Great Heights Medical

HIPAA Notice of Privacy Practices

Last updated: April 5, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Our Commitment to Your Privacy

Great Heights Medical is committed to maintaining the privacy of your protected health information (PHI) in compliance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the HITECH Act. This notice describes our privacy practices and your rights regarding your health information.

How We May Use and Disclose Your Health Information

Treatment

We may use and share your health information to provide, coordinate, and manage your healthcare. This includes sharing information with other healthcare providers involved in your care, such as:

  • Digbi Health — for gut microbiome and DNA analysis as part of our weight loss program
  • Laboratories — for blood work, vaccinations, and diagnostic testing
  • Referring physicians or specialists when coordination of care is needed
  • Styku body composition data used to track your treatment progress

Payment

We may use and share your health information to bill and collect payment for your treatment and services. This may include sharing information with your insurance company, health plan, or other third parties responsible for payment.

Healthcare Operations

We may use your health information for our internal operations, including quality improvement, staff training, compliance audits, and business management.

Required by Law

We will disclose your health information when required to do so by federal, state, or local law. This includes:

  • Reporting to public health authorities (communicable diseases, vaccinations)
  • USCIS — when you authorize disclosure for immigration physical exam purposes (Form I-693)
  • Court orders and legal proceedings
  • Law enforcement requests as permitted by law
  • Workers' compensation programs

With Your Authorization

Other uses and disclosures not described in this notice will be made only with your written authorization. You may revoke your authorization at any time in writing, except to the extent we have already acted on it.

Your Rights Regarding Your Health Information

Right to Access

You have the right to inspect and obtain a copy of your health information, including medical records, billing records, and Styku body composition scan data. We may charge a reasonable fee for copies. Requests must be made in writing.

Right to Amend

You have the right to request that we amend your health information if you believe it is incorrect or incomplete. We may deny the request in certain circumstances, and we will provide a written explanation if denied.

Right to an Accounting of Disclosures

You have the right to request a list of certain disclosures we have made of your health information. This does not include disclosures made for treatment, payment, healthcare operations, or disclosures you authorized.

Right to Request Restrictions

You have the right to request restrictions on how we use or disclose your health information for treatment, payment, or healthcare operations. We are not required to agree to your request, except when the disclosure is to a health plan for payment or healthcare operations and the information relates to a service you paid for in full out of pocket.

Right to Request Confidential Communications

You have the right to request that we communicate with you about your health information in a specific way or at a specific location (e.g., contacting you only at a particular phone number or by mail).

Right to a Paper Copy

You have the right to obtain a paper copy of this notice at any time, even if you previously agreed to receive it electronically.

Right to File a Complaint

If you believe your privacy rights have been violated, you may file a complaint with:

  • Our Privacy Officer (contact information below)
  • The U.S. Department of Health and Human Services Office for Civil Rights at www.hhs.gov/ocr/privacy/hipaa/complaints

You will not be penalized or retaliated against for filing a complaint.

Our Responsibilities

  • We are required by law to maintain the privacy and security of your protected health information
  • We will notify you promptly if a breach occurs that may have compromised the privacy or security of your information
  • We must follow the terms of this notice currently in effect
  • We will not use or share your information other than as described in this notice unless you give us written permission

Safeguards We Maintain

To protect your health information, we implement the following safeguards:

  • Administrative: Staff training on HIPAA privacy and security, designated Privacy Officer, written policies and procedures
  • Physical: Secure storage of paper records, restricted access to areas containing PHI, proper disposal of records
  • Technical: Encrypted electronic health records, password-protected systems, secure data transmission, access controls and audit logs

Special Considerations

Styku 3D Body Scan Data

Your Styku body composition scan data — including 3D body models, body fat measurements, and posture analysis — is treated as protected health information. This data is stored securely and is accessible only to authorized clinical staff. It will not be shared without your authorization, except as needed for your treatment.

Digbi Health / Genetic Information

Gut microbiome and DNA analysis data collected through our partnership with Digbi Health is subject to additional protections under the Genetic Information Nondiscrimination Act (GINA). Genetic information will not be used for underwriting or discriminatory purposes.

Immigration Physical Exam Records

Health information collected during USCIS immigration physical exams (Form I-693) is disclosed to USCIS as required and authorized by you. These records are maintained with the same protections as all other patient records.

Changes to This Notice

We reserve the right to change the terms of this notice at any time. Any changes will apply to all information we maintain. A revised notice will be posted on our website and available at our office.

Contact Information

For questions about this notice, to exercise your rights, or to file a complaint, contact our Privacy Officer:

This notice is provided in accordance with 45 CFR §§ 164.520 of the HIPAA Privacy Rule.