Privacy Policy and Notice of Privacy Practices

Helix Biowellness
2424 Mechanic Street, Galveston, TX 77550
Phone: (409) 498-5011
Email: [email protected]
Website: https://helixbiowellness.com

Effective Date: April 30, 2026
Last Updated: April 30, 2026

Introduction

Helix Biowellness (“Helix Biowellness,” “we,” “us,” or “our“) is committed to protecting the privacy and security of your personal information. This document combines two notices into one:

  • Part A — Notice of Privacy Practices, required by the federal Health Insurance Portability and Accountability Act of 1996 (“HIPAA“), as amended by the HITECH Act and implementing regulations at 45 C.F.R. Parts 160 and 164, and by the Texas Medical Records Privacy Act (Tex. Health & Safety Code Chapter 181, also known as Texas HB 300); and
  • Part B — Website Privacy Policy, which describes how we collect, use, and disclose information collected through https://helixbiowellness.com (the “Site“) and through our marketing communications.

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

If you have questions about this notice, please contact our Privacy Officer using the information at the end of this document.

Part A — Notice of Privacy Practices (HIPAA)

A.1 Our Pledge Regarding Protected Health Information

Helix Biowellness is a HIPAA Covered Entity. We are required by federal and Texas law to:

  • maintain the privacy and security of your Protected Health Information (“PHI“);
  • provide you with this Notice describing our legal duties and privacy practices with respect to your PHI;
  • abide by the terms of the Notice currently in effect;
  • notify you in the event of a breach of unsecured PHI in accordance with the HIPAA Breach Notification Rule and Texas law; and
  • comply with the additional patient-protective requirements of Texas HB 300, including its broader definition of “Covered Entity” and its training, electronic-disclosure, and disclosure-accounting requirements.

“Protected Health Information” or “PHI” means individually identifiable information relating to your past, present, or future physical or mental health, the provision of healthcare to you, or the payment for that care.

A.2 How We May Use and Disclose Your PHI Without Your Authorization

We are permitted by law to use and disclose your PHI without your written authorization for the following purposes:

(a) Treatment. We may use your PHI to provide, coordinate, and manage your healthcare. For example, our providers may review your medical history and lab results to determine appropriate IV therapy, hormone optimization protocols, weight-loss plans, peptide therapy, hyperbaric oxygen therapy, body and skin treatments, or other Services. We may share PHI with consulting physicians, compounding pharmacies, reference laboratories, and other providers involved in your care.

(b) Payment. We may use and disclose your PHI to bill and obtain payment for the Services we provide. This may include verifying coverage with a health plan (where applicable), processing credit-card or financing transactions through Cherry, CareCredit, or similar partners, and communicating with you about balances due. Most of our Services are paid out of pocket; we generally do not bill health insurance.

(c) Healthcare Operations. We may use and disclose your PHI for activities necessary to operate the practice, such as quality improvement, training, credentialing, accreditation, audits, legal services, business management, and customer service.

(d) Business Associates. We engage third parties to perform services on our behalf — for example, electronic health record vendors, scheduling and intake software, secure messaging providers, IT support, billing, accounting, and shredding services. Where these vendors handle PHI, we require them to sign a HIPAA-compliant Business Associate Agreement obligating them to safeguard your PHI.

(e) Appointment Reminders, Treatment Alternatives, and Health-Related Benefits. We may contact you to remind you of upcoming appointments, to inform you about treatment alternatives, or to tell you about health-related products or services that may be of interest. These communications may be sent by telephone, voicemail, email, or text message to the contact information you have provided.

(f) Required by Law. We will use and disclose PHI when required by federal, state, or local law (for example, mandatory reporting of certain conditions or events).

(g) Public Health and Safety. We may disclose PHI to public-health authorities for purposes such as preventing or controlling disease, reporting product defects or adverse events, or when necessary to prevent a serious threat to your health or safety or the health or safety of the public.

(h) Health Oversight; Judicial and Administrative Proceedings; Law Enforcement. We may disclose PHI to health-oversight agencies for audits, investigations, or licensure activities; in response to a court or administrative order, subpoena, or discovery request that meets HIPAA’s procedural safeguards; or to law enforcement under specific HIPAA-permitted circumstances.

(i) Coroners, Medical Examiners, Funeral Directors, and Organ Procurement. We may disclose PHI to identify a deceased person, determine cause of death, or facilitate organ donation as permitted by law.

(j) Workers’ Compensation. We may disclose PHI as authorized by, and to the extent necessary to comply with, workers’ compensation and similar laws.

(k) Specialized Government Functions. We may disclose PHI for military, national-security, protective-services, and certain other specialized government functions authorized by law.

(l) Research, with Safeguards. Where applicable, we may use or disclose PHI for research that has been approved by an Institutional Review Board or Privacy Board and meets all HIPAA requirements.

(m) De-Identified and Aggregated Information. We may use and disclose information that has been de-identified in accordance with the HIPAA Privacy Rule, or that has been aggregated such that it does not identify you, without restriction.

A.3 Uses and Disclosures That Require Your Written Authorization

The following uses and disclosures will be made only with your prior written authorization:

  • most uses and disclosures of psychotherapy notes, where applicable;
  • uses and disclosures for marketing purposes, including before/after photographs, video testimonials, named reviews, or any communication that encourages you (or others) to purchase a product or service for which we receive financial remuneration from a third party;
  • any sale of PHI; and
  • any other use or disclosure not described in this Notice or otherwise required or permitted by law.

You may revoke your authorization in writing at any time, except to the extent we have already acted in reliance on it. Send revocations to our Privacy Officer at [email protected].

A.4 Texas-Specific Protections

In addition to HIPAA, we comply with the Texas Medical Records Privacy Act (Texas HB 300). Among other things, this law:

  • defines “Covered Entity” more broadly than HIPAA;
  • requires biennial training of all employees who handle PHI;
  • gives you the right to receive your electronic health record in electronic form within fifteen (15) business days of a written request, subject to permitted exceptions;
  • restricts the sale of PHI and the electronic disclosure of PHI without your authorization, except for treatment, payment, healthcare operations, insurance functions, or as otherwise permitted by law; and
  • provides additional protections for sensitive categories such as mental-health, substance-use, HIV/AIDS, and reproductive-health information.

We also comply with Texas’s identity-theft and data-breach notification requirements (Tex. Bus. & Com. Code Chapter 521).

A.5 Your Rights Regarding Your PHI

You have the following rights with respect to your PHI:

(a) Right to Inspect and Copy. You may inspect and obtain a copy of your designated record set, including in electronic format where we maintain it electronically. We will respond within thirty (30) days under HIPAA and within fifteen (15) business days for electronic records under Texas HB 300, subject to permitted extensions and exceptions. We may charge a reasonable, cost-based fee as permitted by law.

(b) Right to Request Amendment. You may request that we amend PHI we maintain about you if you believe it is incorrect or incomplete. Requests must be in writing and explain the reason for the requested amendment. We may deny the request under limited circumstances permitted by HIPAA.

(c) Right to an Accounting of Disclosures. You may request an accounting of certain disclosures we have made of your PHI in the six (6) years preceding your request (excluding disclosures for treatment, payment, healthcare operations, those made to you, and certain other categories). One accounting per twelve-month period is provided free of charge.

(d) Right to Request Restrictions. You may request that we restrict how we use or disclose your PHI for treatment, payment, or healthcare operations, or to family members involved in your care. We are not required to agree to all requested restrictions, but we must agree to a request to restrict disclosure of PHI to a health plan if the disclosure is for payment or healthcare operations and the PHI relates solely to a Service for which you have paid us out of pocket in full.

(e) Right to Confidential Communications. You may request that we contact you about medical matters in a particular way (for example, by mobile phone only) or at a particular location. We will accommodate reasonable requests.

(f) Right to a Paper Copy of This Notice. Even if you have agreed to receive this Notice electronically, you may request a paper copy at any time.

(g) Right to Be Notified of a Breach. You have a right to be notified following a breach of unsecured PHI as required by the HIPAA Breach Notification Rule and Texas law.

(h) Right to Designate a Personal Representative. A person with legal authority to make healthcare decisions for you (such as a parent of a minor or a holder of a healthcare power of attorney) may exercise these rights on your behalf.

(i) Right to Complain. You have the right to file a complaint with us or with the U.S. Department of Health and Human Services if you believe your privacy rights have been violated. We will not retaliate against you for filing a complaint.

To exercise any right, please submit a written request to our Privacy Officer using the contact information at the end of this document. Filing a complaint with HHS may be done at https://www.hhs.gov/hipaa/filing-a-complaint or by mail to the Office for Civil Rights, U.S. Department of Health and Human Services.

A.6 Our Duties

We are required by law to maintain the privacy of your PHI and to provide you with this Notice. We must abide by the terms of the Notice currently in effect. We reserve the right to change the terms of this Notice and to make the new terms effective for all PHI we maintain. The current Notice is available at our clinic and at https://helixbiowellness.com/privacy-policy/.

A.7 Breach Notification

In the event of a breach of unsecured PHI, we will notify you without unreasonable delay and in no case later than sixty (60) calendar days after discovery of the breach, in accordance with the HIPAA Breach Notification Rule (45 C.F.R. §§ 164.400–414) and Texas law (Tex. Bus. & Com. Code Chapter 521). Where required by law, we will also notify the U.S. Department of Health and Human Services, the Texas Attorney General, and the major credit reporting agencies. Our breach notification will include a description of what happened, the categories of information involved, the steps you can take to protect yourself, and the steps we are taking to investigate, mitigate harm, and prevent recurrence.

A.8 Nondiscrimination (Section 1557)

Helix Biowellness complies with applicable federal civil-rights laws and does not discriminate on the basis of race, color, national origin, age, disability, sex, sexual orientation, gender identity, or sex characteristics. We provide free language-assistance services to people whose primary language is not English and free auxiliary aids and services to people with disabilities. To request these services, contact our Section 1557 / Civil Rights Coordinator at [email protected] or (409) 498-5011 (the role is held concurrently by our Privacy Officer).

If you believe that Helix Biowellness has failed to provide these services or has discriminated in another way, you may file a grievance with the Coordinator above, or you may file a civil-rights complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, electronically at https://ocrportal.hhs.gov/ocr/portal/lobby.jsf, by mail at 200 Independence Avenue SW, Room 509F, HHH Building, Washington, DC 20201, or by phone at 1-800-368-1019 (TDD: 1-800-537-7697).

ATENCIÓN: si habla español, tiene a su disposición servicios gratuitos de asistencia lingüística. Llame al (409) 498-5011.
CHÚ Ý: Nếu bạn nói Tiếng Việt, có các dịch vụ hỗ trợ ngôn ngữ miễn phí dành cho bạn. Gọi số (409) 498-5011.
注意：如果您使用繁體中文，您可以免費獲得語言援助服務。請致電 (409) 498-5011。

Part B — Website and Marketing Privacy Policy

B.1 Scope

This Part describes how we handle information collected through the Site, online forms, our SMS/text-message program, marketing emails, and our online interactions with prospective and current clients. It applies in addition to — and does not replace — the HIPAA Notice in Part A. Where the same information qualifies as PHI, the HIPAA Notice in Part A controls.

B.2 Information We Collect

(a) Information you provide directly. When you book an appointment, complete an intake or contact form, sign up for our newsletter, opt in to text messages, apply for financing, purchase a Service or membership, or otherwise communicate with us, you may provide information such as your name, date of birth, mailing address, email address, mobile phone number, demographic information, payment-card information (handled by our PCI-compliant processor), insurance information (where applicable), and information about your health goals, medical history, medications, and lifestyle.

(b) Information collected automatically. When you visit the Site, we and our service providers may automatically collect technical and usage information, including IP address, device and browser identifiers, operating system, referring/exit pages, pages viewed, time spent, and approximate geographic location derived from your IP. This information is collected through cookies, pixels, web beacons, server logs, and similar technologies.

(c) Information from third parties. We may receive information from financing providers (such as Cherry and CareCredit) about the status of an application, from advertising platforms about the effectiveness of our campaigns, and from referring providers, laboratories, and pharmacies.

B.3 Cookies and Similar Technologies

We use the following categories of cookies and similar technologies:

  • Strictly necessary — required for the Site to function (for example, to load pages and remember your form inputs).
  • Performance / analytics — help us understand how visitors use the Site so we can improve it (for example, Google Analytics).
  • Functional — remember your preferences.
  • Advertising / targeting — used by us and our advertising partners to deliver and measure ads relevant to you on third-party platforms (for example, Meta/Facebook Pixel, Google Ads).

You can control cookies through your browser settings, your device’s privacy settings, or any cookie-preference tool we make available on the Site. Disabling some cookies may degrade functionality.

We honor browser-based opt-out signals such as Global Privacy Control (GPC) where required by applicable law. We do not currently respond to “Do Not Track” headers because no industry standard has been adopted.

B.4 How We Use Information Collected Through the Site

We use Site and marketing information to:

  • respond to inquiries and provide the Services you request;
  • schedule, confirm, and remind you of appointments;
  • process payments, deposits, memberships, and financing applications;
  • operate, maintain, secure, and improve the Site;
  • conduct analytics, including measuring engagement and ad effectiveness;
  • send you transactional communications (such as appointment confirmations and account notices);
  • send you marketing communications, with your consent where required;
  • detect and prevent fraud, abuse, and unauthorized access; and
  • comply with our legal obligations and enforce our terms.

We do not use Site analytics or advertising tools in a way that discloses PHI to third parties for their own purposes except as permitted under HIPAA. Consistent with U.S. Department of Health and Human Services Office for Civil Rights guidance on online tracking technologies (most recently updated in March 2024), we do not deploy advertising pixels (including the Meta Pixel and Google Ads conversion tags) or third-party behavioral analytics on any page of the Site that collects health information, that contains protected health information, or that is uniquely associated with a particular health condition or treatment — including patient intake forms, appointment-booking pages, patient-portal pages (if and when offered), and condition-specific service pages where the URL or content reveals a health condition. Where any third-party tracking technology is permitted to operate on non-PHI pages, we configure it to limit shared data, and where a Business Associate relationship is required we maintain a written Business Associate Agreement.

B.5 SMS / Text-Message Program (TCPA)

By providing your mobile number and opting in (for example, by checking a consent box on a form, replying to an opt-in keyword, or otherwise affirmatively agreeing), you expressly consent to receive recurring text messages from Helix Biowellness, including messages sent using an automatic telephone dialing system or pre-recorded voice. Consent is not a condition of purchasing any Service.

  • Message frequency varies based on your interactions with us.
  • Message and data rates may apply from your mobile carrier.
  • Reply HELP for help, STOP to unsubscribe at any time.
  • For assistance, call (409) 498-5011 or email [email protected].
  • Carriers are not liable for delayed or undelivered messages.

We do not sell or share mobile-opt-in data or consent for promotional purposes with any third party. Categories of texts you may receive include appointment reminders, intake links, billing notices, treatment follow-ups (where applicable), and — if you have opted in — promotional offers.

B.6 Email Marketing (CAN-SPAM)

We may send marketing emails to recipients who have provided an email address. Marketing emails will identify themselves as such and include an unsubscribe link. You may also email [email protected] to be removed. Unsubscribing from marketing emails will not stop transactional or treatment-related communications you have requested.

B.7 How We Share Information

We do not sell your personal information for monetary consideration. We share information only as follows:

  • With your authorization (for example, when you direct us to send records to another provider).
  • Service providers and business associates who perform services on our behalf (EHR, scheduling, payment processing, financing partners, IT and security, hosting, analytics, advertising platforms, communications providers, and professional advisors), bound by contracts that limit their use of the information.
  • Treatment, payment, and healthcare operations as described in Part A.
  • Legal and safety disclosures: when required by law, court order, or subpoena; to cooperate with regulators or law enforcement under legally permitted circumstances; to enforce our Terms; or to protect the rights, property, or safety of Helix Biowellness, our patients, or others.
  • Business transfers: in connection with a merger, acquisition, financing, reorganization, or sale of assets, in which case the recipient will be bound by privacy commitments at least as protective as those in this Notice.
  • Aggregated or de-identified information that does not identify you.

For the purposes of California, Texas, and other state privacy laws that define “sale” or “sharing” broadly, we treat the use of advertising cookies and pixels as a “sharing” of personal information for cross-context behavioral advertising. You may opt out of such sharing using the cookie-preference tool on the Site, by enabling Global Privacy Control in your browser, or by emailing [email protected].

B.8 Data Security

We maintain administrative, physical, and technical safeguards designed to protect personal information and PHI consistent with the HIPAA Security Rule (45 C.F.R. Part 164, Subpart C), Texas HB 300, and Tex. Bus. & Com. Code Chapter 521. These include access controls, encryption of PHI in transit and at rest where feasible, workforce training, audit logging, and a written incident-response plan.

Payment-card data. Payment-card information is collected, transmitted, and processed by a PCI-DSS-compliant third-party payment processor. Helix Biowellness does not store full payment-card numbers, magnetic-stripe data, CVV/CVC values, or PIN data on its own systems.

No method of transmission or storage is 100% secure; we cannot guarantee absolute security. Do not transmit sensitive medical information through unencrypted email or social media.

B.9 Data Retention

We retain personal information and PHI only for as long as necessary to fulfill the purposes described in this Notice, to provide the Services, to comply with our legal, accounting, tax, and reporting obligations, and to resolve disputes and enforce our agreements. Texas medical records are generally retained for at least seven (7) years from the anniversary of the date of last treatment, and longer for minors and as otherwise required by law (Texas Medical Board Rule 165.1). When PHI is no longer needed and retention is no longer required, we destroy it in accordance with HIPAA and Texas HB 300 standards.

B.10 Your Privacy Rights Under State Law

Depending on your state of residence, you may have additional privacy rights, including the right to know, access, correct, delete, port, or limit the use of your personal information, and the right to opt out of certain “sales” or “sharing” of personal information and of profiling that produces legal or similarly significant effects. These rights apply to information that is not subject to HIPAA; PHI subject to HIPAA is governed by Part A above.

To exercise a state-law right, contact us at [email protected] or (409) 498-5011 with the request and information sufficient to verify your identity. We will respond within the time required by your state’s law, generally within forty-five (45) days. We will not discriminate against you for exercising any privacy right. You may designate an authorized agent to act on your behalf.

Texas residents have rights under the Texas Data Privacy and Security Act, including the right to know, correct, delete, port, and opt out of targeted advertising, the sale of personal data, and certain profiling. To opt out, use the cookie-preference tool on the Site or contact us as described above. You may appeal a denial of a request by emailing [email protected]; if your appeal is denied, you may submit a complaint to the Texas Attorney General at https://www.texasattorneygeneral.gov.

B.11 Children’s Privacy

The Site is not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13 through the Site. Clinical Services for minors are provided only with parental or legal-guardian consent and presence as required by law and clinical protocol.

B.12 International Visitors

The Site is operated from the United States and is intended for residents of the United States. If you access the Site from outside the United States, you understand that your information will be transferred to, processed, and stored in the United States in accordance with this Notice.

B.13 Third-Party Sites and Social Media

The Site may link to third-party websites, social-media platforms, and applications that we do not control. Their privacy practices are governed by their own policies, not this Notice.

B.14 Changes to This Notice

We may update this Notice from time to time. The “Last Updated” date above will reflect the most recent revision. For material changes affecting Part A (HIPAA), we will post the revised Notice in our clinic and on the Site, and we will provide a copy upon request. Your continued use of the Site or Services after the effective date of any update constitutes your acceptance of the revised Notice.

B.15 How to Contact Our Privacy Officer

To ask a question about this Notice, exercise a right, request a copy, or file a complaint, please contact:

Helix Biowellness — Privacy Officer
2424 Mechanic Street
Galveston, TX 77550
Phone: (409) 498-5011
Email: [email protected]

You may also file a complaint with:

We will not retaliate against you for filing a complaint.