Privacy Policy &
Notice of Privacy Practices

Part I

Website Privacy Policy

Who we are and the scope of this policy

Speight Health LLC, doing business as Front Range Longevity (collectively, “Front Range Longevity,” “we,” “us,” or “our”), is a cash-pay telemedicine medical practice serving eligible patients located in Colorado and Wyoming. This Website Privacy Policy applies to information collected through this website and related online interactions that link to it. It does not replace the HIPAA Notice of Privacy Practices below, which governs protected health information (“PHI”) handled as part of healthcare services.

Third-party patient portals, pharmacies, laboratories, payment processors, and other services may maintain their own privacy notices. Their practices govern information they collect directly from you, except when they act as our business associates or service providers subject to applicable contractual and legal restrictions.

Information we collect

Depending on how you interact with us, we may collect:

• Identity and contact information, such as your name, date of birth, mailing or shipping address, email address, telephone number, and government-issued identification.
• Health and clinical information, such as symptoms, health history, medications, allergies, diagnoses, treatment information, photographs, laboratory results, prescription information, and communications with your provider.
• Transaction and payment information, such as billing contact information, transaction status, and limited payment-related details. Payment-card information may be collected and processed directly by a third-party payment processor; we do not state that we retain full payment-card numbers unless our systems actually do so.
• Account and communication information, including patient-portal records, intake responses, consent forms, appointment details, messages, and customer-support communications.
• Technical information, such as IP address, browser type, device type, operating system, referring pages, pages requested, and timestamps that may be recorded automatically by hosting, security, or network providers.

How we collect information

We collect information directly from you; from your authorized representative; from healthcare providers, pharmacies, laboratories, and other sources involved in your care; through the secure patient portal and other service providers; and automatically through ordinary website hosting and security operations.

Cookies, analytics, and website technologies

The current public website files do not contain advertising pixels, analytics tags, cookie-setting code, or browser local-storage code. The site requests font files from Google Fonts. As with other internet requests, Google and the website’s hosting or network providers may receive technical information such as your IP address, browser information, referring URL, and request time. If our website technology or tracking practices materially change, we will update this policy and provide any notice or choice required by law.

How we use information

We may use information to:

• respond to inquiries, establish and administer patient accounts, verify identity and location, schedule consultations, and provide support;
• evaluate eligibility, provide telemedicine services, coordinate laboratory testing, issue and manage prescriptions, arrange medication fulfillment, and communicate about care;
• process payments, maintain business and clinical records, prevent fraud, secure our services, troubleshoot problems, and enforce our terms;
• comply with legal, licensing, professional, accreditation, payment-network, and certification obligations; and
• protect patients, the public, Front Range Longevity, and others where permitted or required by law.

How we disclose information

We may disclose information to your treating providers and authorized workforce members; pharmacies and laboratories; our electronic health record, telehealth, communications, hosting, security, payment, and professional service providers; government authorities or other persons when permitted or required by law; parties involved in a lawful business reorganization; and others at your direction or with your authorization. Service providers receive only the information reasonably necessary for their functions and are subject to contractual protections where required. When a vendor creates, receives, maintains, or transmits PHI for us, we enter into a Business Associate Agreement when HIPAA requires one.

Sale, targeted advertising, and profiling

Front Range Longevity does not sell PHI. We do not use or disclose PHI for marketing when HIPAA requires your written authorization, and we do not sell personal data or process it for targeted advertising as those terms are defined by the Colorado Privacy Act. The current website does not use advertising pixels or behavioral-advertising trackers. We do not use personal data to make decisions producing legal or similarly significant effects through automated profiling.

Data safeguards, retention, and disposal

We use reasonable and appropriate administrative, technical, and physical safeguards designed to protect information, including role-based access, authentication, secure systems, workforce confidentiality requirements, and vendor oversight, as appropriate to the information and our operations. No internet transmission or storage system can be guaranteed to be completely secure.

We retain information for as long as reasonably necessary to provide services, satisfy medical-record and other legal obligations, resolve disputes, enforce agreements, and support legitimate business operations. We dispose of information using methods reasonably designed to make it unreadable or unrecoverable when retention is no longer required.

Security incidents and breach notification

We investigate suspected security incidents and provide notifications to affected individuals, regulators, or others when required by the HIPAA Breach Notification Rule, applicable Colorado or Wyoming breach-notification law, or another applicable law. The Federal Trade Commission’s Health Breach Notification Rule generally applies to certain vendors of personal health records and related entities that are not covered by HIPAA; we comply with that rule if and to the extent it applies to information or activities outside HIPAA’s coverage.

Children’s privacy

This website and our services are not directed to children under 13, and we do not knowingly collect personal information online directly from children under 13 without legally valid parental consent. Our telemedicine services are intended for adults unless Front Range Longevity expressly agrees to provide a service to a minor with authorization required by law.

External links and services

Links to external websites or services are provided for convenience. We do not control the privacy practices of independent third parties. Review the privacy notice of a third party before providing information directly to it.

Processing outside your state

Our service providers may process or store information in other U.S. jurisdictions. Regardless of processing location, we apply the protections described in this notice and comply with applicable law governing the information.

Colorado and Wyoming privacy rights

Colorado residents. To the extent the Colorado Privacy Act applies to particular personal data and no exemption applies, Colorado residents may have rights to access, correct, delete, and obtain a portable copy of personal data, and to opt out of the sale of personal data, targeted advertising, or certain profiling. We do not currently engage in those opt-out activities. A Colorado resident may submit a request using the contact information below. We may verify the requester’s identity, deny or limit a request where permitted by law, and explain any denial. If we deny a qualifying request, the resident may appeal by replying to our decision and stating that the request is an appeal. If the appeal is denied, the resident may contact the Colorado Attorney General. PHI and certain other information may be exempt from the Colorado Privacy Act but remain protected by HIPAA or other law. Universal opt-out signals are not applicable to our current practices because we do not sell personal data or use it for targeted advertising.

Wyoming residents. Wyoming residents may request access to or correction of their medical records as provided by applicable federal and state law. Wyoming law also requires notice to affected residents in qualifying breaches involving personal identifying information. Requests may be submitted using the contact information below.

Your rights regarding your health information

Subject to legal requirements and limitations, you have the right to:

• Inspect or obtain a copy. You may ask to inspect or receive an electronic or paper copy of health information maintained in a designated record set. We generally will respond within the time required by law and may charge a reasonable, cost-based fee where permitted.
• Request a correction. You may ask us to amend health information you believe is incorrect or incomplete. We may deny the request in certain circumstances, but we will explain the denial in writing within the period required by law.
• Request confidential communications. You may ask us to contact you in a particular way or at a particular location. We will accommodate reasonable requests as required by law.
• Request restrictions. You may ask us not to use or disclose certain information for treatment, payment, or healthcare operations. We are generally not required to agree, except that we must agree to a qualifying request not to disclose information to a health plan for payment or healthcare operations when you paid the relevant item or service in full out of pocket and the disclosure is not otherwise required by law.
• Receive an accounting of disclosures. You may request a list of certain disclosures of your PHI made during the applicable period before your request. The accounting does not include every disclosure, such as many disclosures for treatment, payment, or healthcare operations.
• Receive a paper copy. You may ask for a paper copy of this notice at any time, even if you agreed to receive it electronically.
• Choose someone to act for you. If a person has legal authority to act for you, we will treat that person as your personal representative after verifying the authority, subject to applicable law.
• Complain without retaliation. You may complain to us or to the U.S. Department of Health and Human Services if you believe your privacy rights were violated. We will not retaliate against you for filing a complaint.

Your choices

For certain information, you may tell us your preferences about disclosures to family, friends, or others involved in your care or payment for your care, and for disaster-relief purposes. If you cannot tell us your preference, we may disclose information when we determine it is in your best interest and as permitted by law. We do not sell PHI. We will obtain your written authorization before most uses or disclosures of psychotherapy notes, for marketing when HIPAA requires authorization, or for a sale of PHI. You may revoke an authorization in writing, except to the extent we already relied on it.

How we may use and disclose your PHI

HIPAA permits or requires us to use or disclose PHI in the following circumstances. We apply the minimum-necessary standard when it is required.

• Treatment. We may use or disclose PHI to provide, coordinate, or manage your care, including communication with other healthcare providers, pharmacies, and laboratories.
• Payment. We may use or disclose PHI to bill for services, process payments, determine benefits when relevant, and conduct related activities.
• Healthcare operations. We may use or disclose PHI to operate the practice, improve quality, train and evaluate personnel, conduct compliance and auditing activities, manage risk, obtain legal or professional services, and perform other permitted healthcare operations.
• Business associates. We may disclose PHI to vendors that perform services for us. When required, they must sign agreements requiring appropriate protection and permitted use of PHI.
• Appointment reminders and treatment alternatives. We may contact you about appointments, care coordination, treatment alternatives, or health-related services that may interest you, as permitted by law.
• Public health and safety. We may disclose PHI for permitted public-health activities, reporting suspected abuse or neglect, preventing or reducing a serious and imminent threat, medication or product safety, and health oversight.
• Legal and governmental purposes. We may disclose PHI for workers’ compensation, certain law-enforcement purposes, judicial or administrative proceedings, coroners or medical examiners, organ donation, research under legally authorized conditions, national security, and other purposes permitted or required by law.
• As required by law. We will disclose PHI when federal or state law requires it, subject to applicable conditions and protections.

Substance use disorder records

Records created by a federally assisted substance use disorder treatment program may receive additional protection under 42 CFR Part 2. To the extent Front Range Longevity receives or maintains Part 2 records, those records may not be used or disclosed in civil, criminal, administrative, or legislative proceedings against the patient unless authorized by the patient or permitted by a court order or other applicable law. Uses and disclosures of Part 2 records are subject to the consent and redisclosure rules that apply to those records. Front Range Longevity does not represent through this notice that it operates a Part 2 program.

Our responsibilities

• We are required by law to maintain the privacy and security of PHI and to follow the duties and privacy practices described in the notice currently in effect.
• We will notify affected individuals following a breach of unsecured PHI when required by law.
• We will not use or disclose PHI for a purpose not described in this notice unless you authorize it or another law permits or requires it.
• If Colorado or Wyoming law provides greater privacy protection or access rights for particular information, we will follow the more protective applicable law.