Privacy Policy

Amy Wecker M.D., LLC DBA SoBe Functional Medicine

A Functional Medicine Practice Serving Patients in Florida and Georgia

Effective Date: 08/10/26

Last Revised: 07/21/26

1. Introduction and Scope

SoBe Functional Medicine ("the Practice," "we," "us," or "our") is committed to protecting the privacy and security of your personal and health information. This Privacy Policy describes how we collect, use, disclose, and safeguard information obtained from and about you when you interact with our Practice.

SoBe Functional Medicine is a HIPAA-covered entity providing functional medicine services — including but not limited to personalized health assessments, nutritional counseling, lifestyle interventions, advanced laboratory testing, and integrative treatment protocols — to patients located in the states of Florida and Georgia.

This Privacy Policy applies to information collected through all points of interaction with the Practice, including:

• Our website located at sobefunctionalmedicine.com
• Our secure patient portal
• Telehealth sessions (audio and video)
• In-office visits at our physical location(s)
• Telephone, email, and other communications with our staff

Important Notice

This Privacy Policy supplements our Notice of Privacy Practices (NPP) as required under 45 CFR § 164.520 of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), as amended. A copy of our NPP is available upon request, at the front desk of our office(s), and on our website. In the event of any conflict between this Privacy Policy and the NPP, the NPP shall govern with respect to Protected Health Information (PHI).

2. Information We Collect

We collect and maintain several categories of information about you, depending on the nature of your interaction with the Practice.

2.1 Protected Health Information (PHI)

PHI is individually identifiable health information that relates to your past, present, or future physical or mental health condition, the provision of health care, or the payment for health care. We may collect the following types of PHI:

• Medical histories, including family health histories
• Diagnoses, clinical assessments, and problem lists
• Treatment plans, including functional medicine protocols and care plans
• Laboratory results, including advanced functional medicine panels
• Supplement, nutraceutical, and medication lists
• Nutritional assessments, dietary records, and food sensitivity testing results
• Genetic and genomic data (e.g., pharmacogenomic panels, SNP analyses)
• Billing records, claims information, and insurance details
• Clinical notes, progress notes, and consultation records

2.2 Personal Information

We collect personal information necessary for your identification, treatment, and billing, including:

• Full legal name and any preferred names
• Date of birth
• Home address, mailing address, and other contact addresses
• Telephone number(s) and email address(es)
• Social Security number (collected only when necessary for billing or insurance purposes)
• Insurance identification numbers and group numbers
• Emergency contact information
• Driver's license or government-issued identification number (for identity verification)
• By providing your mobile number, you agree that SoBe Functional Medicine may send you text messages regarding appointments, scheduling, treatment updates, billing, and other information related to your care. Message and data rates may apply. Message frequency varies. You may reply STOP at any time to opt out or HELP for assistance.

2.3 Mobile Information and SMS Privacy

Mobile information, including phone numbers and SMS opt-in data, will not be shared with third parties or affiliates for marketing or promotional purposes. This does not include service providers that help us deliver text messages.

2.4 No Sale or External Disclosure of SMS Data

SMS opt-in data, phone numbers, and related consumer information will not be sold, shared, rented, transferred, or otherwise disclosed to external organizations for registration purposes, except where required by law. Your data will not be transferred to external organizations.

2.5 Security and Unauthorized Sharing Protections

We maintain protections against unauthorized access, use, or sharing of your information and retain security measures designed to safeguard mobile information and text messaging data.

2.6 Questions or Contact

If you have questions about this privacy policy or our text messaging practices, please contact the privacy officer using the email address or phone number listed on this website.

2.7 Website and Technical Data

When you visit our website, we may automatically collect certain technical information, including:

• Internet Protocol (IP) address
• Browser type and version
• Device type, operating system, and screen resolution
• Cookies and similar tracking technologies (see Section 9)
• Website analytics data, including pages viewed, time on page, and click paths
• Referral URLs (the website that directed you to our site)
• Date and time of access

2.8 Telehealth Session Data

When you participate in telehealth sessions with our providers, we may collect:

• Session metadata, including date, time, duration, and platform used
• Technical connection data related to the telehealth platform

2.9 Information from Third Parties

We may receive information about you from third-party sources, including:

• Referring healthcare providers (medical records, referral letters, consultation notes)
• Clinical and specialty laboratories
• Pharmacies and compounding pharmacies
• Insurance companies, health plans, and third-party administrators
• Health Information Exchanges (HIEs) in which we participate
• Public health authorities, as permitted by law

3. How We Use Your Information

We use and disclose your information in accordance with HIPAA and applicable state law. The following describes the primary categories of uses and disclosures, as permitted under 45 CFR § 164.502.

3.1 Treatment

We use your PHI to provide, coordinate, and manage your health care and related services. This includes:

• Developing and implementing individualized functional medicine treatment protocols
• Coordinating care among your treatment team, including specialists, therapists, and other providers
• Facilitating consultations with other healthcare professionals
• Processing referrals to or from other providers
• Ordering and interpreting laboratory tests, imaging, and other diagnostic studies
• Recommending supplements, nutraceuticals, dietary plans, and lifestyle modifications

3.2 Payment

We use your information to obtain payment for services rendered. This includes:

• Billing you for services provided
• Engaging in collections activities for outstanding balances

3.3 Health Care Operations

We use your information for operational activities necessary to run the Practice and ensure quality care, including:

• Quality assessment and improvement activities
• Clinical outcomes measurement and population health analytics
• Staff training, credentialing, and professional development
• Compliance auditing, internal investigations, and fraud detection
• Business planning, management, and general administrative activities
• Customer service and patient satisfaction assessments

3.4 Uses and Disclosures Requiring Your Written Authorization

Certain uses and disclosures of your PHI require your prior written authorization on a HIPAA-compliant authorization form. These include:

• Marketing: Using your PHI to send you marketing communications about products or services, unless the communication falls within a HIPAA exception (e.g.,face-to-face communications or promotional gifts of nominal value)
• Sale of PHI: Any disclosure of your PHI where SoBe Functional Medicine receives direct or indirect remuneration from a third party in exchange for your PHI
• Certain Research Uses: Use of your PHI for research purposes that do not qualify for an Institutional Review Board (IRB) waiver
• Psychotherapy  Notes: Use or disclosure of psychotherapy notes, if maintained

You may revoke any authorization at any time in writing, except to the extent that we have already acted in reliance on that authorization.

3.5 Uses and Disclosures Required or Permitted by Law

We may use or disclose your PHI without your authorization in certain circumstances required or permitted by federal and state law, including:

• Public Health Activities: Reporting to public health authorities for the purpose of preventing or controlling disease, injury, or disability
• Abuse, Neglect, or Domestic Violence: Reporting suspected child abuse, elder abuse, or domestic violence to appropriate government authorities
• Judicial and Administrative Proceedings: Responding to a court order, subpoena, or other lawful process
• Law Enforcement: Providing information to law enforcement officials for specific law enforcement purposes as permitted by HIPAA
• Workers' Compensation: Disclosing PHI as authorized by and necessary to comply with workers' compensation laws
• Organ and Tissue Donation: Disclosing PHI to organ procurement organizations for the purpose of facilitating organ, eye, or tissue donation and transplantation
• Coroners, Medical Examiners, and Funeral Directors: Disclosing PHI as necessary for these officials to carry out their lawful duties
• Food and Drug Administration (FDA): Reporting adverse events, product defects, or to enable product recalls, repairs, or replacements
• Health Oversight Activities: Disclosing PHI to health oversight agencies for activities authorized by law, including audits, investigations, inspections, and licensure actions
• Serious Threats to Health or Safety: Disclosing PHI when necessary to prevent or lessen a serious and imminent threat to your health or safety or that of another person or the public
• Specialized Government Functions: Disclosures for military and veterans' activities, national security and intelligence, protective services, and correctional institutions, as applicable
• Secretary of HHS: Disclosing PHI to the Secretary of Health and Human Services for compliance investigations and enforcement actions

4. How We Share Your Information

4.1 Business Associates

We may share your PHI with third-party service providers who perform functions on our behalf or provide services that involve access to PHI. These entities are known as "Business Associates" under HIPAA. All Business Associates are required to enter into a written Business Associate Agreement (BAA) with SoBe Functional Medicine before receiving access to any PHI. The BAA contractually obligates the Business Associate to:

• Use  and disclose PHI only as permitted by the agreement and applicable law
• Implement appropriate administrative, physical, and technical safeguards to protect PHI
• Report any security incidents or breaches of unsecured PHI
• Ensure that any subcontractors with access to PHI also agree to the same restrictions

Examples of Business Associates may include electronic health record (EHR) vendors, billing services, IT support companies, telehealth platform providers, cloud storage providers, and shredding and document destruction services.

4.2 Referrals and Care Coordination

We may share your PHI with other healthcare providers involved in your care for purposes of treatment continuity. This includes sharing medical records, treatment summaries, and clinical notes with referring physicians, specialists, hospitals, laboratories, and pharmacies.

4.3 Health Information Exchanges (HIEs)

We may participate in state or regional Health Information Exchanges, which allow healthcare providers and entities to electronically share patient medical information for treatment, payment, and health care operations. If we participate in an HIE, your PHI may be available to other participating providers. You may have the right to opt out of HIE participation; please contact our Privacy Officer for more information.

4.4 Legal Disclosures

We may disclose your information in response to valid court orders, subpoenas, warrants, civil investigative demands, or other lawful requests by public authorities, including to meet national security or law enforcement requirements, as described in Section 3.5.

4.5 De-Identified Data

We may use and disclose data that has been fully de-identified in accordance with HIPAA standards. De-identified data does not identify you individually and is not subject to HIPAA restrictions. De-identification is performed using one of the following methods permitted under 45 CFR § 164.514:

• Safe Harbor Method: Removal of 18 categories of identifiers specified by HIPAA
• Expert Determination Method: A qualified statistical expert determines that the risk of identifying an individual is very small

De-identified data may be used for research, population health analytics, Practice improvement initiatives, and other lawful purposes.

4.6 No Sale of PHI; Marketing Restrictions

SoBe Functional Medicine does not sell your PHI. We will not use your PHI for marketing purposes without your prior written authorization, except as expressly permitted by HIPAA (e.g., providing you with appointment reminders, information about treatment alternatives, or health-related benefits and services that we offer).

5. Your Rights Under HIPAA

As a patient of SoBe Functional Medicine, you have the following rights with respect to your Protected Health Information. To exercise any of these rights, please contact our Privacy Officer using the information provided in Section 14.

1. Right to Access Your PHI. You have the right to inspect and obtain a copy of your PHI maintained in our designated record set, including medical records, billing records, and other records used to make decisions about your care. You may request copies in electronic format. We may charge a reasonable, cost-based fee for copies as permitted by HIPAA and state law.
2. Right to Request Amendment. You have the right to request that we amend your PHI if you believe it is incorrect or incomplete. We may deny your request under certain circumstances (e.g., if we did not create the information, or if we determine the information is accurate and complete), but we will provide a written explanation of any denial.
3. Right to an Accounting of Disclosures. You have the right to receive a list of certain disclosures of your PHI made by SoBe Functional Medicine or our Business Associates during the six (6) years prior to your request (or a shorter period if you specify). This accounting does not include disclosures made for treatment, payment, or health care operations, or certain other exceptions specified by HIPAA.
4. Right to Request Restrictions. You have the right to request  restrictions on how we use or disclose your PHI for treatment, payment, or health care operations. We are not required to agree to your request, except that we must comply with a request to restrict disclosures to a health plan for services for which you have paid out of pocket in full.
5. Right to Confidential Communications. You have the right to request that we communicate with you about your health information in a certain way or at a certain location. For example, you may request that we contact you only at a specific phone number or send correspondence to an alternative address. We will accommodate reasonable requests.
6. Right to Receive a Copy of the Notice of Privacy Practices. You have the right to obtain a paper or electronic copy of our current Notice of Privacy Practices at any time upon request.
7. Right to Revoke Authorization. If you have provided a written   authorization for the use or disclosure of your PHI, you may revoke that authorization at any time by submitting a written revocation to our Privacy Officer. Revocation will not affect any uses or disclosures made in reliance on the authorization prior to its revocation.
8. Right to File a Complaint. If you believe your privacy rights have been violated, you have the right to file a complaint with SoBe Functional Medicine by contacting our Privacy Officer. You also have the right to file a complaint directly with the U.S. Department of Health and Human Services (HHS), Office for Civil Rights. Instructions for filing a complaint with HHS are available at: https://www.hhs.gov/hipaa/filing-a-complaint/index.html(opens in new tab)

Non-Retaliation

SoBe Functional Medicine will not retaliate against you in any way for exercising your rights under HIPAA, filing a complaint with the Practice, or filing a complaint with the HHS Office for Civil Rights.

6. Data Security Measures

SoBe Functional Medicine is committed to protecting the confidentiality, integrity, and availability of your information. We maintain comprehensive administrative, physical, and technical safeguards in accordance with the HIPAA Security Rule (45 CFR Part 164, Subpart C) and applicable state law. These safeguards include, but are not limited to:

• Encryption: All electronic PHI (ePHI) is encrypted at rest and in transit using industry-standard encryption protocols (e.g., AES-256 for data at rest; TLS 1.2 or higher for data in transit).
• Access  Controls: Role-based access controls ensure that workforce members can access only the minimum necessary PHI required to perform their job functions. Each authorized user is assigned a unique user identification.
• Multi-Factor Authentication (MFA): Multi-factor authentication is required for access to systems containing ePHI, including the patient portal, EHR system, and administrative platforms.
• Security Risk Assessments: Regular and thorough security risk assessments are conducted at least annually to identify potential vulnerabilities and threats to ePHI. Periodic penetration testing and vulnerability scanning are performed.
• Workforce Training: All workforce members receive HIPAA privacy and security training upon hire and at least annually thereafter, including training on phishing awareness, social engineering, and proper handling of PHI.
• Incident Response and Breach Notification: We maintain a written incident response plan to detect, contain, and remediate security incidents. Breach notification procedures are implemented in accordance with Section 7 of this Privacy Policy.
• Physical Safeguards: Physical access to areas where PHI is stored or processed is restricted through locked facilities, access badge systems, visitor logs, and workstation security measures. Paper records containing PHI are stored in locked cabinets.
• Secure Disposal: PHI in any form is securely destroyed when no longer needed, using methods such as cross-cut shredding for paper records, secure electronic wiping, and degaussing for electronic media.
• Business Continuity and Disaster Recovery: We maintain data backup and disaster recovery plans to ensure the availability and integrity of ePHI in the event of a system failure, natural disaster, or other emergency.
• Audit Controls: Automated audit trails record access to ePHI, including user identification, date, time, and nature of the access, enabling monitoring and investigation of potential unauthorized access.