What You Have the Right to Do
As a patient of Prime Metabolic, you have the following rights with respect to your Protected Health Information. To exercise any of these rights, please contact our Privacy Officer using the information at the bottom of this page.
You have the right to inspect and receive a copy of your health information in a designated record set, including your medical history, treatment notes, lab results, and prescription records. We will provide electronic copies in a format you request where readily producible. We may charge a reasonable cost-based fee for copies.
If you believe your health information is incorrect or incomplete, you may request that we amend it. We may deny your request if the information was not created by us, is not part of our records, or is accurate and complete as recorded. If we deny your request, we will explain our reasoning in writing.
You have the right to request a list of disclosures of your PHI made by Prime Metabolic to persons or organizations outside of treatment, payment, or healthcare operations during the six years prior to your request. We will provide one free list per 12-month period; additional requests may incur a reasonable fee.
You may request that we limit how we use or disclose your PHI for treatment, payment, or healthcare operations purposes. We are not required to agree to your request unless you ask us to restrict disclosure to a health plan for services you paid for in full out-of-pocket. Any restrictions we agree to are binding on us.
You have the right to request that we communicate with you about your care in a specific way or at a specific location. For example, you may ask that we contact you only by email or only at a particular phone number. We will honor reasonable requests without requiring you to provide a reason.
You have the right to receive a paper copy of this Notice of Privacy Practices at any time, even if you have agreed to receive it electronically. You may request a copy by contacting our Privacy Officer or by downloading this page. We may change our practices and will update this Notice accordingly.
How We May Use Your Information
The following describes the ways Prime Metabolic may use and disclose your Protected Health Information without requiring your written authorization. All other uses and disclosures require your prior written consent.
Permitted Without Your Authorization
Uses & Disclosures Requiring Your Authorization
The following uses and disclosures of your PHI will only be made with your specific written authorization, which you may revoke at any time in writing (revocation will not affect uses or disclosures already made in reliance on your authorization):
- Marketing communications, including any use of your PHI to encourage you to purchase a product or service
- Sale of your PHI to any third party
- Use or disclosure of psychotherapy notes
- Any other use or disclosure of PHI not described in this Notice or permitted by HIPAA
We do not sell your health data. Prime Metabolic will never sell, rent, or trade your Protected Health Information or personal data to data brokers, advertisers, or any third party for commercial purposes.
Our Duties Under HIPAA
Prime Metabolic is required by law to:
- Maintain the privacy and security of your Protected Health Information
- Follow the duties and privacy practices described in this Notice and as required by HIPAA
- Provide you with this Notice of Privacy Practices and make it available upon request
- Notify you promptly following a breach of your unsecured PHI in accordance with the HIPAA Breach Notification Rule
- Not use or disclose your PHI other than as described in this Notice or as required by law
- Apply this Notice to all PHI we maintain, regardless of whether it was created by Prime Metabolic or received from another source
Changes to This Notice
We reserve the right to change the terms of this Notice at any time. We reserve the right to make the revised or changed Notice effective for health information we already have about you as well as any information we receive in the future. We will post the updated Notice on our website and, where required by law, notify affected individuals directly. You are entitled to a copy of the most current version of this Notice upon request.
The effective date of the current version of this Notice is listed at the top of this page. We encourage you to review this Notice periodically and to contact us with any questions about how your information is used or protected.
How We Protect Your Information
Prime Metabolic maintains comprehensive administrative, technical, and physical safeguards to protect the confidentiality, integrity, and availability of your Protected Health Information, in accordance with the HIPAA Security Rule and applicable state law.
Administrative Safeguards
We have designated a Privacy Officer and a Security Officer responsible for developing, implementing, and enforcing our HIPAA compliance policies. All workforce members who handle PHI receive regular HIPAA privacy and security training. We conduct periodic risk assessments and maintain detailed policies governing access to and handling of PHI.
Technical Safeguards
All PHI transmitted between your device and our platform is protected by TLS/SSL encryption. PHI stored on our systems is encrypted at rest using AES-256 encryption. We enforce role-based access controls, multi-factor authentication for all staff accounts, and automatic session timeouts. All access to PHI is logged and audited.
Physical Safeguards
Our infrastructure is hosted in HIPAA-compliant, SOC 2 Type II certified data centers with physical access controls including badge authentication, surveillance, and environmental controls. Workstations accessing PHI are subject to screen lock policies and clean-desk requirements.
Business Associate Agreements
Any third party that handles your PHI on our behalf — including lab partners, pharmacy fulfillment services, electronic health record providers, and cloud infrastructure vendors — is required to enter into a Business Associate Agreement (BAA) that obligates them to protect your PHI to the same standards we maintain.
Your Right to File a Complaint
If you believe your privacy rights have been violated, or that we have not complied with the requirements of HIPAA or this Notice, you have the right to file a complaint — with us directly or with the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR).
You will not be retaliated against in any way for filing a complaint. We take all complaints seriously and will investigate and respond promptly.
Complaints to HHS OCR may be filed online at hhs.gov/ocr/privacy/hipaa/complaints, by mail to: Office for Civil Rights, U.S. Department of Health and Human Services, 200 Independence Avenue, S.W., Washington, D.C. 20201, or by phone at 1-800-368-1019 (TDD: 1-800-537-7697). Complaints must generally be filed within 180 days of when you knew of the act or omission you are complaining about.
Questions & Requests
To exercise any of your rights described in this Notice, to request a restriction on uses or disclosures of your PHI, to report a concern, or to request a paper copy of this Notice, please contact our Privacy Officer. We will acknowledge your request within 2 business days and fulfill verified requests within the timeframe required by applicable law (generally 30 days, with a 30-day extension available when necessary).
Prime Metabolic LLC
General: hello@prime-metabolic.com
For HIPAA-related requests, please include "HIPAA Request" in your subject line so we can route your inquiry to the appropriate team member.
U.S. Department of Health
and Human Services
hhs.gov/ocr/privacy/hipaa/complaints
Phone: 1-800-368-1019
TDD: 1-800-537-7697. Complaints must generally be filed within 180 days of the alleged violation.
For general privacy inquiries unrelated to your medical care, please refer to our Privacy Policy.