Privacy Policy

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

This notice applies to health information maintained by Chicago Medspa LLC for assessment, good faith exams, treatment, follow-up, payment, and practice operations, including care delivered through telehealth. It is separate from the website privacy policy and from an optional authorization for marketing or release of records.

Privacy Contact: Owner / Managing Member, Chicago Medspa LLC. Address: 30 N Michigan Ave, Suite 1220, Chicago, IL 60602. Telephone: (312) 426-2033. Email: hello@chicagomedspa.com. You may ask for help making a request or obtaining a paper copy. Do not put detailed health information in an ordinary website form or general text message; contact us for the appropriate care or records channel.

You may ask to inspect or receive an electronic or paper copy of your medical record and other information in our designated record set. We will provide it in the requested form and format if readily producible, or agree with you on a readable alternative. We generally act within 30 days; if a permitted extension is needed, we will explain the reason and expected completion date in writing. A reasonable, cost-based fee may apply. If access is denied where the law allows, we will explain the reason and any review rights.

You may request an amendment if information in your record is inaccurate or incomplete. We may deny a request as allowed by law, but will explain why in writing, generally within 60 days, and tell you how to submit a statement of disagreement. A permitted extension will be explained in writing.

You may ask us to contact you in a specific way or at an alternative address or telephone number. We will accommodate reasonable requests. Tell the Privacy Contact how you want to be contacted.

You may ask us to restrict information used or shared for treatment, payment, or health care operations, or with others involved in your care. We are generally not required to agree, except as required by law. If you pay in full out of pocket for a service or item and request that we not disclose its information to a health plan for payment or operations, we will honor that request unless disclosure is required by law. An agreed restriction may not apply in an emergency when the information is needed for treatment.

You may request an accounting of certain disclosures made during the six years before your request. The accounting excludes disclosures for treatment, payment, and health care operations and other exclusions allowed by law, including disclosures made under your authorization. One accounting in a 12-month period is free. We may charge a reasonable fee for additional requests, with advance notice and a choice to withdraw or modify the request.

You may obtain a paper copy promptly and without charge at any time, even if you agreed to receive it electronically. A person legally authorized to act as your personal representative may exercise rights on your behalf, subject to applicable law. We verify that person's identity and authority before acting.

You may complain to the Privacy Contact using the contact information above. You may also complain to the U.S. Department of Health and Human Services Office for Civil Rights at 200 Independence Avenue, S.W., Washington, D.C. 20201; 1-877-696-6775; or https://www.hhs.gov/hipaa/filing-a-complaint/index.html. We will not retaliate against you for a complaint or for exercising your rights.

Treatment: We may use and share information to assess you, plan care, carry out treatment, coordinate care, obtain tests, and provide follow-up. For example, relevant medical history may be used during a good faith exam to determine whether a proposed procedure is suitable.

Payment: We may use and disclose information to charge for services and collect payment. Chicago Medspa LLC is a self-pay practice. For example, we may use the service date and charge to prepare your bill. This does not override a required restriction or a law protecting sensitive records.

Operations: We may use and disclose information for quality review, patient safety, staff training, practice administration, and other permitted operations. For example, we may review records to improve how follow-up instructions are provided. Service companies acting as business associates must agree to required privacy and security protections. We limit information as required by law.

You may tell us whether we may share relevant information with family, friends, or others involved in your care or payment, and your preferences for disaster-relief notifications. If you cannot tell us your preference, we may make a disclosure permitted by law using professional judgment about your best interests. We may also disclose information as permitted to lessen a serious and imminent threat. More protective laws for sensitive records still apply.

Other uses and disclosures not described in this notice require your written authorization. These generally include marketing uses of protected health information, sale of protected health information, and most uses or disclosures of separately maintained psychotherapy notes. Public use of identifiable patient photographs requires a separate, specific authorization. We do not sell protected health information.

You may revoke an authorization in writing at any time by contacting the Privacy Contact. Revocation applies prospectively and does not undo action already taken in reliance on the authorization. Permission for marketing or a public photograph is optional and is separate from treatment consent and receipt of this notice.

We may disclose information when the specific legal conditions are met for public health reporting, product recalls, adverse reactions, reporting suspected abuse or neglect, or preventing a serious threat to health or safety. We may disclose information for legally authorized health oversight, workers' compensation, law enforcement, or special government functions such as military or national-security activities.

We may provide information to coroners, medical examiners, funeral directors, or organ-procurement organizations as permitted by law. Information may be used or disclosed for research only when the applicable authorization, review, or other legal requirements are met. We may disclose information required by law, including to HHS to determine compliance with privacy requirements. Court orders, subpoenas, and other legal requests do not automatically permit every disclosure; the applicable legal conditions and protections for sensitive records must be satisfied.

Illinois law provides additional protection for certain mental-health and developmental-disability records, HIV-related information, genetic testing information, and other sensitive health information. When these laws are more protective, we follow the stricter requirements. A specific written consent may be required even where a general HIPAA permission would otherwise apply; disclosure without that consent is limited to exceptions permitted or required by the applicable law. This notice is not itself consent to release those records.

If we hold substance-use-disorder records protected by 42 CFR Part 2, we apply those additional protections. We will not use or disclose information in those records in civil, criminal, administrative, or legislative investigations or proceedings against you without your written consent or a qualifying court order and a subpoena. A general request for records does not remove this protection. This applies when we receive protected records even if your visit here is for another type of care.

If we use Part 2 information for fundraising communications, we will first give you clear and conspicuous notice and a choice about receiving those communications. For other permitted fundraising communications, you may opt out of further contact; declining will not affect your treatment or payment.

We must maintain the privacy and security of protected health information, follow the duties and practices described in this notice, and give you a copy. We will notify you as required by law if a breach compromises the privacy or security of your information. We will use or disclose information only as described in this notice or with your written authorization.

We may revise this notice. Revised terms may apply to all health information we maintain, including information created before the change. The current notice will be available on request, at our office, and on our website at https://chicagomedspa.com/privacy. The effective date appears at the start of the notice. Your acknowledgment of receipt is not an agreement to waive your rights.