PRIVACY POLICY
Effective Date: September 21, 2026
Last Reviewed: September 21, 2026
Brandon Medical Center Weight Management and Wellness Centers (“Brandon Medical Center,””we,””us,” or “our”) respects the privacy of our patients and website visitors. This Privacy Policy explains what information we collect through brandonmedicalcenter.com and our related online services, how we use and disclose it, the choices and rights you have, and how we comply with the privacy and health information laws that apply to us.
1. Two Kinds of Information, Two Sets of Rules
Brandon Medical Center is a licensed medical practice. The information we hold falls into two categories, governed differently:
- Protected Health Information (PHI). Information created or received in the course of providing medical care to you — your medical record, diagnoses, treatment, prescriptions, and billing for clinical services. PHI is governed by the Health Insurance Portability and Accountability Act (HIPAA) and by Florida law. Our use and disclosure of PHI is described in our Notice of Privacy Practices, not in this Privacy Policy.
- Website and consumer information. Information collected when you browse our website, submit a contact or appointment request form, call a tracked phone number, subscribe to email, or purchase a non-clinical product online. This Privacy Policy governs that information.
Our Notice of Privacy Practices is available at https://brandonmedicalcenter.com/notice-of-privacy-practices/ and in printed form at our office. If any conflict exists between this Privacy Policy and the Notice of Privacy Practices with respect to PHI, the Notice of Privacy Practices controls.
2. Information We Collect
Information you give us
- Identifiers: name, postal address, email address, telephone number, date of birth.
- Appointment and inquiry details, including the service you are asking about and any information you choose to include in a free-text message field.
- Payment information for online purchases, processed by our payment processor. We do not store complete payment card numbers on our systems.
- Communications you send us, including email, text messages, and voicemail.
Information collected automatically
- Device and connection data: IP address, browser type and version, operating system, referring URL, and internet service provider.
- Usage data: pages viewed, time on page, links clicked, and navigation paths through the site.
- Cookie and similar-technology identifiers, described in Section 5.
Information from other sources
- Appointment scheduling data from our booking provider.
- Call detail and, where enabled, call recordings from our telephone tracking provider.
3. How We Use Information
- To respond to your inquiries and schedule, confirm, and remind you of appointments.
- To provide, bill for, and administer the services you request.
- To send you administrative messages about your account, appointment, or order.
- To send marketing communications where you have asked to receive them, and only until you opt out.
- To operate, secure, troubleshoot, and improve our website.
- To measure the effectiveness of our advertising in aggregate.
- To comply with legal obligations and to establish, exercise, or defend legal claims.
We do not use information about your health conditions, treatments, or the specific services you inquire about to target advertising to you, and we do not permit our advertising vendors to do so.
4. How We Disclose Information
We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under state privacy law. We disclose information only as follows:
- Service providers. Vendors who host our website, process payments, schedule appointments, deliver email, handle telephone routing, and provide analytics. Each is contractually bound to use the information only to perform services for us, and where they handle PHI, under a Business Associate Agreement.
- Legal and safety. When required by law, subpoena, or court order, or where we reasonably believe disclosure is necessary to protect the rights, property, or safety of our patients, our staff, or the public.
- Business transfer. In connection with a merger, acquisition, or sale of assets, subject to the acquirer honoring this Policy.
- With your direction. Where you ask us to share information with a third party, such as another treating provider.
5. Cookies, Analytics, and Your Tracking Choices
We use cookies and similar technologies to keep the site functioning, remember your preferences, and understand how the site is used. You can refuse or delete cookies through your browser settings; some site features may not work correctly if you do.
Global Privacy Control. We honor the Global Privacy Control (GPC) browser signal as a valid request to opt out of sale and sharing where state law requires it.
6. Consumer Health Data (Washington, Nevada, and Connecticut Residents)
Some states regulate “consumer health data” separately from other personal information and separately from HIPAA. Consumer health data generally means information linked to you that identifies your past, present, or future physical or mental health status, including your interest in or acquisition of health care services or products.
Where that information is not already PHI governed by HIPAA, we:
- Collect it only as needed to provide the service you requested, or with your consent.
- Obtain separate consent before sharing it, where consent is required.
- Do not sell it.
- Do not use geofencing around any health care facility to identify, track, or advertise to consumers.
- Restrict internal access to employees for whom access is necessary.
Washington residents: our Consumer Health Data Privacy Policy is available at https://brandonmedicalcenter.com/consumer-health-data-privacy-policy/ . See Part 4 of the accompanying memo — Washington requires this as a standalone document with its own link.
7. Your Privacy Rights
Depending on where you live, you may have some or all of the following rights regarding information covered by this Policy:
- To confirm whether we process your personal information and to access it.
- To obtain a copy in a portable, readily usable format.
- To correct inaccurate personal information.
- To delete personal information we hold about you.
- To opt out of targeted advertising, the sale of personal information, and profiling with legal or similarly significant effects.
- To withdraw consent previously given for the processing of sensitive or consumer health data.
- To be free from discrimination or retaliation for exercising any of these rights.
These rights are not absolute. We may decline a request where an exception applies — most commonly where the information is PHI subject to HIPAA and Florida medical records retention law, in which case your rights are governed by our Notice of Privacy Practices instead.
How to exercise your rights
Submit a request by email to privacy[@]brandonmedicalcenter.com, by telephone at (813)502-6430, or in writing to 122 S. Moon Ave. Brandon, FL 33511 ATTN: Privacy Officer. We will verify your identity before acting on a request. We respond within 45 days, and may extend once by an additional 45 days where reasonably necessary, in which case we will tell you before the first period expires.
Appeals:
appeals[@]brandonmedicalcenter.com
If we decline your request, you may appeal by writing to within a reasonable period. We will respond in writing within 60 days with our decision and the reasons for it. If we deny your appeal, we will provide a method for you to contact your state attorney general to submit a complaint.
Authorized agents
You may designate an authorized agent to submit a request on your behalf. We will require proof of the agent’s authority and may still ask you to verify your own identity directly.
8. How We Comply With Privacy and Health Information Laws
Brandon Medical Center maintains a privacy and information security program designed to meet the requirements of the federal and state laws applicable to our operations. Those include:
- HIPAA and the HITECH Act. As a health care provider, we handle Protected Health Information in accordance with the HIPAA Privacy, Security, and Breach Notification Rules. We maintain a Notice of Privacy Practices, execute Business Associate Agreements with vendors who create, receive, maintain, or transmit PHI on our behalf, train our workforce on privacy obligations, and limit access to PHI to the minimum necessary for each role.
- Florida law. Including the Florida Information Protection Act and Florida statutory requirements governing patient records, their confidentiality, retention, and release.
- State comprehensive privacy laws. We honor the consumer rights described in Section 7 for residents of every state that grants them, rather than limiting those rights to residents of any single state.
- State consumer health data laws. Including Washington’s My Health My Data Act, Nevada SB 370, and the consumer health data provisions of the Connecticut Data Privacy Act, as described in Section 6.
- State breach notification laws. We maintain an incident response process and will notify affected individuals and regulators within the timeframes required by the law of each affected person’s state of residence, and by HIPAA where PHI is involved.
- Federal consumer protection law. Including the FTC Act and the FTC Health Breach Notification Rule, the CAN-SPAM Act for commercial email, and the Telephone Consumer Protection Act for calls and text messages.
- Children’s privacy law. Including COPPA, as described in Section 11.
Because we provide services to patients residing outside Florida, we apply the more protective standard where state requirements differ, rather than applying only Florida law.
Our privacy program is overseen by C. Kilgore, who can be reached at privacy[@]brandonmedicalcenter.com We review this Policy and our underlying practices at least annually and whenever a material change in our operations or in applicable law requires it.
9. Data Security
We maintain administrative, physical, and technical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, and destruction. These include encryption of data in transit, access controls and unique user credentials, role-based restrictions on who may view patient information, workforce privacy and security training, and periodic review of our vendors’ security practices.
No method of transmission or storage is completely secure. Please do not send detailed medical information to us through unencrypted email or through a website contact form. If you need to communicate clinical information, contact our office directly so we can provide a secure method.
10. Data Retention
We retain personal information for as long as needed for the purpose it was collected, and thereafter as required by law. Medical records are retained in accordance with Florida law and our Notice of Privacy Practices. Website inquiry and marketing data is retained for 2 years unless you ask us to delete it sooner and no legal obligation requires us to keep it.
11. Children and Minors
Our website is not directed to children. We do not knowingly collect personal information online from anyone under 13, consistent with the Children’s Online Privacy Protection Act. We do not provide weight management, hormone, or peptide services to anyone under 18 through this website. If we learn that we have collected information from a child under 13, we will delete it. A parent or guardian who believes we may have collected such information should contact us using the details in Section 15.
12. Marketing Communications
We send marketing email and text messages only to people who have asked to receive them. You can unsubscribe at any time using the link in any marketing email, by replying STOP to a text message, or by contacting us directly. Opting out of marketing does not stop transactional messages such as appointment confirmations, order confirmations, and reminders.
We do not add patients or purchasers to any mailing list without their consent.
13. Patients Outside Florida
Our website is operated from the United States and our services are intended for residents of the United States. Where we provide services to patients residing in other states, we comply with the privacy and health information requirements of those states in addition to Florida law, as described in Section 8. We do not offer our services to residents of the European Economic Area or the United Kingdom, and this Policy does not address the GDPR.
14. Third-Party Websites
Our website may link to sites we do not operate, including our online scheduling provider. This Policy does not apply to those sites. We encourage you to review the privacy policy of any third-party site before providing information to it.
15. Changes to This Policy
We may update this Policy. When we do, we will revise the Effective Date at the top and post the updated Policy on this page. Where a change materially affects how we use information you have already given us, we will provide additional notice.
16. Contact Us
Brandon Medical Center Weight Management and Wellness Centers
122 S. Moon Ave
Brandon, FL 33511
Phone: (813)502-6430
Privacy inquiries: privacy@brandonmedicalcenter.com
Privacy Officer: C. Kilgore