Privacy Policy

1. Introduction

OnPoint Performance PLLC ("OnPoint," "we," "us," or "our") is committed to protecting the privacy of our patients and website visitors. This Privacy Policy describes how we collect, use, disclose, and safeguard information when you visit our website, use our patient portal, or receive telehealth services from us.

Please read this policy carefully. If you disagree with its terms, please discontinue use of our services.

2. Information We Collect

We collect the following categories of information:

Personal Identification Information

• Name, date of birth, mailing address, phone number, email address
• Government-issued identification when required for clinical or legal verification

Health and Medical Information

• Medical history, symptoms, laboratory results, medications, and treatment records
• This information is governed by HIPAA when collected in the context of care, and by our HIPAA Notice of Privacy Practices

Payment Information

• Credit or debit card details and billing address, processed through secure third-party payment processors
• We do not store full credit card numbers on our systems

Technical and Usage Data

• IP address, browser type, device information, operating system
• Website usage data collected through cookies and analytics tools
• Technical data is collected at the website level and is not linked to your individual health records

Communications

• Messages sent through our patient portal, email, contact forms, or any other channel where you communicate with us

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and improve our telehealth services and patient care,
• Communicate with you about your care, appointments, and membership,
• Process payments and manage your subscription,
• Comply with legal and regulatory obligations, including HIPAA,
• Send administrative communications and service updates,
• Send educational and wellness information when you have consented to receive it,
• Analyze website usage to improve our online presence and patient experience.

We do not sell your personal information to third parties. We do not use your health information for marketing purposes without your explicit consent. We do not share information with advertising networks or data brokers.

4. Disclosure of Your Information

We may share your information with:

• Healthcare partners: labs, pharmacies, and other providers involved in your care, as necessary to provide services and as permitted by HIPAA.
• Service providers: third-party vendors who assist in operating our website, patient portal, payment processing, communications, and analytics. This includes Practice Better, our HIPAA-compliant patient portal vendor.
• Legal authorities: when required by law, court order, subpoena, or to protect the rights, property, or safety of our patients, staff, or others.
• In a business transition: in the event of a merger, acquisition, or sale of practice assets, your information may be transferred as part of the transaction.

We require all third-party service providers who handle protected health information to sign a Business Associate Agreement (BAA) in compliance with HIPAA. Service providers are contractually required to protect your information and use it only for the purposes for which it was disclosed.

5. Cookies and Tracking Technologies

Our website uses cookies and similar tracking technologies to enhance your experience, analyze site traffic, and understand how visitors interact with our content.

Types of cookies we use

• Strictly necessary cookies: required for the website to function properly.
• Analytics cookies: help us understand site usage so we can improve content and user experience.
• Preference cookies: remember your settings and preferences.

Your cookie choices

You may set your browser to refuse cookies, though some features of the website may not function properly as a result. Our website displays a cookie consent banner where you can manage your preferences.

Do Not Track signals

Some web browsers transmit "Do Not Track" (DNT) signals. There is no industry consensus on how to interpret these signals. At this time, OnPoint Performance does not alter site behavior in response to browser DNT signals. We do not engage in cross-site behavioral advertising, so the practical impact is limited.

We do not use tracking technologies to target advertising based on your health information.

6. Third-Party Websites and Links

Our website may contain links to third-party websites, including peer-reviewed research, government health agencies, and educational resources. We are not responsible for the privacy practices or content of those websites. We encourage you to review the privacy policies of any third-party site you visit.

7. Data Security

We implement administrative, technical, and physical safeguards designed to protect your information from unauthorized access, use, or disclosure. Specific measures include:

• HIPAA-compliant patient portal infrastructure (Practice Better)
• Industry-standard encryption for data in transit and at rest where supported
• Access controls limiting information to authorized personnel only
• Regular review of vendor security practices

No method of data transmission or storage is completely secure. While we take reasonable precautions, we cannot guarantee absolute security. In the event of a data breach affecting your protected health information, we will notify you as required by HIPAA and applicable state law.

8. Data Retention

We retain your personal and health information for as long as necessary to fulfill the purposes outlined in this policy, comply with legal obligations (including medical record retention requirements under Florida law), resolve disputes, and enforce our agreements.

Medical records are retained for a minimum of five (5) years from the date of last service for adult patients, or longer where required by Florida or Texas law. Non-medical website data is retained only as long as needed for the purpose collected.

9. Your Privacy Rights

Depending on your state of residence and the nature of your information, you may have the following rights:

All visitors

• Access the personal information we hold about you,
• Request correction of inaccurate information,
• Request deletion of certain personal information (subject to legal and medical record retention requirements),
• Opt out of non-essential communications.

HIPAA rights (for patients)

If you are a patient, your additional rights regarding protected health information are described in our HIPAA Notice of Privacy Practices.

California residents (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (as amended by the California Privacy Rights Act):

• The right to know what categories of personal information we collect and how we use it,
• The right to request deletion of your personal information,
• The right to correct inaccurate personal information,
• The right to opt out of the sale or sharing of your personal information (we do not sell or share for cross-context advertising),
• The right to limit the use of sensitive personal information,
• The right to non-discrimination for exercising your rights.

How to exercise your rights

To exercise any of these rights, contact us at info@onpointperformancepllc.com. We will respond within the timeframes required by applicable law.

10. Children's Privacy

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected information from a minor, please contact us immediately and we will take steps to delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last Updated" date. Material changes will be communicated to active patients through the patient portal or by email. Your continued use of our services after changes are posted constitutes your acceptance of the revised policy.

12. Contact Us

If you have questions or concerns about this Privacy Policy or about how we handle your information, please contact our Privacy Officer:

OnPoint Performance PLLC
Privacy Officer · Concierge Telehealth Licensed in Florida and Texas
Email: info@onpointperformancepllc.com
Phone: (682) 368-3262