Privacy Policy

1. Introduction

At Health Balance Source ("we," "our," or "us"), your privacy is fundamental to the care we provide. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal and health information when you visit our website, book services, or interact with our care team. We are fully compliant with the Health Insurance Portability and Accountability Act (HIPAA), the California Consumer Privacy Act (CCPA), and all applicable US federal and state privacy laws.

2. Information We Collect

2.1 Information You Provide

• Identity data: name, date of birth, government-issued IDs
• Contact data: email address, phone number, mailing address
• Health information: medical history, symptoms, diagnoses, prescriptions, lab results
• Payment information: credit card details processed by PCI-compliant third parties
• Insurance information: policy numbers and provider details
• Account data: usernames, passwords, preferences, communications

2.2 Automatically Collected Information

• Device information: IP address, browser type, operating system
• Usage data: pages visited, time spent, referral URLs
• Cookies and tracking technologies for analytics and personalization

3. How We Use Your Information

We use collected information strictly for healthcare operations, including:

• Providing, coordinating, and improving medical services
• Communicating with you about appointments, results, and care plans
• Processing payments and insurance claims
• Conducting quality assurance and clinical research (de-identified)
• Complying with legal, regulatory, and safety obligations
• Sending wellness tips and marketing (only with your consent)

4. How We Share Your Information

We never sell your data. We may share it only with:

• Healthcare providers directly involved in your treatment
• Insurance companies for claims processing
• Service providers (labs, imaging, pharmacies) under HIPAA-compliant contracts
• Government agencies when required by law
• Business partners in mergers, acquisitions, or asset sales (with notice)

5. Data Security

We implement enterprise-grade security measures including:

• AES-256 encryption for data at rest and TLS 1.3 for data in transit
• Multi-factor authentication for all staff access
• Regular penetration testing and security audits
• Role-based access controls and audit trails
• HIPAA-compliant data centers with SOC 2 Type II certification

6. Your Rights

You have the right to:

• Access, correct, or delete your personal information
• Request a copy of your medical records
• Opt out of marketing communications
• Restrict or object to certain data processing
• Request an accounting of disclosures
• File a complaint with HHS or your state attorney general

7. Cookies & Tracking

We use essential cookies for site functionality, analytics cookies to improve our services, and marketing cookies (only with consent). You can manage cookie preferences through your browser settings or our cookie banner.

8. Children's Privacy

Our services are intended for adults. We do not knowingly collect data from children under 13 without verifiable parental consent. For minors, a parent or legal guardian must authorize care.

9. Data Retention

We retain your medical records for a minimum of 10 years after the last encounter (or until age 28 for minors), as required by HIPAA and state law. Marketing data is retained until you opt out or 3 years of inactivity, whichever comes first.

10. International Transfers

Your data is primarily stored in the United States. If transferred internationally, we ensure adequate protection through standard contractual clauses and equivalent safeguards.

11. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be posted on this page with a revised effective date, and where required, we will notify you via email or a prominent website notice.