HIPAA Privacy Policy

Begin Anew Med Spa

Effective Date: 11/11/2026

Begin Anew, LLC, doing business as Begin Anew Med Spa

1. Introduction

At Begin Anew Med Spa, we are committed to respecting your privacy and protecting the confidentiality of your personal health information.

This Notice of Privacy Practices explains how your Protected Health Information (PHI) may be used and disclosed, the rights you have regarding your medical information, and our responsibilities under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), its applicable regulations, and relevant Florida laws.

This Notice applies to health information maintained by Begin Anew Med Spa in connection with healthcare services subject to HIPAA, including medical consultations, aesthetic procedures, wellness services, laboratory testing, hormone therapy, and other medically supervised treatments.

Our goal is to provide personalized care while respecting your privacy and maintaining appropriate safeguards for your health information.

2. Understanding Protected Health Information (PHI)

Protected Health Information refers to individually identifiable health information maintained or transmitted by a covered healthcare provider or its business associates.

Depending on the services you receive, PHI may include:

• Personal identifying information, including your name, date of birth, address, and contact information.
• Medical history, current health conditions, and medication information.
• Laboratory testing, diagnostic results, and clinical assessments.
• Consultation notes, treatment recommendations, and medical records.
• Treatment photographs and other clinical documentation.
• Prescription information and follow-up care instructions.
• Billing and payment information associated with healthcare services.

We use appropriate administrative, physical, and technical safeguards to protect PHI from unauthorized access, use, or disclosure.

3. Your Rights Regarding Your Health Information

You have important rights concerning your health information, subject to applicable federal and state laws.

A. Access Your Medical Records

You may request to inspect or obtain an electronic or paper copy of your medical records and other PHI maintained in a designated record set.

We will generally respond within 30 days of receiving your request, subject to legally permitted extensions and exceptions. Reasonable, cost-based fees may apply where permitted by law.

B. Request Corrections to Your Records

If you believe information in your medical records is inaccurate or incomplete, you may request an amendment.

We will review your request and respond in accordance with applicable law. If your request is denied, we will explain the reason and inform you of any available rights to submit a statement of disagreement.

C. Request Confidential Communications

You may request that we communicate with you through a particular method or at a specific location.

For example, you may ask us to contact you using a designated telephone number or mailing address.

We will accommodate reasonable requests as required by law.

D. Request Restrictions on Information Sharing

You may ask us to limit certain uses or disclosures of your PHI for treatment, payment, or healthcare operations.

Although we are not generally required to agree to every restriction, we will consider your request.

If you pay out of pocket in full for a healthcare service, you may request that we not disclose information about that service to your health plan for payment or healthcare operations. We will honor qualifying requests unless disclosure is required by law.

E. Request an Accounting of Disclosures

You may request an accounting of certain disclosures of your PHI made during the six years preceding your request.

This accounting generally excludes disclosures for treatment, payment, healthcare operations, and other disclosures excluded under applicable law.

F. Obtain a Copy of This Notice

You may request a paper copy of this Notice at any time, even if you previously agreed to receive it electronically.

G. Designate a Personal Representative

If you have authorized someone through a valid healthcare power of attorney or other legally recognized arrangement, that individual may exercise certain rights on your behalf.

We may request documentation verifying the individual’s authority before disclosing information.

H. File a Privacy Complaint

If you believe your privacy rights have been violated, you may submit a complaint directly to Begin Anew Med Spa or to the U.S. Department of Health and Human Services, Office for Civil Rights.

We will not retaliate against you for exercising your privacy rights or filing a complaint.

4. How We May Use and Disclose Your Health Information

HIPAA permits certain uses and disclosures of PHI without obtaining separate written authorization. Other uses and disclosures require authorization or must meet specific legal conditions.

A. Treatment

We may use or disclose PHI to provide, coordinate, and manage your medical care.

For example, your healthcare provider may review your medical history, laboratory results, or treatment records to determine an appropriate treatment plan.

When necessary, information may be shared with other healthcare professionals, laboratories, pharmacies, or specialists involved in your care.

B. Payment

We may use or disclose PHI for activities related to payment for healthcare services.

This may include processing payments, preparing billing records, collecting outstanding balances, or communicating with authorized payment-related service providers.

C. Healthcare Operations

We may use PHI for legitimate healthcare operations, including:

• Quality assurance and patient safety activities.
• Clinical training and professional development.
• Internal audits and compliance reviews.
• Administrative and operational management.
• Licensing, credentialing, and regulatory activities.
• Evaluating and improving healthcare services.

D. Appointment Reminders and Follow-Up Care

We may contact you regarding scheduled appointments, treatment instructions, follow-up visits, and other communications related to your care.

Communications may occur by telephone, email, text message, or other permitted methods, subject to applicable privacy requirements and your communication preferences.

E. Treatment Alternatives and Health-Related Services

We may communicate with you about treatment options, healthcare services, or health-related benefits that may be relevant to your care, as permitted by HIPAA.

Marketing communications requiring authorization will not be sent using PHI without the required authorization.

F. Family Members and Individuals Involved in Your Care

When appropriate and permitted by law, we may share relevant health information with family members, caregivers, or other individuals involved in your treatment or payment for your care.

We will consider your preferences and any applicable legal restrictions.

G. Medical Emergencies

In emergency situations, we may use or disclose PHI as necessary to provide treatment, coordinate emergency care, or protect your health and safety.

H. Business Associates and Service Providers

We may work with third-party organizations that provide services involving PHI, including electronic medical record systems, scheduling platforms, technology providers, and other healthcare support services.

When required by HIPAA, these organizations must enter into Business Associate Agreements and comply with applicable privacy and security obligations.

5. Other Uses and Disclosures Permitted or Required by Law

In certain circumstances, we may use or disclose PHI without your written authorization when permitted or required by law.

These circumstances may include:

Public Health Activities: Reporting certain diseases, adverse events, or other information to authorized public health agencies.

Health Oversight: Responding to lawful audits, investigations, inspections, or licensing reviews.

Abuse, Neglect, or Domestic Violence: Reporting information to authorized agencies when required or permitted by law.

Legal Proceedings: Responding to court orders, subpoenas, or other lawful legal processes when applicable requirements are satisfied.

Law Enforcement: Providing information to law enforcement officials under circumstances specifically permitted or required by law.

Food and Drug Administration: Reporting adverse reactions, product defects, recalls, or other safety-related matters involving regulated medical products.

Research: Using or disclosing information for qualifying research activities when appropriate authorizations, approvals, or legal exceptions apply.

Serious Threats to Health or Safety: Disclosing information when legally permitted and necessary to prevent or lessen a serious and imminent threat.

Workers’ Compensation: Providing information as authorized by applicable workers’ compensation laws.

Coroners, Medical Examiners, and Funeral Directors: Disclosing information for legally authorized purposes.

Other Legal Requirements: Complying with federal, Florida, and other applicable laws, including any heightened protections that apply to particular categories of health information.

6. Uses and Disclosures Requiring Written Authorization

Certain uses and disclosures of PHI require your written authorization.

These generally include:

• Most uses and disclosures of psychotherapy notes, when applicable.
• Uses or disclosures of PHI for marketing when authorization is required by HIPAA.
• Disclosures that constitute a sale of PHI under HIPAA.
• Other uses and disclosures not otherwise permitted or required by law.

Treatment Photography and Before-and-After Images

Begin Anew Med Spa may take photographs to document treatment progress, assist with clinical evaluations, and maintain medical records.

Clinical photographs maintained as PHI are protected under applicable privacy laws.

We will obtain appropriate written authorization before using identifiable patient photographs or other PHI for advertising, social media, website galleries, or promotional materials when required by law.

You may revoke an authorization in writing at any time, except to the extent that we have already acted in reliance on it.

7. Protecting Your Health Information

Begin Anew Med Spa recognizes the importance of protecting sensitive patient information.

We maintain safeguards appropriate to the information and systems involved, which may include:

• Restricting access to authorized personnel.
• Using access controls and password-protected systems.
• Protecting electronic records through appropriate security measures.
• Maintaining secure storage and disposal procedures.
• Providing workforce privacy and security training.
• Reviewing potential unauthorized access or disclosures.
• Working with service providers subject to applicable confidentiality and security obligations.

Although no information system can eliminate every risk, we are committed to maintaining safeguards required by applicable law.

8. Breach Notification

In accordance with the HIPAA Breach Notification Rule, Begin Anew Med Spa will evaluate suspected breaches of unsecured PHI and provide notifications when required by law.

What Constitutes a Breach?

A breach generally involves an impermissible acquisition, access, use, or disclosure of unsecured PHI that compromises its privacy or security, unless an applicable exception or risk assessment establishes otherwise.

Notification Requirements

When notification is required, affected individuals will be notified without unreasonable delay and no later than 60 calendar days after discovery of the breach, unless a legally permitted delay applies.

Notifications may include:

• A description of the incident.
• The date of the breach and its discovery, if known.
• The types of information involved.
• Steps individuals may take to protect themselves.
• Actions taken to investigate, mitigate, and prevent similar incidents.
• Contact information for questions or additional assistance.

We will also notify the U.S. Department of Health and Human Services and, when applicable, the media, in accordance with the requirements governing the particular breach.

9. Our Responsibilities Under HIPAA

To the extent applicable under HIPAA, Begin Anew Med Spa is responsible for:

• Maintaining the privacy and security of PHI.
• Providing patients with notice of our legal duties and privacy practices.
• Following the terms of the Notice currently in effect.
• Providing required notifications following breaches of unsecured PHI.
• Respecting patient rights under applicable privacy laws.
• Obtaining written authorization for uses or disclosures when required.
• Complying with applicable federal and Florida health information privacy requirements.

We will not use or disclose your PHI except as permitted or required by applicable law.

10. Changes to This Notice

Begin Anew Med Spa reserves the right to revise this Notice of Privacy Practices.

Revisions may apply to PHI we already maintain as well as information received after the effective date of the revised Notice.

When material changes occur, we will make the updated Notice available through our website and at our practice locations, as required by law.

The effective date will be displayed at the beginning of the Notice.

11. Contact Information and Privacy Complaints

If you have questions regarding this Notice, wish to exercise your privacy rights, or would like to report a privacy concern, please contact:

Begin Anew, LLC
Doing business as Begin Anew Med Spa
337 E Indiantown Rd, Suite E-13
Jupiter, FL 33477

Privacy Contact: Jennifer Boushie
Telephone: (561) 781-3578
Email: J.Boushie@beginanewmed.com

You may also file a complaint with:

U.S. Department of Health and Human Services
Office for Civil Rights
200 Independence Avenue SW
Washington, DC 20201

Telephone: 1-800-368-1019

Website: https://www.hhs.gov/hipaa/filing-a-complaint/

Begin Anew Med Spa will not retaliate against anyone for filing a privacy complaint or exercising their rights under applicable law.