Privacy Policy & Notice of Privacy Practices

Covered entity: Clínica Médica Salve · Clinica Medica Salve PLLC (organization NPI 1982346631). Public NPI records list family medicine (taxonomy 207Q00000X) at 217 W Main St Ste 110, Grand Prairie, TX 75050-5648. Authorized official on file: Dr. Espiridion Mendez, D.O., Director. A related organization NPI (Clinica Medica Salve, LLC — 1508510140) appears in public registries at the same address.

• Clinic address: 217 W Main St, Suite 110, Grand Prairie, TX 75050
• Phone: (214) 235-0607
• Fax: (214) 602-9042 (site contact) · NPI mailing records may also list (972) 329-7005
• Email: clinicamedicasalve@gmail.com
• Languages: Spanish and English

Privacy Officer / medical records contact: call or email the clinic and ask for “Privacy Officer” or “medical records.”

We are required by the HIPAA Privacy, Security, and Breach Notification Rules and by Texas law (including the Texas Medical Records Privacy Act and HB 300) to:

• Maintain the privacy and security of your PHI
• Give you this Notice of our legal duties and privacy practices
• Follow the terms of the Notice that is currently in effect
• Notify you following a breach of unsecured PHI as required by law
• Provide notice that your PHI may be subject to electronic disclosure (Texas Health & Safety Code § 181.154)
• Train workforce on privacy as required (Texas generally requires training within timelines set by HB 300 and periodic refreshers)

We may change our privacy practices and this Notice. When we do, we will post the revised Notice on our website and make it available at the clinic. Unless law requires otherwise, the revised Notice will apply to PHI we already maintain as well as PHI we create or receive later.

Depending on how you interact with us, we may collect:

• Identifiers & contact: name, date of birth, address, phone, email, preferred language, emergency contact
• Visit & administrative data: appointment preferences, how you found us, insurance/self-pay status, financing interest (CareCredit, Cherry), intake tokens, signatures
• PHI / clinical: medical history, medications, allergies, conditions, symptoms, labs you share, visit reasons, weight-management details, hormone-related history, aesthetic concerns and treatment-planner hotspot selections, photos if you provide them for care, clinical notes and orders created during care
• Digital telemetry needed to run the site: device/browser type, approximate IP-derived location, pages viewed, language preference, security logs, and chat/form submissions you choose to send
• Payment-related data needed for billing, eligibility, or to connect you to third-party financing — we do not store full card numbers on the marketing site

We do not sell your PHI. We do not sell personal information to data brokers.

We may use and disclose PHI without your written authorization for:

Treatment — Example: Your clinician reviews your intake and treatment-planner notes, orders labs, coordinates with a pharmacy or BIOTE-related lab partner, or shares relevant history with a specialist or laser/aesthetic team member involved in your care plan.

Payment — Example: We submit claims or statements to an insurer or clearinghouse, verify benefits, collect self-pay balances, or share limited information with a financing partner you choose (such as CareCredit or Cherry) so they can process an application you initiate.

Health care operations — Example: Quality review of aesthetic outcomes, staff training, appointment reminders, auditing compliance, improving Salve Assist guidance, credentialing, and business planning for the practice.

Business associates. Vendors that help us (cloud hosting such as Firebase/Google Cloud, email/SMS providers, e-signature tools, IT support, billing/clearinghouse partners, etc.) may receive PHI only as needed to perform services for us, under Business Associate Agreements when HIPAA requires them.

As applicable, we may also use or disclose PHI without authorization for purposes such as:

• Public health activities (certain disease, injury, or product-problem reporting)
• Health oversight (audits, investigations, inspections by regulators)
• Judicial and administrative proceedings (court order, subpoena, or similar process as allowed)
• Law enforcement purposes permitted by HIPAA and Texas law
• Coroners, medical examiners, funeral directors; organ/tissue donation organizations
• Research under IRB/privacy-board approved protocols or limited data sets with data use agreements
• To avert a serious threat to health or safety
• Workers’ compensation and specialized government functions when applicable
• As otherwise required by federal or Texas law

Appointment reminders & care communications. We may contact you by phone, text, email, or similar channels for appointment reminders, intake links, care follow-up, billing notices, and treatment alternatives or health-related benefits and services that may be of interest — consistent with HIPAA rules for such communications.

Fundraising. If we ever use PHI for fundraising, we will include a clear way to opt out of future fundraising communications. We do not currently operate a patient fundraising program.

Except as described in this Notice or otherwise permitted/required by law, we will not use or disclose your PHI without your written authorization. Authorization is generally required for:

• Most uses and disclosures of psychotherapy notes (if applicable)
• Marketing that meets HIPAA’s definition of “marketing” (other than face-to-face communications or promotional gifts of nominal value)
• Sale of PHI
• Certain electronic disclosures under Texas law that are not for treatment, payment, health care operations, or another legally permitted purpose — generally requiring a separate authorization for each such disclosure (see Section 7)

You may revoke an authorization in writing at any time, except to the extent we have already acted in reliance on it.

Under Texas Health & Safety Code § 181.154, we hereby give notice that your PHI may be subject to electronic disclosure. Except as provided by law, we may not electronically disclose your PHI to a person without a separate authorization from you (or your legally authorized representative) for each disclosure. Authorization is not required when the electronic disclosure is to another covered entity for treatment, payment, or health care operations, or when disclosure is otherwise permitted or required by state or federal law.

This Notice on our website helps satisfy Texas’s requirement to post general electronic-disclosure notice where patients are likely to see it (in addition to clinic postings and intake acknowledgments).

Federal rules updated in 2024 require Notices of Privacy Practices (effective no later than February 16, 2026) to address substance use disorder (SUD) patient records described in 42 U.S.C. § 290dd-2 and 42 CFR Part 2, when applicable.

If we create or maintain records that are also Part 2 SUD records, those records have additional protections. Among other limits, Part 2 records generally may not be used or disclosed in a civil, criminal, administrative, or legislative proceeding against the individual without the individual’s written consent or a qualifying court order. Where more protective Part 2 rules apply, we follow those rules in addition to HIPAA.

Redisclosure risk: Information we disclose as permitted by this Notice may be subject to redisclosure by the recipient and may no longer be protected by HIPAA or Part 2 once it leaves our control, except where the recipient is also bound by law (for example another covered entity or Part 2 program).

If we do not maintain Part 2 program records, this section still informs you of the general legal framework and redisclosure risk for PHI we disclose.

Certain uses and disclosures of PHI related to reproductive health care may require a signed attestation under HIPAA (§ 164.509) before we disclose PHI for purposes such as health oversight, judicial/administrative proceedings, or law enforcement, when those rules apply. We will follow federal requirements and Texas law then in effect.

Genetic information, HIV-related information, and other specially protected categories may have additional federal or Texas restrictions. Ask the Privacy Officer if you have questions about a specific record type.

Subject to limited exceptions, you have the right to:

• Access / copy your PHI in a designated record set. When we use an EHR capable of fulfilling the request, Texas law generally requires us to provide your electronic health record within 15 business days of a written request (Texas Health & Safety Code § 181.102) — faster than HIPAA’s general 30-day outer limit. We may charge a reasonable, cost-based fee as allowed by law (Texas also sets paper-copy fee caps for physicians in many cases).
• Amend PHI you believe is incorrect or incomplete (we may deny in limited cases and explain your options).
• An accounting of certain disclosures made in the prior six years (with HIPAA exceptions, including many TPO disclosures).
• Request restrictions on uses/disclosures for treatment, payment, or operations. We are not required to agree in all cases, except we must agree to restrict disclosure to a health plan for an item or service you paid for in full out of pocket when disclosure is not otherwise required by law.
• Request confidential communications (e.g., alternate phone, email, or mailing address).
• Receive a paper copy of this Notice even if you agreed to receive it electronically.
• Opt out of optional marketing messages while still receiving necessary care and appointment communications as allowed by law.
• File a complaint without retaliation (Section 14).

To exercise these rights, contact the Privacy Officer (Section 1). We may ask for written requests and reasonable identity verification.

We may share PHI with a person who is your personal representative under applicable law (for example a parent/guardian of a minor, or someone with legal authority for health decisions). Federal and Texas law may limit parental access in certain sensitive situations. Provide any court orders or guardianship papers that affect access.

Texas medical board / practice standards generally expect adult medical records to be retained at least seven years from the last treatment date, and minor records until age 21 or seven years from last treatment, whichever is longer (confirm with counsel and your medical-board guidance). Digital form submissions and intake packets are retained as part of clinic operations and legal holds as needed.

• Hosting: Site and form data may be hosted with cloud providers (including Firebase / Google Cloud services configured for this project) with administrative, technical, and physical safeguards. No Internet transmission is 100% secure.
• Salve Assist chat & treatment planner: Used to guide you toward booking, services, and visit prep. Do not use them for emergencies — call 911 or go to the nearest ER. Chat content you submit may be stored to improve guidance and for clinic follow-up.
• Intake & e-sign portals: Tokenized links collect consents, history, and signatures for care preparation under this Notice.
• Cookies / local storage: Essential preferences (language, UI state). If we add analytics or advertising pixels later, we will update this Notice and provide choices where required.
• Third-party sites: CareCredit, Cherry, Google Maps, Facebook, Instagram, and similar partners have their own privacy policies. Their practices are not controlled by us.
• Emergencies: Website tools are not monitored 24/7 for acute medical crises.

If a breach of unsecured PHI occurs, we will investigate and notify affected individuals and, when required, HHS and/or the media, within the timeframes required by HIPAA and applicable Texas law.

If you believe your privacy rights have been violated, you may complain to us and/or to regulators. You will not be retaliated against for filing a complaint.

• Clinic Privacy Officer — clinicamedicasalve@gmail.com · (214) 235-0607 · 217 W Main St, Suite 110, Grand Prairie, TX 75050
• U.S. HHS Office for Civil Rights: https://www.hhs.gov/ocr/privacy/hipaa/complaints/
• Texas Attorney General: https://www.texasattorneygeneral.gov/

We aim to provide equally effective communication and reasonable accommodations for people with disabilities (vision, hearing, mobility, cognitive, or other needs), including interpreters and accessible forms when reasonably available. Email clinicamedicasalve@gmail.com with “Accessibility” in the subject line to request help with appointments, forms, or this website.

Our public website is not directed to children under 13. We do not knowingly collect personal information online from children under 13 without appropriate parental consent. Clinical care for minors is handled through guardianship and clinic processes.

We may ask you to acknowledge receipt of this Notice (including electronically during intake). Declining to sign an acknowledgment does not prevent you from receiving care; we may document our good-faith attempt to obtain acknowledgment.

• Clínica Médica Salve — Privacy Officer
• 217 W Main St, Suite 110, Grand Prairie, TX 75050
• Phone: (214) 235-0607 · Fax: (214) 602-9042
• Email: clinicamedicasalve@gmail.com