Endless Vitality logo
Endless Vitality
Legal

Privacy Policy

Last updated: October 7, 2026

Endless Vitality, LLC ("Endless Vitality," "we," "us," or "our") respects your privacy. This policy explains how we collect, use, disclose, and protect information through our website, communications, forms, in-person care, and telehealth services. Our separate HIPAA Notice of Privacy Practices explains permitted uses of protected health information (PHI), our legal duties, and your patient privacy rights. For PHI, that notice and applicable law govern if this policy is inconsistent with them. Visiting this website or accepting this policy does not authorize uses or disclosures that require a separate written authorization.

Information we collect

We collect information you provide, including your name, contact details, date of birth, appointment requests, payment-related information, and communication preferences.

In providing care, we collect medical histories, symptoms, medication information, laboratory results, diagnoses, treatment plans, consent documents, and information from consultations and follow-ups. We may receive records from providers, laboratories, pharmacies, and people you authorize.

Our website and its service providers may collect technical information such as IP addresses, device and browser details, pages visited, and cookie identifiers.

Information collected through healthcare activities may be PHI; other website information may be governed by different privacy laws.

How health information is used and disclosed

Subject to applicable law and any required consent, we may use or disclose PHI for:

  • Treatment: evaluating your health, coordinating care, ordering laboratory tests, and communicating with treating providers and pharmacies.
  • Payment: processing payments, preparing statements, and resolving billing questions. Our cash-pay model does not eliminate privacy protections for billing records.
  • Healthcare operations: quality review, patient safety, staff training, compliance, and practice administration.
  • Legal and public-interest purposes: legally required reporting and other disclosures permitted by law, subject to applicable conditions and limits.
  • Patient-authorized purposes: disclosures you specifically authorize, such as sending records to a designated third party. You may revoke an authorization in writing, subject to actions already taken in reliance on it.

The HIPAA notice provides additional details and examples. We limit information used or disclosed to the minimum necessary when that standard applies. Vendors handling PHI on our behalf must be subject to required business associate agreements and other applicable protections. A vendor's general confidentiality promise alone does not replace a required agreement.

TalkEHR and telehealth information

Clinical records and telehealth-related clinical information are maintained in TalkEHR, our electronic health record system. This includes clinical documentation, relevant history, laboratory results, treatment plans, and telehealth encounter information. Other authorized systems may support scheduling, communications, payments, or service delivery; TalkEHR is not necessarily the only system that processes patient information.

Telehealth information receives the protections applicable to medical records. This policy does not provide consent to record a visit. Any recording requires a separate assessment of applicable consent and privacy requirements.

Communications, marketing, and website technologies

We use contact information to respond to inquiries, arrange visits, and communicate about care. Where required, we obtain consent before sending promotional emails or texts. You can unsubscribe from promotional emails or reply STOP to promotional texts. Opting out of promotions does not stop necessary care or administrative communications.

We do not sell or rent personal information. We do not disclose PHI to advertising platforms for their own marketing without a valid authorization when required by law. Marketing uses of PHI that require HIPAA authorization will occur only with that authorization; website consent is not a substitute.

Cookies and similar technologies may support website functions and traffic measurement. Browser controls can limit cookies, though some functions may be affected. We do not treat identifiable website information as anonymous simply because it is used for analytics. Applicable consent and opt-out rights depend on the data, technology, and law. Third-party websites linked from our site have their own privacy practices.

Your privacy rights and requests

Patients may request access to and copies of medical and billing records, amendments to inaccurate or incomplete records, restrictions on certain uses or disclosures, confidential communications, an accounting of certain disclosures, and a paper copy of the HIPAA notice. You may also appoint an authorized representative and file a privacy complaint without retaliation. These rights have legal conditions and exceptions; see the separate notice.

To request help, contact our Privacy Officer using the details below. Tell us the type of request and your preferred way to receive a response. We may reasonably verify identity or representative authority. Call for secure submission instructions rather than sending detailed medical information through an ordinary website form or unencrypted email.

State privacy rights and retention

Arizona medical and payment records are privileged and confidential, subject to disclosures authorized by law or valid written authorization. Arizona patients have applicable rights to obtain records, including telehealth medical reports. We process requests within applicable state and federal deadlines and apply more protective state requirements where required.

Depending on your residence, the information involved, and whether a law applies to our activities, additional state rights may include access, correction, deletion of eligible nonmedical information, portability, and opting out of sale, sharing, targeted advertising, or certain profiling. Where required, we honor recognized opt-out preference signals, permit authorized-agent requests, provide an appeal process for denied requests, and do not unlawfully discriminate for exercising rights. Contact us to exercise applicable rights or appeal a denial.

HIPAA and state laws may exempt particular information or entities from certain consumer rights. There is no general HIPAA right to delete medical records. We retain records as required for care, legal retention obligations, billing, and other lawful purposes; a deletion request may not override those obligations. Sensitive records, including certain genetic, behavioral-health, HIV-related, or substance-use-disorder records, receive additional protections where applicable.

Security and required notifications

We maintain reasonable administrative, physical, and technical safeguards designed to protect information. These include workforce confidentiality and training, appropriate access controls, protection of physical records and work areas, and procedures for identifying and responding to security incidents. Electronic safeguards are selected through risk assessment and applicable legal requirements. No system or transmission method can guarantee absolute security.

If a breach of unsecured PHI requires notification, we notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery, subject to legally permitted delay. We also notify HHS and the media when required and meet applicable state notification requirements, including shorter deadlines where applicable. Notices explain the incident, information involved, protective steps, our response, and how to obtain help.

Contact and updates

Privacy Officer — Endless Vitality, LLC

We update this policy as our practices or legal obligations change and identify the current version by its date. Material changes will be communicated when required by law. See our HIPAA Notice of Privacy Practices for health-information complaints and additional rights.