Privacy Policy and HIPAA Notice of Privacy Practices

Privacy Policy

Effective Date: October 12, 2025

This Privacy Policy explains how GLĒO collects, uses, discloses, and protects information when you visit our website, contact us, or receive our virtual weight health care services across Massachusetts. GLĒO is a 100% cash-based practice and does not bill insurance.

If you are a patient, certain information we maintain may be protected by healthcare privacy laws, including HIPAA. When HIPAA applies, our HIPAA Notice of Privacy Practices governs how we use and disclose protected health information (PHI). This Privacy Policy supplements—does not replace—the HIPAA Notice.

1. Information We Collect

• Information you provide directly:

  • Contact details (name, email, phone).

  • Intake/appointment details submitted via our contact/consultation forms or scheduling tools.

  • Health and wellness information shared during consultations or via forms/telehealth platforms (goals, relevant medical history, medications, allergies, lifestyle factors).

  • Payment information for cash-pay services (processed by our payment processor; we do not store full card numbers).

  • Communications you send to us (email, web forms, telehealth messaging).

• Information collected automatically:

  • Device/usage data (IP address, device identifiers, browser type, pages viewed, referring URLs, date/time stamps).

  • Cookies and similar technologies for functionality, analytics, and performance.

• Information from third parties:

  • Telehealth/EHR platforms, pharmacies, labs, and service providers that support care delivery and operations (subject to appropriate agreements).

  • Patient review or scheduling platforms you use (e.g., Zocdoc).

  • Analytics, communications, and other service providers; publicly available sources.

2. How We Use Information

• Provide and improve services: schedule and conduct virtual visits; personalize care plans; medication support when clinically necessary; coordinate care; maintain records.

• Communications: confirmations, reminders, responses to inquiries, educational content, and service updates.

• Billing and operations: process payments; manage accounts; quality improvement; business records and auditing.

• Legal and compliance: comply with laws; respond to legitimate requests; prevent fraud, abuse, or security incidents; enforce our terms.

• Marketing (non-PHI and as allowed): with your consent where required, send information about services and resources. You can opt out anytime.

When HIPAA applies, PHI uses/disclosures follow the HIPAA Notice and applicable law.

3. Disclosures of Information
   We may disclose information:

• For care and operations: to clinicians/care team, telehealth platforms, pharmacies, and labs involved in your care.

• To service providers (business associates): telemedicine/EHR, scheduling, payment processing, analytics, secure communications—under appropriate contracts and safeguards.

• Legal and safety: to comply with laws, respond to lawful requests, and protect rights, safety, and property.

• Business transfers: in connection with a merger, acquisition, or similar event, subject to confidentiality and law.

• With your direction or consent: to third parties you authorize.

We do not sell personal information. We do not share PHI for targeted advertising.

4. Cookies & Tracking
   We and our providers use cookies, pixels, and similar technologies to enable functionality and perform analytics. You can control cookies in your browser; disabling them may affect site functionality. We do not respond to Do Not Track signals at this time.

5. Data Security
   We use reasonable administrative, technical, and physical safeguards to protect information, including PHI when applicable. No system is completely secure. If you believe your information has been compromised, contact us immediately.

6. Data Retention
   We retain information as needed to provide services, meet legal/medical record retention obligations (including Massachusetts requirements), resolve disputes, and enforce agreements.

7. Your Choices and Rights

• Marketing: opt out of non-transactional emails via unsubscribe links or by contacting us.

• Access/update/delete: request access to or correction of your information. If HIPAA applies, you may have additional rights regarding PHI (restrictions, accounting of disclosures, etc.) as described in our HIPAA Notice.

• Telehealth platform: manage certain privacy settings within the platform we use.

We may verify your identity before fulfilling requests and may deny requests where permitted by law.

8. Insurance and Payment
   GLĒO is 100% cash-based and does not bill insurance. If you independently seek out-of-network reimbursement, you may request documentation; disclosures would only occur at your direction.

9. Children’s Privacy
   Our services are designed for adults. We do not knowingly collect personal information from children under 13 without appropriate consent. If you believe a child has provided information, contact us to request deletion.

10. Third-Party Links and Platforms
    Our site may link to third-party websites/platforms (e.g., Zocdoc, social media, Google Forms). Your interactions are governed by their policies and terms. We are not responsible for third-party practices.

11. Location of Services
    We provide virtual care across Massachusetts. If you access our site from outside the U.S., information may be processed in the U.S., where privacy laws may differ.

12. Changes to This Privacy Policy
    We may update this Privacy Policy from time to time. Changes will be posted here with a revised Effective Date. Continued use after changes indicates acceptance.

13. Contact Us

• Website: gleowellness.com

• Contact page: https://gleowellness.com/contact-gleo-virtual-weight-loss-program-massachusetts

• Email: hello@gleowellness.com

• Phone: 413.429.3039

Please avoid sending sensitive health information via unsecured email.

HIPAA Notice of Privacy Practices

Effective Date: October 12, 2025
Applies to: GLĒO Wellness

This Notice describes how your medical information may be used and disclosed and how you can get access to this information. Please review it carefully.

Our Responsibilities

We are required by law to:

• Maintain the privacy and security of your protected health information (PHI).

• Provide you with this Notice describing our legal duties and privacy practices.

• Follow the terms of the current Notice.

• Notify you following a breach of unsecured PHI as required by law.

How We May Use and Disclose PHI Without Your Authorization

• Treatment: To provide, coordinate, or manage your healthcare and related services. Example: sharing information with a pharmacy to fill a prescription or consulting with another provider.

• Healthcare Operations: For quality assessment, training, accreditation, audits, and administrative purposes. Example: reviewing service quality to improve patient care.

• Payment: Although GLĒO is cash-based and does not bill insurance, “payment” under HIPAA also includes limited activities such as eligibility or documentation you direct us to provide for your own reimbursement claims.

• Individuals Involved in Your Care: To a family member or person involved in your care or payment for care, when appropriate and permitted by law.

• Public Health and Safety: For public health activities; to report abuse, neglect, or domestic violence; to prevent or reduce a serious threat to health or safety.

• Health Oversight and Law Enforcement: To health oversight agencies for activities authorized by law; to law enforcement officials in response to lawful requests.

• Judicial and Administrative Proceedings: In response to court or administrative orders, or in response to subpoenas with required assurances.

• Specialized Government Functions: For military and veterans’ activities, national security, or protective services when required by law.

• Workers’ Compensation: As authorized to comply with workers’ compensation laws and similar programs.

• Research: Under certain conditions and with required approvals or limited data sets.

• Organ and Tissue Donation; Coroners/Medical Examiners/Funeral Directors: As necessary and permitted by law.

• Required by Law: When other laws require disclosure.

Other Uses and Disclosures Require Your Authorization

• Uses/disclosures of PHI for marketing (as defined by HIPAA) or sale of PHI.

• Most uses and disclosures of psychotherapy notes (if applicable).

• Any other use or disclosure not described in this Notice.

If you provide an authorization, you may revoke it at any time in writing, except to the extent we have already taken action in reliance on it.

Your Rights Regarding PHI

• Right to Access: You may request to see or get a copy of your PHI (including electronic copies) in a designated record set, with limited exceptions. We will provide a copy or summary usually within 30 days of your request. Reasonable fees may apply as permitted by law.

• Right to Amend: You may request an amendment to your PHI if you believe it is incorrect or incomplete. We may deny your request in certain circumstances, but we will tell you why in writing.

• Right to an Accounting of Disclosures: You may request a list of certain disclosures of your PHI made in the past six years, excluding disclosures for treatment, payment, and healthcare operations, and certain other exceptions.

• Right to Request Restrictions: You may request that we restrict uses/disclosures of your PHI. We are not required to agree, except we must agree to restrict disclosure to a health plan if the disclosure is for payment or operations, is not otherwise required by law, and you have paid in full out-of-pocket for the item or service.

• Right to Request Confidential Communications: You may request that we contact you in a specific way (e.g., phone, secure portal) or at a different address.

• Right to Receive a Paper or Electronic Copy of This Notice: You may request a paper copy of this Notice at any time, even if you agreed to receive it electronically. A current version is also available on our website.

Telehealth and Electronic Communications

We provide care via telemedicine across Massachusetts. We use secure platforms and reasonable safeguards to protect PHI during virtual visits and electronic communications. Do not share sensitive information via unsecured email or messaging; use our telehealth platform or other secure channels when available.

Complaints

If you believe your privacy rights have been violated, you may file a complaint with us using the contact information below. You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights (OCR). We will not retaliate against you for filing a complaint.

Contact for Privacy Matters, Requests, and Complaints

GLĒO Wellness

• Website: gleowellness.com

• Contact page: https://gleowellness.com/contact-gleo-virtual-weight-loss-program-massachusetts

• Email: hello@gleowellness.com

• Phone: 413.429.3039

Changes to This Notice

We may change the terms of this Notice, and the changes will apply to all PHI we maintain. The current Notice will be posted on our website with the effective date.

Acknowledgment of Receipt

We will provide this Notice at or before your first service where feasible. We may request that you acknowledge receipt of this Notice. Your decision not to sign an acknowledgment will not affect your right to receive care.