Privacy Policy

Privacy Policy & Notice of Privacy Practices

Last Updated: July 9, 2026 Effective Date: January 1, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

PainterMed, LLC (“PainterMed,” “the Practice,” “we,” “us,” or “our”) is a founder-led concierge telemedicine practice serving eligible patients in Florida, led by Michael Painter, MMS, PA-C. We are committed to protecting the privacy and security of your information, including your Personally Identifiable Information (“PII”) and, where applicable, your Protected Health Information (“PHI”) as defined under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (“HIPAA”).

This document explains how we collect, use, share, and protect information from individuals who visit our website, communicate with us, or receive care from us (“you”). It also serves as our Notice of Privacy Practices describing how we may use and disclose your PHI and the rights you have regarding that information.

By accessing or using our website or services, you acknowledge the practices described in this Privacy Policy. Where HIPAA applies to your PHI, our uses and disclosures are governed by HIPAA regardless of any consent implied by website use.

1. Definitions

Personally Identifiable Information (PII): Information that identifies you as an individual, such as your name, email address, phone number, and similar details you provide.

Protected Health Information (PHI): Individually identifiable health information that we create or receive in connection with providing you care — including your health history, the reasons for your visit, the care recommended, and related information — that is protected under HIPAA.

2. Information We Collect

Information you provide voluntarily. When you visit our website, complete an intake, book a consultation, or communicate with us, we may collect information you choose to share — such as your name, email address, phone number, date of birth, health history, current medications, and the goals or concerns you wish to discuss.

Health information you provide for care. To provide telemedicine services, we collect the health information necessary to evaluate you and, where appropriate, design and monitor a treatment plan. This information is treated as PHI and handled in accordance with HIPAA and the practices described below.

Information collected automatically. When you use our website, we may automatically collect certain technical information, such as your IP address, browser type, device type, referring pages, and the pages you visit.

Cookies and similar technologies. We may use cookies and similar technologies to understand how our website is used and to improve your experience. You can control cookies through your browser settings. Where required, we will seek consent for non-essential cookies.

3. How We Use Your Information

We use the information we collect to:

Provide care. Evaluate your health, and where appropriate, design, deliver, monitor, and adjust your treatment through telemedicine.

Communicate with you. Respond to inquiries, confirm and remind you of appointments, and coordinate your care.

Operate and improve the Practice. Support scheduling, billing where applicable, quality, and the performance and security of our website and services.

Send optional communications. With your permission where required, share educational content or updates. You may opt out of non-essential communications at any time.

Where information is PHI, our uses and disclosures are limited to those permitted or required by HIPAA, as described in Sections 5–7.

4. How We Share Your Information (Website & General)

We do not sell your personal information, and we do not sell or share your PHI for third-party marketing purposes. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. We may share information in the following circumstances:

Service providers. With trusted vendors who support our operations — such as our telemedicine platform, scheduling and intake systems, payment processors, and communications tools. Vendors that handle PHI on our behalf do so under written Business Associate Agreements requiring them to safeguard it.

Legal requirements. When required by law, regulation, subpoena, or other legal process.

Business transfers. In connection with a merger, acquisition, or sale of assets, with your information remaining subject to protections consistent with this policy and applicable law.

5. HIPAA Notice of Privacy Practices — How We May Use and Disclose Your PHI

The following describes the ways we may use and disclose your PHI. Not every use or disclosure will be listed, but all permitted uses fall within the categories below.

For Treatment. We use and disclose your PHI to provide, coordinate, and manage your care — for example, when Michael Painter, MMS, PA-C evaluates your history and medications, designs your protocol, or consults with a pharmacy that will dispense a prescribed therapy.

For Payment. We may use and disclose your PHI to obtain payment for services — for example, to process a payment or, if applicable, to document services rendered.

For Health Care Operations. We may use and disclose your PHI to run the Practice — for example, for quality review, staff evaluation, care coordination, and general administration.

Appointment reminders and communications. We may contact you to provide appointment reminders or information about your care.

Uses and disclosures that may be made without your authorization

As permitted or required by law, we may use or disclose PHI without your authorization for purposes including: as required by law; for public health activities; for reporting abuse, neglect, or domestic violence; for health oversight activities; in judicial and administrative proceedings; for certain law enforcement purposes; to avert a serious threat to health or safety; for specialized government functions; for workers’ compensation where applicable; and to coroners, medical examiners, or funeral directors as permitted by law.

Uses and disclosures that require your written authorization

Most uses and disclosures not described above will be made only with your written authorization. This includes: most uses and disclosures for marketing purposes; any sale of PHI; and disclosure of psychotherapy notes (if any). You may revoke an authorization in writing at any time, except to the extent we have already acted in reliance on it.

6. Your HIPAA Rights

You have the following rights regarding your PHI:

Right to access. You may inspect and obtain a copy of your PHI, in the form and format you request where readily producible, subject to limited exceptions.

Right to amend. You may request that we amend PHI you believe is incorrect or incomplete. We may deny the request under certain conditions and will explain any denial.

Right to an accounting of disclosures. You may request a list of certain disclosures we have made of your PHI.

Right to request restrictions. You may request limits on how we use or disclose your PHI. We are not required to agree to all requests, but we will honor a request to restrict disclosure to a health plan for services you paid for in full out of pocket, as required by law.

Right to request confidential communications. You may ask that we communicate with you in a specific way or at a specific location.

Right to a paper copy. You may request a paper copy of this Notice at any time, even if you agreed to receive it electronically.

Right to be notified of a breach. You have the right to be notified if there is a breach of your unsecured PHI.

Right to revoke authorization. Where you have authorized a use or disclosure, you may revoke it in writing, subject to actions already taken in reliance on it.

To exercise any of these rights, contact us using the information in Section 13.

7. Our Duties

We are required by law to: maintain the privacy and security of your PHI; provide you with this Notice of our legal duties and privacy practices; follow the terms of the Notice currently in effect; and notify you following a breach of unsecured PHI. We reserve the right to change this Notice and to make the revised Notice effective for PHI we already have as well as information we receive in the future. Any revised Notice will be posted on our website with an updated effective date.

8. Data Security and Handling

We use administrative, technical, and physical safeguards designed to protect your information.

Access controls. Access to personal data and PHI is limited to authorized personnel and trusted service providers who need it to support care, scheduling, communication, and coordination.

Encryption and secure transmission. Where supported by our systems, data is encrypted in transit and, where applicable, at rest, to reduce the risk of unauthorized access. Telemedicine visits are conducted over Google Meet. No third parties are attached to or permitted to join your consultations.

Operational safeguards. We maintain internal policies and training intended to support confidentiality and appropriate handling of sensitive information.

Vendor oversight. We select service providers offering security features appropriate for health care and, where they handle PHI, require Business Associate Agreements.

Data retention. We retain information only as long as needed for legitimate clinical, business, and legal purposes, then dispose of it securely in accordance with applicable requirements.

Incident response. If we become aware of a security incident affecting your information, we will take reasonable steps to investigate, mitigate harm, and provide any notices required by law.

No method of transmission or storage is completely secure. While we take care to protect your information, we cannot guarantee absolute security.

9. Mobile Messaging Terms (SMS)

If you provide your mobile number and opt in, PainterMed may send you transactional and, where permitted, promotional text messages (for example, appointment reminders and practice updates) through an automated system.

Consent. By providing your mobile number and opting in, you consent to receive messages from us and confirm the number is yours or that you are authorized to use it. Consent to marketing messages is not a condition of receiving care.

Frequency and rates. Message frequency may vary and will not exceed 10 messages per month. Message and data rates may apply.

Opt-out and help. Reply STOP to opt out or HELP for help. Not all opt-out messages may be recognized by all carriers.

No third-party sharing. Mobile information is not shared with third parties or affiliates for their marketing or promotional purposes.

As-is. Messages are provided “as is.” We are not responsible for delays or delivery failures by mobile carriers.

10. Your Choices and Marketing Preferences

You may opt out of non-essential marketing communications at any time by following the unsubscribe instructions in an email, replying STOP to a text message, or contacting us directly. You may still receive transactional or care-related communications necessary to your treatment and account.

11. Children’s Privacy

Our website and services are intended for adults. We do not knowingly collect personal information from children in a manner inconsistent with applicable law, and our services are not directed to children. Care is provided only to eligible patients in accordance with applicable requirements. If you believe a minor has provided us information improperly, please contact us.

12. Third-Party Links and Changes to This Policy

Our website may contain links to third-party sites we do not control; their privacy practices are governed by their own policies.

We may update this Privacy Policy and Notice of Privacy Practices to reflect changes in law or our practices. Updates will be posted on this page with a revised “Last Updated” date. Please review this page periodically.

13. Complaints

If you believe your privacy rights have been violated, you may file a complaint with us using the contact information below. You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights:

U.S. Department of Health and Human Services, Office for Civil Rights 200 Independence Avenue, S.W., Washington, D.C. 20201 Website: www.hhs.gov/ocr

We will not retaliate against you for filing a complaint.

14. Contact Us

If you have questions or concerns about this Privacy Policy or our privacy practices, or to exercise your rights, please contact:

Privacy Officer: Michael Painter, MMS, PA-C Phone: (954) 800-3290 Email: [email protected] Written privacy complaints and requests to exercise your rights may be submitted to the Privacy Officer by email or phone using the contact details above. A mailing address will be added to this Notice when available.

PainterMed provides concierge telemedicine to eligible patients in Florida, led by Michael Painter, MMS, PA-C.