Privacy Policy

This Privacy Policy is issued by Fingertips Acupuncture and Wellness LLC (“Fingertips,” “we,” “us,” or “our”) for fingertipsacupuncture.com. Part I addresses website information, inquiries, cookies, and planned online booking. Part II is our Notice of Privacy Practices for protected health information and explains patient privacy rights, permitted disclosures, our legal duties, and complaints.

Patients: Please review Part II — Notice of Privacy Practices — below. You may request a paper copy from our Privacy Contact at any time.

Part I: Website Information and Cookies

1. Information you provide

We receive information you choose to give us by telephone or email, including your name, contact details, and scheduling or general inquiry. Selecting an email link opens your email application; it does not submit a WordPress contact form. Please keep ordinary email inquiries limited to scheduling and general questions. Call the clinic to arrange an appropriate method for medical histories, symptoms, records, identification numbers, or payment card details.

We plan to use Jane for online booking and patient intake. When our Jane service is available and you use it, information collected may include contact details, date of birth, appointment details, relevant medical history, symptoms, medications, consent responses, and billing or insurance information, depending on the services and forms used. Payment details, if requested, are handled through the payment services presented to you.

2. Hosting and technical information

Our website uses WordPress software and is hosted by GoDaddy. GoDaddy and the website delivery and security infrastructure, including Cloudflare, process technical information to deliver pages, manage traffic, protect the site, and troubleshoot errors. This can include IP addresses, browser and device information, requested pages, request times, and referring addresses where provided by your browser. WordPress is the website software; its use does not mean that WordPress.com hosts this website.

The website includes GoDaddy SCC C2 traffic analytics and page-performance code. These technologies can process visitor and session identifiers, page requests, browser and device information, referral information, and performance data. GoDaddy code can also record clicks on elements marked with its event identifiers. These technologies are addressed in Section 3, which also identifies the pages on which they are not used.

3. Cookies and similar technologies

Cookies are small files stored in a browser. Session cookies generally last for a browsing session; persistent cookies remain until they expire or are deleted. Local storage and similar technologies may also retain preferences or identifiers. These technologies can process personal information and are not necessarily anonymous.

Cloudflare security: The website uses the __cf_bm cookie for bot management and protection against automated traffic. Cloudflare describes its expiry as 30 minutes of continuous inactivity; it may be renewed as you continue using the website.

GoDaddy analytics: The website includes traffic and performance measurement that may use visitor, visit, and session identifiers. Cookie names, retention, and behavior depend on provider and hosting configuration. This policy does not represent that analytics identifiers are anonymous or used only during one browsing session.

WordPress functions: Authentication, security, and preference cookies may be used when login or related functions are accessed. Cookies associated with administrator settings or login are distinct from cookies used during ordinary public browsing. They include cookies whose names begin with wordpress_logged_in_, wordpress_sec_, and wp-settings-, and the wordpress_test_cookie cookie, which are set only when the login page or the website’s administration is used. WordPress comment cookies are set only if comments are enabled and a commenter chooses to save their details.

Website preferences: Reading tools on the website remember some choices in your browser’s local storage: text size, which Community Hub articles you have read, listening speed and voice, preferred citation style, and the last view used in the herb and medicine checker. Words searched in the Community Hub and the page from which an article was opened are kept in session storage until the browser tab is closed, so the article can highlight them and link back. These stored values remain in your browser and are not sent to us by the website. You can clear them through your browser’s site data settings.

Cookies found on this website: When this policy was last reviewed, ordinary public browsing set the following cookies:

• __cf_bm (Cloudflare, security): bot management; expires after 30 minutes of inactivity.
• _tccl_visitor (GoDaddy, analytics): visitor identifier; expires after one year.
• _tccl_visit (GoDaddy, analytics): visit identifier; expires after 30 minutes.
• _scc_session (GoDaddy, analytics): pages viewed in the current session; expires after 20 minutes.

Pages about reproductive and sexual health: The website does not load GoDaddy’s analytics code on pages about pregnancy, fertility, or reproductive or sexual health, including articles, topic and tag pages, and search results on these subjects, or on the herb and medicine checker, where visitors may indicate a pregnancy or select contraceptive medicines. These pages are identified automatically from their content each time they are shown. Because no analytics code runs on them, no analytics page view, click, or identifier is recorded for a visit to them. Analytics cookies set on other pages remain in your browser and, like all cookies for our website, accompany requests to our hosting servers, but they are not used to record visits to these pages. These pages also ask your browser to tell the next page you open only our website’s address, not the address of the page you left. Cloudflare’s security cookie and the technical information described in Section 2 still apply.

Controls: You can block or delete cookies and manage site storage through your browser. Blocking necessary cookies may affect certain functions. Browser controls apply separately to each browser and device and do not necessarily block all analytics requests or data transmissions. The website does not currently provide a verified on-site cookie preference center. Contact us about available controls or to make a privacy request. We comply with applicable consent and opt-out requirements, including legally required handling of browser preference signals; this policy does not represent that every Do Not Track or Global Privacy Control signal is automatically detected.

Accepting cookies or visiting the website is not consent to treatment or a HIPAA authorization. Any use or disclosure of protected health information through website technologies must independently satisfy applicable health privacy law.

4. How we use information

We use information to respond to inquiries, arrange appointments, administer patient services when offered, process transactions when offered, operate and protect the website, maintain necessary records, and meet legal obligations. If a newsletter is offered and you subscribe, we use your subscription information to send it and honor your communication choices. Optional marketing is not a condition of treatment.

5. Disclosures and service providers

Information is available to authorized clinic personnel and service providers as needed for their roles, including hosting, delivery, security, communications, and payment services when used. Jane will receive information through our designated Jane service when that service is available and used. Providers acting as business associates must have the agreements required by HIPAA and may handle protected health information only as permitted by applicable law and their agreements.

We may disclose information when required or permitted by law, including legally valid regulatory requests and protection of legal rights. Disclosures of health records remain subject to applicable health privacy requirements. Identifying a provider in this policy does not authorize a disclosure or establish that a particular hosting, plugin, or communications product is suitable for patient records.

If our practice is sold, merged, or otherwise transferred, in whole or in part, information we hold may be disclosed to the other party as part of that transaction and the review that comes before it. Protected health information may be disclosed in such a transaction only as HIPAA permits: to another HIPAA covered entity, such as a healthcare practice, or to a business that will become one through the transaction. Before patient records are transferred because the practice closes, is sold, or relocates, we will first attempt to notify current patients as Virginia law requires and explain how to have their records sent to another provider or provided to them.

6. Jane and clinical records

We plan to use Jane for booking and patient administration. We determine our clinic’s collection and use of patient records in that service, subject to applicable law. Contact the clinic about those records. Jane separately describes its processing, including certain account authentication information, at https://jane.app/legal/privacy-notice. Its notice does not replace our duties to patients.

When our Jane link becomes available, use the clinic-designated patient tools for medical information. Until then, call the clinic to arrange scheduling and an appropriate method for clinical details. Website messages and ordinary email are not emergency services. The Notice of Privacy Practices in Part II applies to protected health information.

7. Text messages

When our Jane service is available, you may choose to receive text messages about your care, such as appointment reminders, waitlist openings, and reminders about a balance due. Jane sends these messages only after you consent to receive them, which you can do when booking online, on an intake form, in your Jane account, or by telling the clinic. Agreeing to text messages is not a condition of booking or treatment. Message frequency depends on your appointments. Message and data rates may apply.

You can stop text messages at any time by replying STOP to any text from the clinic. Texts then stay stopped until you reply START to a text from the clinic; the clinic cannot restart them for you. You can also ask the clinic to mark your profile Do Not Text, which stops reminders, waitlist and balance messages; a few messages you request directly, such as a code to verify your Jane account or to check in for a visit, may still be sent. Replying STOP does not cancel an appointment. Contact the clinic to cancel or reschedule.

We do not sell mobile numbers, and we do not share mobile numbers or text-message consent with third parties or affiliates for their marketing or promotional purposes. They are shared only with the service providers that send our messages, such as Jane and its text-message provider, under the agreements described in Section 5. We do not currently send promotional text messages and would ask for your separate consent before sending any.

Text messages are not a secure way to send health information and may be seen by anyone who can see your phone. Please do not reply to a text with medical details; call the clinic instead.

8. Your choices and requests

Contact us to request access or correction, discuss communication preferences, or exercise rights provided by applicable law. We may verify your identity or authority and respond within the applicable legal time limit. Deletion requests are subject to required medical-record retention and other legal obligations. Rights concerning patient records are described in Part II.

You may unsubscribe from optional marketing emails using the unsubscribe instructions or by contacting us. This does not prevent necessary appointment, billing, or service communications. You may raise privacy concerns without retaliation.

9. Retention and protection

We retain information for the purposes described here and to meet applicable medical-record, billing, tax, and other legal obligations. Retention depends on the type of information and the requirements that apply. We use reasonable administrative, technical, and physical safeguards appropriate to the information. No online service can guarantee complete security. We provide legally required privacy or security incident notices as required by law.

10. Children and representatives

The general website is intended for adults and is not directed to children under 13. A parent, guardian, or other authorized person should arrange a minor’s care where legally required. Information about minors receiving care is handled under applicable health privacy and consent laws, including any confidentiality rights of the minor.

11. External services

Our website links to services such as Google Maps and Instagram. Following an external link takes you to that provider’s service, which may receive connection and referral information and use its own cookies. Jane has separate privacy and cookie notices at https://jane.app/legal/privacy-notice and https://jane.app/legal/cookie-policy. Those notices are not an inventory of cookies on our WordPress website. The Listen feature on Community Hub articles uses the speech service of your browser or device; depending on the browser and voice selected, the text being read may be processed by that browser’s provider.

12. Changes to this policy

We may update Part I when our practices or legal obligations change. The effective date identifies the version in effect. We provide additional notice or obtain consent where required. Updates do not remove existing legal protections or authorize a use requiring separate permission. Changes to the HIPAA notice are governed by Part II.

13. Privacy Contact

Clinic Privacy Contact
Fingertips Acupuncture and Wellness LLC
2106-D Gallows Road, Vienna, VA 22182
Telephone: (571) 279-8126
Email: contact@fingertipsacupuncture.com
Website: https://fingertipsacupuncture.com

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

This notice applies to protected health information held by Fingertips Acupuncture and Wellness LLC and used by our practitioners, staff, and others acting on our behalf. It covers patient information in paper, electronic, and other forms, including information in any clinic-designated patient system. Jane is planned for booking and patient records. This notice applies to those records when that service is put into use.

1. Privacy contact

Clinic Privacy Contact
Fingertips Acupuncture and Wellness LLC
2106-D Gallows Road, Vienna, VA 22182
Phone: (571) 279-8126 | Email: contact@fingertipsacupuncture.com
Website: https://fingertipsacupuncture.com

2. Your rights

Contact our Privacy Contact to exercise the rights below. We may ask you to submit a written request and verify your identity or authority. We will explain the process and respond within applicable legal time limits.

2.1 Access your records

You may inspect or obtain an electronic or paper copy of health and billing information in the records used to make decisions about you. Tell us the records and format you want. We ordinarily respond within 30 days, subject to any shorter applicable legal deadline. Fees, if any, will comply with applicable law and be limited to permitted costs. If we deny access, we will give the required written explanation and explain any right to review. Some information, such as separately maintained psychotherapy notes, is excluded from the HIPAA access right.

2.2 Request a correction

You may request an amendment to information you believe is inaccurate or incomplete and explain why. We ordinarily respond within 60 days or provide a legally permitted written extension. We may deny a request on grounds allowed by law, such as when the information is accurate and complete. We will explain a denial in writing and explain how to submit a statement of disagreement. An amendment does not necessarily remove the original record.

2.3 Request confidential communications

You may ask us to contact you in a particular way or at a different location, such as a specific phone number or mailing address. We accommodate reasonable requests. Tell us how to reach you safely.

2.4 Ask for limits on use or disclosure

You may request limits on using or sharing information for treatment, payment, or healthcare operations, or with people involved in your care. We generally do not have to agree, but we follow a restriction we accept, subject to applicable emergency and other legal exceptions. If you pay in full out of pocket for a specific item or service, we must honor a request not to disclose information relating solely to that item or service to your health plan for payment or healthcare operations unless disclosure is required by law.

2.5 Request an accounting of disclosures

You may request a list of disclosures for up to six years before your request. The list generally excludes treatment, payment, healthcare operations, disclosures authorized by you, and other disclosures excluded by law. The first accounting in a 12-month period is free. We may charge a reasonable, cost-based fee for additional requests in that period after informing you of the fee and letting you withdraw or modify the request.

2.6 Obtain a paper notice and use a representative

You may obtain a paper copy of this notice at any time, even if you accepted it electronically. A person legally authorized to act as your personal representative may exercise your rights within the scope of that authority. We verify authority and apply legal exceptions, including rules protecting minors and people at risk of abuse.

3. How we use and disclose information

The descriptions below are subject to HIPAA, Virginia law, and any more protective law that applies to particular records. A HIPAA permission does not override stricter legal requirements. We limit information to what is legally appropriate, including the minimum necessary where that standard applies.

3.1 Treatment

We may use your health information to evaluate your needs, plan and provide treatment, and coordinate with other professionals treating you. For example, we may review your medications when planning acupuncture care or communicate relevant information to another treating provider.

3.2 Payment

We may use and disclose information to bill for services and obtain payment, subject to your rights and applicable law. For example, we may prepare an invoice or superbill, or provide information needed for a permitted payment inquiry. Being out of network does not remove health privacy protections.

3.3 Healthcare operations

We may use and disclose information to manage the clinic, assess care quality, train authorized personnel, maintain records, and meet compliance duties. For example, we may review patient records to improve care or use a designated patient system, such as Jane once implemented, to maintain clinical records. Business associates handling protected health information for these functions must have appropriate agreements as required by HIPAA.

3.4 Appointment and care communications

We may contact you about appointments, follow-up care, treatment alternatives, or health-related services as permitted by law. Tell us your communication preferences. We do not require consent to optional marketing as a condition of treatment.

3.5 People involved in your care and disaster relief

Where permitted by law, we may share information directly relevant to care or payment with family, friends, or others you identify when you agree, do not object after an opportunity to do so, or circumstances reasonably indicate your agreement. If you cannot express a preference, we may use professional judgment to share information in your best interests. We may also make legally permitted disclosures to support disaster relief notifications. Additional confidentiality protections may limit these disclosures.

3.6 Public health, safety, and oversight

We may disclose information as required or permitted by law to public health authorities, for product safety and adverse-event reporting, to report suspected abuse, neglect, or domestic violence, or to prevent or lessen a serious and imminent threat. We may disclose information to authorized oversight bodies for audits, inspections, licensing, and investigations. We meet the legal conditions applicable to each disclosure.

3.7 Legal proceedings, law enforcement, and other government functions

We may disclose information when required by law, including to HHS to assess HIPAA compliance. We may respond to legally valid court orders, subpoenas, and law enforcement requests only when the applicable legal conditions are satisfied. A request alone does not automatically authorize release. Permitted disclosures may also concern workers’ compensation, military or national security functions, and correctional custody situations, subject to legal limits.

3.8 Research, donation, and deceased individuals

When applicable legal requirements are satisfied, we may use or disclose information for approved research, organ or tissue donation, or the work of coroners, medical examiners, and funeral directors. Describing these legal permissions does not mean the clinic routinely engages in each activity.

4. Additional protections for certain records

Virginia law restricts health-record disclosures and provides additional rules for authorizations, access, and legal demands. For example, disclosure of separately maintained psychotherapy notes generally requires written authorization unless a specific exception under applicable law allows it. Civil subpoenas for health records are subject to applicable notice and objection procedures. We follow the more protective applicable requirements. Parents’ access to a minor’s records is subject to the minor’s confidentiality and consent rights under applicable law.

If we receive or maintain substance use disorder records protected by 42 CFR Part 2, those records have additional protections. Such records, or testimony conveying their contents, may not be used or disclosed in civil, criminal, administrative, or legislative proceedings against you unless you provide the required written consent or a qualifying court order is issued after the required notice and opportunity to be heard. A court order authorizing disclosure must also be accompanied by a subpoena or other legal requirement compelling disclosure. Other uses and disclosures of Part 2 records must meet Part 2’s consent requirements or a permitted exception; a general HIPAA permission alone may not be sufficient.

5. Uses requiring written permission

Most uses or disclosures of psychotherapy notes, most uses or disclosures of protected health information for marketing, and disclosures constituting a sale of protected health information require your written HIPAA authorization, subject to limited exceptions in law. Other uses and disclosures not described in this notice will be made only with your written authorization.

You may revoke an authorization in writing through our Privacy Contact. A revocation does not undo actions already taken in reliance on the authorization or other exceptions allowed by law. A newsletter subscription, treatment consent, website visit, or cookie acceptance is not a substitute for a required HIPAA authorization.

6. Our responsibilities

We are required by law to maintain the privacy of protected health information, safeguard it as required by applicable law, provide this notice of our legal duties and privacy practices, and notify affected individuals after a breach of unsecured protected health information as required by law. We must follow the notice currently in effect. We provide required breach notices without unreasonable delay and within applicable legal deadlines.

Deleting a website account or ending care does not require us to erase health records that we must retain. We handle retention and disposal under applicable legal and professional requirements.

7. Complaints

If you believe your privacy rights have been violated, contact our Privacy Contact by phone, email, mail, or in person using the details above. Please describe your concern and how we can contact you. You may also complain directly to the Secretary of the U.S. Department of Health and Human Services through the Office for Civil Rights at https://www.hhs.gov/hipaa/filing-a-complaint/index.html. You do not have to complain to us first. We will not retaliate against you for filing a complaint.

8. Changes and availability

We may change this notice as permitted by law and make the revised notice apply to information we already maintain as well as information we receive later. The current notice and effective date will be available on our website, at our clinic, and upon request. We provide revised notices as required by law. A change cannot authorize a use or disclosure prohibited by law.

We provide this notice at the first service encounter as required by HIPAA and request acknowledgment of receipt. Acknowledging receipt does not waive rights or authorize disclosures requiring separate permission. You may request another copy at any time.