Privacy Policy

Who we are

This notice describes how Palm Beach Metabolic Care handles information collected through our website, our patient portal, and our iPhone app.

Palm Beach Metabolic Care, 4700 N Congress Ave, Suite 103, West Palm Beach, FL 33407. Telephone (561) 972-8002.

Palm Beach Metabolic Care is a physician-supervised metabolic care program operated under the clinical direction of Plastic Surgery of Palm Beach, P.A., a Florida professional association. Plastic Surgery of Palm Beach, P.A. is the covered entity responsible for the clinical services. Palm Beach Metabolic Care itself is not a separate legal entity for purposes of these policies.

Where your information is stored

Your information is stored on a server controlled by the practice, not on a third-party health platform. It is not stored with a cloud health-records vendor, and it is not shared with one.

Traffic between your device and our server is encrypted in transit. Backups are encrypted before they leave the server, using a key the server itself does not hold.

Clinical and member data managed through our systems (including the Palm Beach Metabolic Care member portal) is held securely on site at the practice. We maintain appropriate physical, administrative, and technical safeguards to protect the information. We do not publish the precise physical location of on-site servers or storage systems.

What we collect

Account information you give us: name, email address, and optionally a telephone number.

Health information you record: weights and the dates you recorded them, medication doses you log, weekly check-ins, side-effect notes, and how you say you are feeling.

Messages you send to your care team through the portal or app.

Appointment records entered by our staff.

If you turn on notifications, a device token that lets us send them. Notifications never contain health information — they say only that something is waiting for you in the app.

Basic technical records of requests to our server, kept for security and troubleshooting. Web-server logs record the page requested, not the full address, so a password-reset link is never written to a log.

What we do not collect

We do not use advertising trackers, analytics pixels, or third-party marketing tags on the patient portal or in the app.

We do not sell your information. We do not share it for advertising.

We do not use your health information to train artificial-intelligence systems, and no patient information of any kind is sent to any AI service.

Who can see your information

You can see your own information. Our clinical and administrative staff can see the information they need to provide your care.

Our systems are built so that one patient cannot see another patient’s records. This is enforced by the application and, separately, by the database itself.

We use third-party vendors (Business Associates) that may receive or access protected health information in order to provide services to us. These include:

Nextech Systems, LLC — our electronic health record (EHR) and practice-management system, which is also used for billing and related payment activities. A Business Associate Agreement is in place with Nextech.

Twilio (SendGrid) — used to send transactional emails, including password resets, appointment notices, and certain automated care-team messages. A Business Associate Agreement is in place with Twilio.

We only share the minimum information necessary for these vendors to perform their functions, and each is required by contract (Business Associate Agreement) to protect the information in accordance with HIPAA.

How long we keep information

Clinical records are retained in accordance with Florida law and professional standards. Florida Board of Medicine rules generally require physicians to retain medical records for at least five years from the last patient contact; many practices retain longer for malpractice and operational reasons. The Palm Beach Metabolic Care platform does not automatically delete patient data. Records are retained for the period required by applicable law and our internal retention policy, after which they may be securely destroyed or de-identified.

Deleting your account

You may ask us to delete your account, and you can request this from within the app.

When an account is deleted, your identifying details are overwritten so the account can no longer be used or connected to you. A record that certain actions occurred is retained, without your identifying information, because a medical practice must be able to show what happened to a record and when.

You may request deletion of your member account (sign-in credentials and portal profile). Account deletion removes your ability to log in and removes certain identifying details from the member-facing portal. It does not erase the practice’s legal obligation to retain a clinical medical record under Florida law and professional standards. Clinical records are retained according to the retention policy described above and are not deleted solely because a portal account is closed.

Your rights

You may ask for a copy of the information we hold about you, ask us to correct it, or ask questions about how it is handled.

Under HIPAA you have the right to access and obtain a copy of your protected health information in our designated record set. Requests are handled manually by the practice (self-service electronic export is not currently available). We will respond to a valid request within the time required by HIPAA (generally 30 days, with one possible 30-day extension). We may charge a reasonable, cost-based fee for copies as permitted by law. To exercise this right, contact the practice using the contact information provided in this Notice / Privacy Policy.

To make a request, contact us at (561) 972-8002.

Children

This service is not intended for anyone under 18, and we do not knowingly create accounts for minors.

Palm Beach Metabolic Care and the associated member portal are intended for adults. We do not knowingly collect personal information from individuals under 18 years of age through the portal or membership program. The program is not directed to children.

Changes to this notice

If we change this notice we will post the updated version here and change the date at the top.