Privacy Policy and Notice of Privacy Practices

Part 1. Notice of Privacy Practices

Our duties to you

We are required by law to keep your protected health information private, to give you this notice of our legal duties and privacy practices, and to follow the terms of the notice currently in effect. We are required to notify you if a breach occurs that may have compromised the privacy or security of your information. Protected health information means any information that identifies you and relates to your health, your care, or payment for your care. That includes your medical records, lab results, prescriptions, photographs taken for treatment, visit recordings, and messages with our clinical team.

This notice covers everyone who works at Navara Health and every location where we provide care, including virtual visits.

How we use and share your information without your written authorization

Treatment	To evaluate you, prescribe, and coordinate your care. For example, we send your prescription to a licensed pharmacy, send lab orders to a laboratory, and share information with our collaborating physician or with another provider involved in your care.
Payment	To bill and collect for the care we provide. Navara Health is cash pay and does not bill insurance, so this mainly means processing your payment and preparing a superbill if you ask for one.
Health care operations	To run the practice and improve care. For example, reviewing charts for quality, training staff, maintaining our records systems, and meeting legal and licensing requirements.
Business associates	We work with outside companies that handle information on our behalf, such as our electronic health record and telehealth platform, our secure messaging and phone system, and our laboratory ordering service. Each one signs a business associate agreement that requires it to protect your information the same way we do.
Appointment reminders and care messages	To remind you of appointments, follow up on results, and tell you about treatment options related to your care.
Family and others involved in your care	With a family member, friend, or other person you identify, limited to what relates to their involvement, unless you tell us not to. If you cannot agree or object, for example in an emergency, we use professional judgment.

Other uses and disclosures the law allows or requires

• As required by law, when federal, state, or local law requires it.
• Public health and safety, such as reporting disease, adverse reactions to medications, or product problems to the FDA, and preventing a serious threat to someone's health or safety.
• Abuse, neglect, or domestic violence, to the authorities required to receive those reports.
• Health oversight, to agencies such as state licensing boards for audits, investigations, and inspections.
• Lawsuits and legal proceedings, in response to a court order, or to a subpoena when the law permits.
• Law enforcement, for limited purposes the law allows.
• Coroners, medical examiners, funeral directors, and organ donation, as the law allows.
• Research, only when approved under the privacy rule's research protections.
• Specialized government functions, such as military or national security purposes the law allows.
• Workers' compensation, as state law allows.

Uses that require your written authorization

We will not do any of the following without your written permission: use or share psychotherapy notes, use your information for marketing, or sell your information. We do not sell protected health information, and we do not use it for fundraising. Any other use or disclosure not described in this notice will be made only with your written authorization. You can revoke an authorization in writing at any time, except to the extent we have already acted on it.

State law protections

Federal law sets the minimum. Where a state law that applies to you is more protective, we follow it.

• Texas. Under the Texas Medical Records Privacy Act, Texas Health and Safety Code Chapter 181, we never sell your protected health information, and we give you electronic records within 15 business days of a written request. Notice of electronic disclosure: your protected health information may be disclosed electronically, for example through our electronic health record, e-prescribing, and electronic lab ordering. Texas law requires your separate authorization before we disclose your information electronically for any purpose other than treatment, payment, health care operations, or as otherwise permitted by law.
• Washington. We follow the Washington Uniform Health Care Information Act, RCW Chapter 70.02. Health data collected outside the patient relationship is covered by our Consumer Health Data Privacy Policy under the Washington My Health My Data Act.
• Florida. We keep patient records confidential as required by Florida Statutes Section 456.057 and give notice of a data breach as required by Section 501.171.
• All states we serve. Some types of information carry extra protection under state law, such as HIV and sexually transmitted infection test results, genetic test results, and mental health records. We will not disclose those categories except as the applicable state law allows.

Changes to this notice

We can change the terms of this notice, and the changes will apply to all information we have about you. The current notice is always posted on this page and in our clinic, with its effective date at the top.

Complaints

If you believe your privacy rights have been violated, you can file a complaint with our Privacy Officer using the contact details below. You can also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, by mail at 200 Independence Avenue SW, Washington, DC 20201, by phone at 1-877-696-6775, or online at hhs.gov/ocr/complaints. We will not retaliate against you for filing a complaint.

Part 2. Website Privacy Policy

This part explains how we handle information when you use navarahealthtx.com, our online forms, and our text messaging. Once you become a patient, your health information is protected as described in Part 1.

What we collect

Information you give us	Your name, contact details, and anything you tell us about your health when you complete a form, request an appointment, call, text, or email us.
Booking information	The service you select and your appointment time.
Technical information	IP address, device and browser type, and pages visited, collected automatically and only as described in the cookie section below.

Our intake forms and booking tools are hosted on platforms that sign business associate agreements with us, so health information you submit through them is protected as health information from the moment we receive it.

How we use it

• To respond to your request and schedule your visit
• To confirm that you are located in a state where we provide care
• To prepare for and deliver your care
• To operate, secure, and improve this website
• To meet our legal obligations

What we do not do

We do not sell your personal information or your health information. We do not share it with anyone for their own marketing. We do not use health information for targeted advertising, and we never pass your name, email address, phone number, or health information into analytics or advertising tools.

Cookies and tracking

When you first visit, a banner lets you accept all cookies, reject non-essential cookies, or choose by category. Analytics and marketing cookies stay off until you choose. Strictly necessary cookies keep the site working and remember your choice. You can change your choice at any time with the cookie preferences link at the bottom of every page. Analytics data is set to delete after two months.

Text messages

If you give us your mobile number and agree to receive texts, we use it for appointment scheduling, reminders, and care-related messages. Message frequency varies. Message and data rates may apply. Reply STOP to opt out at any time or HELP for help. We do not share your mobile number or your consent to receive texts with any third party for marketing.

Security

We protect information with administrative, physical, and technical safeguards, including encrypted systems, access limited to the staff who need it, and business associate agreements with every vendor that handles health information. No system is perfectly secure, and we will notify you of a breach as the law requires.

How long we keep records

We keep medical records for at least seven years after your last visit. For patients treated as minors, we keep them until the patient turns 21 or for seven years, whichever is longer. Where a state law requires longer, we follow it.

Children

This website is not directed to children under 13, and we do not knowingly collect information online from them. Navara Health treats patients under 18 for virtual urgent care visits only, with a parent or legal guardian.

Changes to this policy

We may update this policy. We post every change on this page and update the effective date at the top.