Privacy Policy & Notice of Privacy Practices

Who this notice covers

This notice applies to the Paradigm Health practices — Paradigm Health, PLLC and Paradigm Wellness, PLLC — and to Paradigm Health Asset Management, LLC, the management company that handles administrative, scheduling, and billing services on the practices' behalf, together with their physicians, clinicians, and staff, at 520 Duke Drive, Suite 200, Franklin, Tennessee 37067. It covers everything we do online at paradigmhealth.org and in the Paradigm member portal. We refer to all of these together below as "Paradigm," "we," or "us."

We are required by law to protect the privacy of your health information, to give you this notice of our legal duties and privacy practices, and to follow the terms of the notice currently in effect.

The information we hold

To care for you well, we collect and keep two broad kinds of information.

Protected health information

This is health information that identifies you. In our practice it includes:

• Who you are — name, date of birth, address, phone, email, and emergency contacts
• Your medical history, current conditions, allergies, and the medicines and supplements you take
• Notes and findings from your visits with our physicians, clinicians, and physical therapists
• Laboratory results, imaging, DEXA body composition, VO₂ max and CPET testing, motion analysis, and continuous glucose data
• Data you choose to connect from a wearable device or app
• Your personalized Paradigm Plan and the goals and targets in it
• Prescriptions we write for you and the pharmacy you ask us to send them to
• Payment and membership records for the services you buy from us
• Messages between you and your care team

Website and app information

When you visit paradigmhealth.org we collect ordinary website information: pages viewed, approximate location from your IP address, browser and device type, and how you arrived at the site. If you fill out a form on the site, we receive whatever you type into it.

Please do not include detailed medical information in a website form or in ordinary email. Those channels are for getting in touch — the member portal is the secure place for anything clinical.

The app collects less than the website does. It has no advertising, no analytics, and no third-party tracking of any kind. If you turn on notifications, your phone gives us an anonymous delivery code so we can send them; it identifies the phone, not you, and we use it for nothing else. Notifications never contain medical details — they tell you something is waiting and you sign in to read it.

How we use and share your health information

Most of the time we use your health information for three purposes, and we do not need to ask your permission first.

• Treatment. Your physician, care team, physical therapist, and the specialists and laboratories we work with use your information to care for you and coordinate that care. For example, we send your prescription to the pharmacy you choose, and we send lab orders to the laboratory that will run them.
• Payment. We use your information to bill you or your membership account, to process card payments, and — where a service is billed to insurance — to obtain payment for it.
• Health care operations. We use your information to run the practice well: reviewing quality of care, training, licensing and credentialing, business planning, and improving the way we work.

Other uses that do not need your permission

The law also permits or requires us to use or share your health information in specific situations, including:

• When required by federal, state, or local law
• Public health activities, such as reporting a communicable disease or a problem with a medicine or device
• Reporting suspected abuse, neglect, or domestic violence
• Health oversight activities, such as audits, investigations, and licensure
• Responding to a court order, subpoena, or lawful request from law enforcement
• Coroners, medical examiners, funeral directors, and organ procurement organizations
• Averting a serious and imminent threat to your health or safety, or to the safety of others
• Workers' compensation, and specialized government functions such as military or national security

Uses that always need your written permission

• Most uses and disclosures of psychotherapy notes
• Use or disclosure of your information for marketing
• Any sale of your health information — which we do not do
• Sharing your information with family members, friends, or anyone else you name

If you give us written permission, you can take it back at any time, in writing. Taking it back does not undo anything we already did while we had it.

We do not sell your health information, and we do not share it for anyone else's advertising.

E-prescribing and your pharmacy

When your physician prescribes a medicine, the prescription is sent electronically through a secure prescription network to the pharmacy you choose. Your physician chooses the medicine on clinical grounds. You choose the pharmacy. Paradigm does not direct you to any particular pharmacy and has no financial relationship with one.

To send prescriptions electronically we use DoseSpot, an e-prescribing service that connects to the Surescripts network. In the course of prescribing, our physicians may review your medication history as reported by pharmacies and health plans through that network, and — as state law requires — the Tennessee Controlled Substance Monitoring Database.

Before a clinician is allowed to prescribe electronically, federal rules require that the clinician's own identity be verified. That check is performed by Experian and applies to the prescriber, not to you. It does not involve your health information and has no effect on your credit.

Your rights

Your health record is our physical property, but the information in it is yours. You have the right to:

• See and get a copy of your record. Ask us and we will provide it, usually within 30 days. You can ask for it electronically. We may charge a reasonable, cost-based fee for copies.
• Ask us to correct your record. If you think something is wrong or incomplete, ask us in writing to amend it. If we decline, we will tell you why in writing, and you may file a statement of disagreement that becomes part of your record.
• Get a list of who we shared it with. You can request an accounting of certain disclosures we made in the six years before your request. The first list in any 12 months is free.
• Ask us to limit what we use or share. We will consider every request, and we are not required to agree to all of them. One request we must honor: if you pay in full, out of pocket, for a service, you can tell us not to share information about that service with your health plan.
• Choose how we contact you. Ask us to reach you at a particular phone number or address, and we will accommodate reasonable requests.
• Get a paper copy of this notice at any time, even if you agreed to receive it electronically.
• Be told if your information is breached. We will notify you if a breach compromises the privacy or security of your health information.
• Choose someone to act for you. A person with legal authority to make health care decisions for you can exercise these rights on your behalf.
• Ask us to close your account and delete your app data. Email support@paradigmhealth.org with the subject “Delete my account”, from the address you use to sign in. We will confirm within 30 days. This closes your sign-in to the member portal and the mobile app, and removes the information held for them. Your medical record itself is kept for the period the law requires us to keep it — we will tell you what that means in your case.

To exercise any of these rights, contact our Privacy Officer using the details at the bottom of this page.

How we protect your information

We use administrative, physical, and technical safeguards to protect your health information, consistent with HIPAA and current security practice. Access is limited to the people who need it for your care, and we keep our safeguards under regular review. We keep the specifics of those safeguards private so as not to make them a target. If you have a security question, contact our Privacy Officer using the details at the bottom of this page.

Companies that work with us

Some companies handle information on our behalf so we can care for you and run the practice. Where they handle health information, each is bound by a business associate agreement that requires them to protect it the same way we do. Rather than name every vendor, we describe the kinds of companies we work with:

• Our secure cloud platform — hosting and storage for the clinical system, in the United States
• Electronic prescribing — the service that sends your prescriptions to your pharmacy over the national Surescripts network
• Reference laboratories and imaging/screening partners — who run the labs and scans your clinician orders
• Payment processors — who handle card payments on their own secure pages, so full card numbers never touch our website
• Secure communication providers — for fax, secure messaging, scheduling, and email
• Website analytics — measures site traffic only if you accept cookies, and never receives health information

We will name any specific company on request. Our clinicians choose your medication on clinical grounds and you choose your pharmacy; Paradigm has no ownership stake in, or financial relationship with, any pharmacy or drug manufacturer.

Cookies and analytics on this website

We use cookies for two things: keeping the site working, and understanding how visitors use it so we can improve it. Analytics only runs if you accept it in the banner shown on your first visit — if you decline, we do not load it. You can change your mind by clearing this site's data in your browser, which brings the banner back.

We do not use advertising cookies, and we do not allow anyone to track you across other websites from here.

The member portal and mobile app

Members sign in to a secure portal to see their Paradigm Plan, results, and messages from their care team. Portal access is protected by your own credentials — please keep them private, and tell us right away if you think someone else has them. Information you send through the portal becomes part of your medical record.

The Paradigm Health app for iPhone and Android shows you the same information as the member portal, and is covered by this notice in exactly the same way. Signing in on a phone works the same as signing in on a computer, and anything you send us from the app becomes part of your medical record.

The app keeps you signed in on that device until you sign out. If you lose your phone, tell us and we will help you secure your account.

The app does not read your phone’s health data, location, contacts, photos, or microphone. If we ever add a feature that reads health data from your phone — from Apple Health or Android’s Health Connect — the app will ask your permission first, tell you exactly what it wants to read, and you can refuse or change your mind at any time in your phone’s settings.

Children

Our website is intended for adults, and we do not knowingly collect information from children through the website. We do care for adolescents as part of a family membership — beginning in adolescence, once puberty has started — and a parent or guardian is involved in enrolling and in that care. We handle a minor's health information, and a parent's access to it, in keeping with Tennessee law.

Changes to this notice

We may change this notice, and the changed notice will apply to all the health information we hold. The current version is always posted here with its effective date, and a copy is available at our front desk.

Questions and complaints

If you have a question, or if you believe your privacy rights have been violated, please contact us first — we would genuinely like the chance to put it right.

You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights:

We will never retaliate against you for filing a complaint.

See also our Terms and Conditions and our frequently asked questions.