Legal · HIPAA

HIPAA Notice of Privacy Practices

Effective: January 1, 2026  ·  Last updated: May 25, 2026
Holistic4Spirit · Elena Y. Davis, ND · 102 E Victoria Ct A, Greenville, NC 27858 · (252) 916-9462

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Our Commitment to Your Privacy

Holistic4Spirit ("we," "our," or "the Practice") is committed to protecting the privacy of your Protected Health Information (PHI). This Notice describes how we may use and disclose your PHI, your rights regarding that information, and our legal duties. We are required by HIPAA (Health Insurance Portability and Accountability Act of 1996) and the HITECH Act, as amended by the Omnibus Rule, to maintain the privacy and security of your PHI.

What Is Protected Health Information?

PHI is information that may identify you and relates to your past, present, or future health condition, the health care services we provide to you, or payment for those services. In our practice, PHI includes: your name, address, date of birth, medical history, treatment records, intake forms, skin condition documentation, clinical before-and-after images, hormone and food sensitivity test results, supplement records, billing information, and health-related communications.

How We Use and Disclose Your PHI

Treatment

We use PHI to provide, coordinate, and manage your care. For example, treatment notes inform subsequent visits, and consultation records guide personalized treatment plans.

Payment

We use PHI to process payments for services, including billing your payment method and maintaining financial records related to your care.

Healthcare Operations

We use PHI for quality assessment, staff training, scheduling, and other administrative functions necessary to operate our practice.

Other Permitted Disclosures (No Authorization Required)

Marketing and Sale of PHI

We will never use or disclose your PHI for marketing purposes, or sell your PHI to any third party, without your explicit written authorization. We do not engage in these practices.

Your Rights Regarding Your PHI

Right to Access
Request access to and copies of your PHI in our records. We respond within 30 days. A reasonable cost-based fee may apply for copies.
Right to Amend
Request correction of PHI you believe is incorrect or incomplete. We may deny if we determine the information is accurate and complete.
Right to an Accounting
Request a list of certain PHI disclosures made in the past 6 years, excluding disclosures for treatment, payment, and operations.
Right to Restrict Use
Request restrictions on how we use or disclose your PHI. We must agree if you paid out-of-pocket in full for a service.
Right to Confidential Communications
Request we contact you via alternative means or at an alternative location. We will accommodate reasonable requests.
Right to a Paper Copy
Receive a paper copy of this Notice at any time, even if you agreed to receive it electronically. Request at the front desk or by phone.

Technology Platform & Business Associate

CTE Studios — HIPAA Business Associate

This digital platform is developed and maintained by CTE Studios. A Business Associate Agreement (BAA) is in place between Holistic4Spirit and CTE Studios as required by 45 CFR §164.308(b)(1). CTE Studios implements the following safeguards:

  • All data in transit encrypted with TLS 1.3 or higher
  • All data at rest encrypted with AES-256
  • Row-level security isolates each client's records
  • PHI access restricted to authorized personnel with full audit logging
  • Health notes, intake forms, and treatment records visible only to Elena and authorized staff
  • No PHI used for marketing, sold to third parties, or shared without a BAA
  • Breach notification to Holistic4Spirit within 60 days of discovery per 45 CFR §164.410
  • PHI returned or destroyed upon service termination per HIPAA requirements

All downstream sub-processors who may access PHI — including our database provider (Supabase) and payment processor (Stripe) — have executed Business Associate Agreements and maintain HIPAA-compliant infrastructure.

Breach Notification

If a breach of your unsecured PHI occurs, we will notify you without unreasonable delay and no later than 60 calendar days from discovery, as required by 45 CFR §164.404. The notification will include a description of the breach, types of PHI involved, steps you can take to protect yourself, what we are doing to investigate and mitigate the breach, and contact information for questions.

North Carolina State Law

We comply with applicable North Carolina laws governing health information privacy. Where North Carolina law provides greater privacy protections than HIPAA, we follow state law. We are also subject to oversight by the North Carolina Medical Board and the North Carolina Board of Cosmetic Art Examiners with respect to the scope of our practice.

Complaints

If you believe your privacy rights have been violated, you may file a complaint with us or with the U.S. Department of Health and Human Services Office for Civil Rights. We will not retaliate against you for filing a complaint.

Privacy Contact — Holistic4Spirit

Elena Y. Davis, ND (Privacy Officer)
102 E Victoria Ct A, Greenville, NC 27858
(252) 916-9462 · privacy@holistic4spirit.com

U.S. Department of Health and Human Services — Office for Civil Rights

hhs.gov/ocr/privacy/hipaa/complaints · (800) 368-1019 · TDD: (800) 537-7697

Changes to This Notice

We reserve the right to change this Notice and to make the new provisions effective for all PHI we maintain. Current Notice will always be posted at our practice and at holistic4spirit.com/legal/hipaa. The effective date appears at the top of the Notice.