Privacy Policy

Last Updated: April 1, 2026  |  Effective Date: April 1, 2026

NOTE: This document serves as our HIPAA Notice of Privacy Practices and website Privacy Policy. This is not legal advice. We recommend consulting with a healthcare attorney for your specific situation.

Section 1 — Who We Are

Félix Vida Wellness is a medical aesthetics and wellness clinic located in Scottsdale, Arizona. We are a covered entity under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its implementing regulations. This means we are legally obligated to maintain the privacy of your protected health information (PHI), to provide you with this Notice of Privacy Practices, and to abide by the terms of the notice currently in effect.

Our provider of record is Kaitlyn Félix, MS, MSN, RN, operating under the medical direction of Dr. Christopher Ray, MD. Services we offer include Botox® and neuromodulators, dermal fillers, microneedling, peptide therapy, PRP, IV therapy (signature drips, NAD+, B12/MIC+, custom blends, and add-on enhancements), hormone optimization therapy, GLP-1 medical weight loss, and wellness consulting.

Business Address:
Félix Vida Wellness
9170 E. Bahia Dr., Suite #107
Scottsdale, AZ 85260

Phone/Text: 602.456.0324
Email: support@felixvidawellness.com

Section 2 — Information We Collect

Depending on how you interact with Félix Vida Wellness — whether as a patient, a website visitor, or both — we may collect the following categories of information:

Protected Health Information (PHI)

• Health history, current conditions, medications, allergies, and prior treatments
• Patient intake forms and consent documents
• Clinical notes and treatment records created during or following your appointments
• Lab results and any diagnostic information you provide or that we obtain in connection with your care
• Photographs taken before and after procedures (only with your written consent)

Personal Identifying Information

• Full legal name, date of birth, and gender
• Home address, telephone number(s), and email address
• Social Security Number (SSN), where required for billing or insurance superbill documentation
• Emergency contact information

Financial Information

• Payment card information (processed through our PCI-DSS compliant payment processor; we do not store full card numbers)
• HSA and FSA account information used for payment of eligible services
• Billing records and transaction history

Membership & Subscription Data

• If you enroll in a membership plan, we store a tokenized reference to your payment method (processed through our PCI-DSS compliant payment processor) for the purpose of recurring monthly billing
• Membership enrollment date, tier, billing history, and service credit balance
• Payment method tokens are retained for the duration of your active membership and deleted within 90 days of membership cancellation, unless retention is required by law

Website and Technical Data

• IP address and general geographic location
• Browser type, device type, and operating system
• Pages visited, time on site, and referring URLs (via anonymized Google Analytics)
• Cookies and similar tracking technologies used to support site functionality

Booking and Scheduling Data

• Appointment requests, booking history, and scheduling preferences collected through our online booking platform, OptiMantra
• Intake form responses submitted through OptiMantra prior to your appointment

Section 3 — HIPAA Notice of Privacy Practices

As a HIPAA covered entity, we are permitted and in some cases required to use and disclose your protected health information (PHI) for specific purposes. Below is a complete description of those uses and disclosures.

Minimum Necessary Standard

We limit the use and disclosure of your protected health information to the minimum amount necessary to accomplish the intended purpose, as required by 45 CFR § 164.502(b). This standard applies to all uses and disclosures described below, except for disclosures made for treatment purposes, disclosures to you about your own health information, disclosures made pursuant to your written authorization, and disclosures required by law.

De-Identified Information

We may use or disclose de-identified health information, from which all individual identifiers have been removed in accordance with 45 CFR § 164.514, for research, quality improvement, or other purposes. De-identified information is not subject to the protections of this Notice.

Uses and Disclosures for Treatment

We may use and disclose your PHI to provide, coordinate, and manage your healthcare and related services. This includes sharing information with our Medical Director, Dr. Christopher Ray, MD, who provides clinical oversight of your care. We may also share relevant information with referring healthcare providers, specialists, laboratories, or other treatment professionals involved in your care, where doing so is necessary to treat you effectively.

Uses and Disclosures for Payment

We may use and disclose your PHI to obtain payment for services we provide to you. This includes submitting billing information, generating insurance superbills you may use for reimbursement from your insurer or HSA/FSA administrator, and verifying coverage or eligibility. Your information may be shared with your health plan or its designees as part of this process.

Uses and Disclosures for Healthcare Operations

We may use and disclose your PHI for our internal healthcare operations, including quality assurance reviews, clinical staff training and education, performance improvement activities, audits and compliance monitoring, and activities related to accreditation or credentialing. These uses help us ensure we are delivering safe, effective, and high-quality care.

Other Permitted Uses and Disclosures Without Your Authorization

In certain circumstances, federal and state law permit or require us to use or disclose your PHI without your written authorization, including:

• Public health activities: Reporting to public health authorities as required by law, such as reporting communicable diseases or adverse reactions to medications or medical devices.
• Law enforcement: Disclosures to law enforcement officials as required or permitted by law, including in response to a court order, warrant, or subpoena.
• Judicial and administrative proceedings: In response to a court or administrative order, or in certain circumstances in response to a subpoena, discovery request, or other lawful process.
• Workers' compensation: To comply with workers' compensation laws or similar programs that provide benefits for work-related injuries or illness.
• Health oversight agencies: To government agencies conducting audits, investigations, or oversight activities authorized by law, including the Arizona Department of Health Services and the U.S. Department of Health and Human Services (HHS).
• Serious threats to health or safety: To prevent or lessen a serious and imminent threat to the health or safety of a person or the public, consistent with applicable law and ethical standards.
• Decedents: To coroners, medical examiners, and funeral directors as necessary and permitted by law.

Uses and Disclosures That Require Your Written Authorization

The following uses and disclosures of your PHI require your separate, written authorization before we may proceed:

• Marketing communications that use or disclose your PHI to encourage you to purchase a product or service
• Sale of your PHI to any third party
• Any other use or disclosure of your PHI not described in this Notice or otherwise permitted by applicable law

You may revoke any authorization you have given us at any time, in writing. Your revocation will be effective for future uses and disclosures, but will not affect any actions we have already taken in reliance on your prior authorization.

Section 4 — Your HIPAA Rights

You have the following rights with respect to your protected health information. To exercise any of these rights, please submit a written request to our Privacy Officer using the contact information in Section 15.

Right to Access and Copy Your Records (45 CFR § 164.524)

You have the right to inspect and receive a copy of your medical records and other PHI that we maintain in a designated record set. To request access, submit a written request to our Privacy Officer. We will respond within 30 days of receiving your request (with one 30-day extension if we notify you in writing). We may charge a reasonable, cost-based fee for copies in accordance with Arizona law, A.R.S. § 12-2295. There is no fee for records provided for the purpose of continuity of care transfers to another treating provider. We will provide records in the format you request if it is readily producible; if not, we will work with you to find a mutually acceptable format.

Right to Request Amendment (45 CFR § 164.526)

If you believe that information in your medical record is incorrect or incomplete, you have the right to request that we amend it. Requests must be submitted in writing and must include a reason supporting the amendment. We will act on your request within 60 days. We may deny your request in limited circumstances, such as when the record was not created by us or when we believe the information is accurate and complete. If we deny your request, we will provide you with a written explanation and inform you of your right to submit a written statement of disagreement.

Right to an Accounting of Disclosures (45 CFR § 164.528)

You have the right to receive a list ("accounting") of certain disclosures of your PHI that we have made during the prior six years. This right does not apply to disclosures made for treatment, payment, or healthcare operations purposes, or to disclosures you previously authorized. Submit your request in writing to our Privacy Officer. We will provide the accounting within 60 days of your request. The first accounting you request in any 12-month period is free; subsequent requests within the same 12 months may be subject to a reasonable fee.

Right to Request Restrictions (45 CFR § 164.522)

You have the right to request that we restrict how we use or disclose your PHI for treatment, payment, or healthcare operations. You also have the right to request that we restrict disclosures to family members or others involved in your care. We are not required to agree to most restriction requests; however, if we do agree, we are bound by that agreement except in certain emergency circumstances. One exception: We are required to agree to a restriction on disclosures to a health plan for a particular service if you have paid out-of-pocket in full for that service and the disclosure is not otherwise required by law.

Right to Confidential Communications (45 CFR § 164.522(b))

You have the right to request that we communicate with you about your health matters in a certain way or at a certain location. For example, you may ask that we contact you only at a specific phone number or by email rather than by mail. We will accommodate all reasonable requests. Your request must specify the alternative means or location you prefer.

Right to a Paper Copy of This Notice (45 CFR § 164.520(c)(1)(vi))

You have the right to receive a paper copy of this Notice of Privacy Practices at any time, even if you previously agreed to receive it electronically. To request a paper copy, contact our Privacy Officer or ask at your next appointment. We will provide a copy promptly and at no charge.

Section 5 — Arizona State Privacy Rights

In addition to your federal HIPAA rights, Arizona law provides additional protections for your medical records and health information.

Confidentiality of Medical Records (A.R.S. §§ 12-2292 through 12-2297)

Arizona law provides that medical records and the information contained within them are confidential. Healthcare providers may not disclose medical records without patient authorization except in circumstances permitted or required by state or federal law. These protections run alongside — and in some cases supplement — your federal HIPAA rights.

Right to Written Copies

Under A.R.S. § 12-2293, you have the right to obtain written copies of your medical records upon written request. We will provide copies in a timely manner and may charge a reasonable fee consistent with the fee schedule established under A.R.S. § 12-2295. No fee will be charged for records requested for the purpose of ongoing medical treatment with another provider.

Records Retention

We retain medical records in accordance with Arizona law (A.R.S. § 12-2297):

• Adult patient records: Retained for a minimum of six (6) years from the date of the last service provided.
• Minor patient records: Retained until the patient reaches age 21 or for six (6) years from the date of last service, whichever is later. (Note: Our services are generally limited to patients 18 and older.)

After the applicable retention period, records are destroyed using secure methods that protect confidentiality.

Section 6 — Website Privacy & Cookies

When you visit our website at felixvidawellness.com, we collect certain technical data to help us understand how our site is used and to improve your experience.

Analytics

We use Google Analytics with IP anonymization enabled. This means your full IP address is not stored. Google Analytics collects aggregated, anonymized data about site usage — including pages visited, time on site, and general geographic region — to help us understand visitor behavior. This data is not linked to your identity or your health information. You may opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on.

No Health-Targeted Advertising Pixels

We do not use Meta Pixel (Facebook Pixel), TikTok Pixel, or similar third-party advertising tracking pixels on any pages where health or personal information is submitted, including booking, intake, and contact pages. We do not use your health information to target you with advertising, nor do we share your PHI with advertising networks.

Cookies

Our website uses cookies — small text files stored on your browser — for the following purposes:

• Strictly necessary cookies: Required for the website to function. These cannot be disabled without impairing site functionality.
• Analytics cookies: Help us understand how visitors use our site (Google Analytics, anonymized).
• Functional cookies: Remember your preferences to improve your browsing experience.

You can control cookies through your browser settings. Most browsers allow you to refuse new cookies, delete existing cookies, or be notified when new cookies are set. Please note that disabling certain cookies may affect how our website functions. We do not sell data collected through cookies to third parties.

Section 7 — Third-Party Services and Business Associates

We work with select third-party service providers who may access, process, or store your information in connection with services they provide to us. When any such vendor may encounter your PHI, we enter into a Business Associate Agreement (BAA) with them as required by HIPAA. We require that all Business Associates implement appropriate safeguards to protect your PHI and use it only for the purposes for which it was disclosed.

OptiMantra (EMR & Online Booking Platform)

We use OptiMantra to manage electronic medical records, online booking, intake forms, and patient scheduling. OptiMantra is a HIPAA-compliant platform and we have a Business Associate Agreement in place with OptiMantra, Inc. Information you submit through OptiMantra is subject to both this Privacy Policy and OptiMantra's own privacy practices. Learn more at optimantra.com/privacy-policy.

Payment Processor

We use a PCI-DSS (Payment Card Industry Data Security Standard) compliant payment processor to handle credit card and other payment transactions. We do not store full payment card numbers on our own systems. Your payment data is encrypted and handled in accordance with applicable financial security standards.

Other Vendors

We may engage other vendors for services such as email communications, document management, or electronic health record systems. All vendors who may access PHI are required to execute a Business Associate Agreement before receiving any such access. We periodically review our vendor relationships to ensure ongoing compliance.

Section 8 — Marketing Communications

Email Marketing (CAN-SPAM Act)

If you subscribe to our email list or provide your email address in connection with a service inquiry or booking, we may send you promotional emails about our services, wellness tips, special offers, and clinic news. Every marketing email we send will include a clear and conspicuous unsubscribe mechanism. We will honor all unsubscribe requests within 10 business days of receipt, in compliance with the CAN-SPAM Act. Once you opt out, we will not send you further promotional emails unless you re-subscribe. Please note that transactional and appointment-related emails (e.g., booking confirmations, pre-appointment instructions) are not marketing communications and will continue regardless of your marketing email preference.

SMS and Text Message Marketing (TCPA)

We send SMS text messages only with your express written consent, in compliance with the Telephone Consumer Protection Act (TCPA) and applicable Federal Communications Commission (FCC) regulations. If you have consented to receive promotional text messages from us, you may opt out at any time by replying STOP to any text message. We will honor all opt-out requests within 10 business days as required under applicable TCPA regulations. You may also reply HELP for assistance. Message and data rates may apply.

Clinical Appointment Reminders

Appointment reminder calls, texts, and emails — including reminders about upcoming appointments, post-visit follow-up, and refill or recare notifications — are considered part of your healthcare treatment and do not require separate marketing consent under HIPAA. You may request that we contact you only through specific channels or at specific numbers; see your Right to Confidential Communications in Section 4.

Section 9 — Data Security

We take the security of your health and personal information seriously and implement a range of administrative, physical, and technical safeguards to protect it.

• Encryption in Transit: All data transmitted between your browser and our website, and between our systems and our service providers, is protected using SSL/TLS encryption.
• Access Controls: Access to PHI and sensitive personal information is restricted to authorized personnel who require such access in the course of providing services to you. We use role-based access controls and require staff to authenticate before accessing patient records.
• HIPAA Security Rule Compliance: Our security practices are designed to comply with the HIPAA Security Rule (45 CFR §§ 164.302–164.318), including required and addressable implementation specifications for administrative, physical, and technical safeguards.
• Payment Security: We do not store full payment card numbers on our systems. All payment processing is handled by our PCI-DSS compliant payment processor.
• Staff Training: Our team receives regular HIPAA training and is required to follow our privacy and security policies and procedures.

While we take every reasonable precaution to protect your information, no method of electronic transmission or storage is 100% secure. If you have reason to believe that your interaction with us is no longer secure, please notify us immediately using the contact information in Section 15.

Section 10 — Data Breach Notification

In the event of a breach of unsecured protected health information, we will comply fully with the HIPAA Breach Notification Rule (45 CFR §§ 164.400–164.414).

• Individual Notification: We will notify affected individuals without unreasonable delay and in no case later than 60 calendar days after discovery of the breach. Notice will be provided by first-class mail to your last known address, or by email if you have agreed to receive electronic notices.
• HHS Notification: We will notify the U.S. Department of Health and Human Services (HHS) of breaches. Breaches affecting fewer than 500 individuals will be reported in our annual log submission. Breaches affecting 500 or more individuals will be reported to HHS contemporaneously with individual notification.
• Arizona State Notification: As a HIPAA covered entity, our compliance with the HIPAA Breach Notification Rule satisfies Arizona's data breach notification requirements under A.R.S. § 18-552 for breaches involving PHI. In the case of a breach affecting 500 or more Arizona residents, we will also notify the Arizona Attorney General in accordance with applicable state law.

Section 11 — Data Retention

We retain your information for as long as necessary to fulfill the purposes for which it was collected, to comply with our legal and regulatory obligations, and to resolve disputes.

• Adult Medical Records: Retained for a minimum of six (6) years from the date of your last service, in accordance with A.R.S. § 12-2297.
• Minor Patient Records: Retained until the patient reaches age 21 or for six (6) years from the date of last service, whichever period is longer. (Our services are generally limited to adults 18 and older.)
• Payment and Financial Records: Retained for a minimum of seven (7) years from the date of the transaction, as required for tax and accounting purposes under federal and Arizona state law.
• Consent and Authorization Records: Retained for as long as the underlying record to which they relate.
• This Notice of Privacy Practices: Retained for six (6) years from the date it was created or last in effect, whichever is later, as required by 45 CFR § 164.530(j).

When records are no longer required to be retained, they are securely destroyed using methods appropriate to the media type (e.g., shredding for paper records, certified destruction for electronic media).

Section 12 — Children's Privacy (COPPA)

Félix Vida Wellness does not knowingly collect personal information from individuals under the age of 18. Our clinical services are designed for adults and require patients to be at least 18 years of age. Our website is not directed to children under 18, and we do not knowingly collect personal information from minors through our website.

If we learn that we have inadvertently collected personal information from a person under the age of 18 through our website without verifiable parental consent as required by the Children's Online Privacy Protection Act (COPPA), we will take prompt steps to delete that information from our records. If you believe we may have collected information from a minor, please contact our Privacy Officer immediately using the information in Section 15.

Section 13 — Your Right to File a Complaint

If you believe your privacy rights have been violated, you have the right to file a complaint without fear of retaliation. We will not penalize, retaliate against, or otherwise discriminate against any patient who exercises their privacy rights or files a complaint.

File a Complaint with Us

You may file a complaint directly with our Privacy Officer at any time. See Section 15 for contact information. We take all privacy complaints seriously and will investigate and respond to each complaint promptly.

File a Complaint with HHS Office for Civil Rights (OCR)

You have the right to file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights (OCR) if you believe we have violated your HIPAA rights. Complaints must generally be filed within 180 days of when you knew or should have known of the act or omission that is the subject of the complaint. File online or learn more at:
hhs.gov/hipaa/filing-a-complaint

File a Complaint with the Arizona Attorney General

Arizona residents may also file complaints about privacy violations with the Arizona Attorney General's Office:
azag.gov/complaints
Arizona Attorney General
2005 N. Central Ave.
Phoenix, AZ 85004
Phone: (602) 542-5025

Section 14 — Amendments to This Policy

We reserve the right to change this Privacy Policy and our HIPAA Notice of Privacy Practices at any time. We are required to abide by the terms of this Notice currently in effect. We may revise this Notice in response to changes in applicable law, changes in our business practices, or to better serve our patients.

When we make material changes to this Policy, we will:

• Post the updated Notice on our website at felixvidawellness.com, with a revised "Last Updated" date at the top of the page
• Provide a copy of the updated Notice to active patients at their next appointment or by mail or email
• Make paper copies available at our office upon request at no charge

Your continued use of our services following the posting of a revised Notice constitutes your acknowledgment of and agreement to the updated terms. If you have questions about a change to this Notice, please contact our Privacy Officer.

Section 15 — Contact / Privacy Officer

All privacy-related requests, questions, complaints, or correspondence should be directed to our designated Privacy Officer. Written requests for access to records, amendment, accounting of disclosures, restrictions, or confidential communications should be submitted to this contact as well.

We strive to respond to all written privacy requests within 30 days of receipt. If you have a time-sensitive concern, please call or text us directly at 602.456.0324 so we can assist you promptly.