Privacy policy

• We collect what you give us so that a licensed provider can review your health and care for you.
• We do not sell your information, and we do not use it for advertising.
• Visit counts and Google Analytics run only on our public pages, only if you accept them, and you can change your mind at any time. They never run on the intake or the patient portal.
• Only people who need your records to do their job can open them.
• You can ask us for a copy of your information or ask us to correct it.

This policy is from CorePhia, a weight loss program based in Tampa, Florida. It covers this website, the patient intake, the contact form, and the patient portal. It applies to visitors, people who apply, and patients.

Information you give us as a patient is also covered by our Notice of Privacy Practices (linked at the end of this page), which explains your rights over your health records. If anything in that notice is more protective than this page, the notice controls for your health information.

Information you give us:

• On the intake: your name, date of birth, sex assigned at birth, phone, email, and home address; your height, current and goal weight, and highest adult weight; your medical conditions, medications, allergies, surgeries, past weight loss treatment, and interest in medication; your family medical history; your tobacco and alcohol use and how often you exercise; what and how much you eat and drink; the plan you are interested in and when you would like a visit; any notes you add; and your agreement to the telehealth consent and privacy acknowledgement with your typed signature and the date.
• On the contact form: your name, email, what you are interested in, and your message.
• In the patient portal: your login email, the weights you log, and the messages you send. Your password is handled by our sign-in service. Our staff cannot see it.
• When you call or email us: what you tell us and your contact details.

Information our care team creates about you once you are a patient: appointment records, visit notes, plans, prescriptions and vitals, and the updates and messages they send you through the portal.

Information collected automatically:

• Visit counts, only if you press Accept on the privacy banner. We record which page was viewed or which link or button was clicked, and the day. We do not use cookies for this, and we do not record your IP address or give you a visitor ID, so these counts cannot be tied to you. We do not count anything you do inside the intake, the patient portal, or the staff area.
• Server logs. Our hosting provider keeps routine logs of requests to the site (such as IP address, browser type, and the pages requested) for security and to keep the site running.
• Google Analytics, only if you press Accept, and only on our public pages (such as the home, program, guide, FAQ, and membership pages). It uses cookies to tell Google which pages were visited, how long, the kind of device and browser, the approximate location (city level), and how you arrived at the site. It never runs on the intake, the patient portal, or the staff area, so it never receives anything you tell us about your health. We have turned off Google's advertising features. Google handles this data under its own privacy policy. If you later press Decline, it stops and its cookies are removed.

Until you press Send, what you type into the intake stays in your own browser. We receive it only when you submit.

• To review your intake, decide with you whether the program fits, and arrange your first visit.
• To provide and document your care, including prescriptions when a provider decides they are appropriate.
• To run your patient portal, schedule visits, and answer your messages and questions.
• To send you notification emails that something is waiting for you in your portal.
• To understand, in anonymous counts, which pages people use, so we can improve the site.
• To keep the site and patient records secure, to prevent misuse, and to meet legal and professional obligations.

We do not use your health information to market to you, and we do not sell it.

• Your care team. The licensed providers, dietitian, and staff involved in your care, and only as much as each needs.
• Service providers that help us run the program. They handle information for us and not for their own purposes. Today these are Google Firebase (our database, sign-in, and site hosting), EmailJS (which delivers our notification emails), and, if you accept, Google Analytics on our public pages. The notification emails go to your address and say only that something is waiting for you. They never contain health details.
• Pharmacies and other health professionals, when a provider sends a prescription or refers you, as your care requires.
• People you ask us to share with, and anyone you give written permission to. For example, we publish a patient's story only with their written permission.
• Authorities or others when the law requires it, to respond to a valid legal process, or to protect someone from serious harm.
• A buyer or successor, if CorePhia is ever sold or reorganized. Patient records would stay protected by law.

We do not sell your personal information and we do not share it for advertising.

We treat the health information you give us as confidential. Where HIPAA applies to us, we follow it, and our Notice of Privacy Practices describes how your health information may be used and disclosed and your rights over it. Florida law on the confidentiality of patient records also applies.

Submitting an intake does not make you a patient. Your records are part of a medical record once a CorePhia provider accepts you.

We set no advertising cookies. If you accept on the privacy banner, Google Analytics sets its cookies (named _ga) on our public pages. Otherwise the site stores a few small items in your browser so it can work: your answer on the privacy banner, whether you are signed in to the patient portal on this device, and the sign-in your portal login needs. The intake keeps a note that you have seen its intro screen for the length of your visit.

We do not track you across other websites, so we do not respond to "Do Not Track" signals. You can clear stored items in your browser settings at any time. Use "Privacy choices" in the footer to change your answer about visit counts.

Patient records are kept for as long as Florida law and professional rules require medical records to be kept, even after you stop the program. Other information, such as a contact message or an intake from someone who did not become a patient, is kept only as long as we need it for the reasons above. Visit counts contain no personal information and may be kept as totals.

Patient records can be opened only by signed-in staff, and each person sees only what their role allows. Staff sign-ins time out when they go idle, and we keep an activity log of what staff do in the system. Information you send to us travels over an encrypted connection.

No website or storage system is completely secure. If a breach affects your information, we will tell you and the authorities as the law requires, and without unreasonable delay. Please do not send health details by regular email. Use the patient portal or call us.

• Ask for a copy of your records. Patients have a right to see and receive a copy of their medical record.
• Ask us to correct information that is wrong or incomplete.
• Ask us to delete information we are not required to keep. We cannot delete medical records we must keep by law.
• Change your answer about visit counts at any time with "Privacy choices" in the footer.
• Ask about, or complain about, how we handled your information. We will not retaliate against you for doing so.

To use any of these, write to info@corephia.com or call +1 (850) 454-6700. We may need to confirm who you are first, because we will not give a person's records to someone else. We aim to answer within 30 days. If a request takes longer, we will tell you why and when to expect an answer.

CorePhia serves patients in the United States, and the intake, contact, portal, and chart information you give us is stored in the United States. If you use the site from another country, you understand that your information will be handled here under US law.

The program is for adults, and the site is not directed to children under 13. We do not knowingly collect information from children. If you believe a child has sent us information, contact us and we will remove it.

When we change this policy, we change the date at the top. If a change materially affects how we treat your health information, we will tell current patients through the portal or by email before it takes effect.