access.

9. Your privacy rights and choices

Depending on the information and law that applies, you may have the right to:

• request access to or correction of personal information;
• request deletion, subject to medical, billing, legal, and security exceptions;
• request a portable copy of certain information;
• opt out of certain targeted advertising, sale, or sharing as those terms are defined by law;
• limit certain uses of sensitive personal information where required by law;
• withdraw consent for future processing when consent is the legal basis;
• appeal a denied privacy request where applicable; and
• exercise the HIPAA rights described in our Notice of Privacy Practices.

To protect patients, we may verify identity, location, and authority before completing a request. An authorized agent may submit a request when permitted by law, but we may require proof of authorization. We will not unlawfully discriminate against you for exercising a privacy right.

You can manage targeted-advertising and advertising-measurement technology through Your Privacy Choices. The choice is stored in the browser you use, so you may need to repeat it on another browser or device.

You may opt out of non-essential marketing email through the unsubscribe link and may opt out of marketing text messages by replying STOP. We send recurring marketing calls or texts using automated technology only with the separate consent requested at enrollment, and that consent is not a condition of purchase. Service, safety, billing, and care communications may continue when permitted or required.

10. Jurisdictions served and state-specific protections

This website and program are intended for adults located in the United States. Website enrollment may be available broadly, but medical services are provided only when an assigned clinician is licensed or otherwise authorized to treat a patient in the state where the patient is located. Availability is confirmed during the clinical process and may change.

We comply with applicable U.S. federal privacy and health-information laws and the privacy, medical-record, breach-notification, consumer-protection, and telehealth laws of the patient’s state when those laws apply to our role. Residents of states with comprehensive consumer privacy laws may exercise the access, correction, deletion, portability, opt-out, limitation, and appeal rights provided by their state, subject to exemptions for PHI, medical records, regulated entities, and information we must retain.

11. Children and use outside the United States

The program is not intended for anyone under 18, and we do not knowingly enroll minors. Contact us if you believe a minor submitted information. The program is operated in the United States and is not offered to individuals located outside the United States.

12. Changes to this policy

We may update this policy to reflect changes in law, vendors, technology, or program operations. The updated policy will be posted here with a new effective date. When a change materially affects how we use previously collected information, we will provide any additional notice or choice required by law.