Legal
HIPAA Notice of
Privacy Practices
Your rights regarding protected health information and how we use it.
Your rights regarding protected health information and how we use it.
Lumae Aesthetics and Wellness is a medical aesthetics and wellness practice located on Budde Road in Spring, Texas. All clinical services — including IV infusion therapy, aesthetic injections, ketamine infusion therapy, and telehealth consultations — are performed under the supervision and medical direction of Dr. Rahimi, MD. This Practice is a "covered entity" under HIPAA and is required to maintain the privacy of your protected health information (PHI), provide you with this Notice, and abide by its terms.
We are required by law to:
We reserve the right to change this Notice and our privacy practices at any time, provided such change is permitted by applicable law. Changes will apply to PHI we already hold about you as well as PHI we receive in the future. The revised Notice will be made available in our clinic and on our website. The effective date of the most current version will appear at the top of this Notice.
The following categories describe the ways we may use and disclose your PHI. Not every use or disclosure in a category will be listed, but all of the ways we are permitted to use and disclose your PHI will fall within one of these categories.
We may use and disclose your PHI to provide, coordinate, or manage your healthcare and related services. For example, we may share information about your care with Dr. Rahimi, our licensed RNs (Natalie and Marie), compounding pharmacies (such as Empower Pharmacy in Houston, TX), or other healthcare providers involved in your treatment.
We may use and disclose your PHI in connection with payment activities, including billing, claims submission, and payment collection. For example, we may share your PHI with your health plan or payment processor to obtain reimbursement for services rendered.
We may use and disclose your PHI for our internal operations, including quality assessment, staff training, accreditation, compliance activities, and business management. For example, we may review treatment records to evaluate clinical performance or ensure compliance with Texas medical licensing requirements.
We will disclose your PHI when required to do so by federal or state law, court order, or subpoena.
We may disclose your PHI to authorized public health authorities for activities such as disease reporting, investigation of adverse events related to medications (including compounded GLP-1 medications or peptide therapeutics), or recalls of products you may have received.
We may disclose your PHI to a health oversight agency for activities authorized by law, including audits, investigations, and inspections by the Texas Medical Board, Texas State Board of Pharmacy, Texas DPS (for Schedule III substances such as ketamine), or the DEA.
We may use or disclose your PHI when necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public.
We may disclose your PHI to law enforcement officials under certain limited circumstances, including in response to a court order, warrant, subpoena, or summons; to identify or locate a suspect, fugitive, or missing person; or to report crimes occurring on our premises.
We may release your PHI for workers' compensation purposes or similar programs that provide benefits for work-related injuries or illness.
We may release PHI to a coroner, medical examiner, or funeral director as authorized or required by law.
Other uses and disclosures of your PHI not described in this Notice will be made only with your written authorization. You may revoke a written authorization at any time by notifying us in writing. A revocation will not apply to disclosures already made in reliance on your authorization. Specific uses requiring your authorization include:
You have the following rights with respect to PHI we maintain about you. To exercise any of these rights, please submit a written request to our Privacy Officer using the contact information in Section 7.
You have the right to inspect and request a copy of PHI that we use to make decisions about your care, including your medical records and billing records. We may charge a reasonable, cost-based fee for copies. We may deny access in certain limited circumstances; if denied, you may request a review of the denial.
We will provide your PHI in the format you request if readily producible; otherwise, we will provide it in an alternative readable format.
If you believe the PHI we have about you is incorrect or incomplete, you may request that we amend it. We may deny your request if the information was not created by us, is not part of the records we maintain, is not information you are entitled to inspect or copy, or is accurate and complete in our professional judgment. If we deny your request, you may submit a statement of disagreement.
You have the right to request a list of disclosures of your PHI that we have made for purposes other than treatment, payment, or healthcare operations, and certain other exceptions. This accounting will cover the six (6) years prior to the date of your request.
You have the right to request restrictions on the use or disclosure of your PHI for treatment, payment, or healthcare operations. We are not required to agree to your request. However, if you pay for a service entirely out of pocket and ask us not to share the information with your health plan, we must honor that request.
You have the right to request that we communicate with you about your PHI by alternative means or at an alternative location (e.g., by phone at a specific number only, or by mail to a different address). We will accommodate reasonable requests.
You have the right to receive a paper copy of this Notice at any time, even if you have agreed to receive it electronically. Please contact us to request a paper copy.
You have the right to be notified in the event that we discover a breach of unsecured PHI affecting your information, as required by the HIPAA Breach Notification Rule.
If you participate in our telehealth services, your video consultation is conducted via Doxy.me, a HIPAA-compliant, end-to-end encrypted video platform. No video or audio recordings of your consultations are retained without your explicit consent.
Electronic prescriptions issued by Dr. Rahimi are transmitted via DoseSpot or DrFirst, both HIPAA-compliant e-prescribing platforms. Prescription information shared with Empower Pharmacy (Houston, TX) or other compounding pharmacies is limited to what is clinically necessary for dispensing your medication.
Texas Compassionate Use Program (CUP) registrations involve disclosure of your clinical information to the Texas Department of Public Safety (DPS) Compassionate Use Registry of Texas (CURT). This disclosure is required by law and does not require your separate authorization.
If you have questions about this Notice, wish to exercise your rights, or believe your privacy rights have been violated, please contact our Privacy Officer:
You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights:
We will not retaliate against you for filing a complaint.
We may ask you to sign a form acknowledging that you have received this Notice. Your signature acknowledges receipt only — it does not constitute your agreement to our uses and disclosures of your PHI. You are not required to sign the acknowledgment; however, we will document our good-faith efforts to obtain your acknowledgment if you choose not to sign.
This Notice is effective as of July 12, 2026 and supersedes all previous versions.