Privacy Policy

Echelon Direct Care and Aesthetics ("we," "us," or "our") is committed to safeguarding the privacy of every patient, member, and visitor who interacts with our website, our clinic, and our online services. This Privacy Policy explains what information we collect, how we use it, the choices you have, and how we protect it.

As a licensed healthcare provider, we are also subject to the Health Insurance Portability and Accountability Act (HIPAA). Protected Health Information (PHI) is handled in accordance with our Notice of Privacy Practices, which is provided separately at the time of care and governs any clinical record we create.

This policy applies to information collected through this website, our online forms, our scheduling partner, and any digital communication you initiate with us. It does not modify the rights or obligations described in HIPAA or any signed patient agreement.

Information you provide directly:

• Contact details such as your name, email address, phone number, and mailing address.
• Appointment, consultation, and membership enrollment details submitted through our booking partner or contact forms.
• Health information you provide during in-clinic, virtual, or concierge visits — handled separately under HIPAA.
• Payment and billing details processed by our PCI-compliant payment processor (we do not store full card numbers).
• Communications you send to us via email, phone, SMS, or our website forms.

Information collected automatically:

• Device and browser data, including IP address, browser type, operating system, and screen size.
• Usage data such as pages viewed, time on site, referring URLs, and approximate geographic location derived from IP.
• Cookies and similar technologies — see our Cookie Policy for details and choices.

We use the information we collect for the following purposes:

• Care delivery — to provide, schedule, and coordinate medical, IV therapy, and aesthetic services.
• Communication — to respond to inquiries, confirm appointments, send membership updates, and share clinic announcements you opt in to.
• Improvement — to analyze how our website performs and refine the patient experience.
• Security — to detect, investigate, and prevent fraudulent activity or misuse of our services.
• Compliance — to meet our legal, regulatory, licensing, and professional obligations.

We will never use your information for purposes incompatible with those listed above without first obtaining your consent.

We do not sell your personal information. We share information only with trusted partners who help us operate our practice, and only as necessary to provide care or comply with the law:

• Our online scheduling and patient-portal partner.
• Our electronic health record (EHR) provider, under a HIPAA Business Associate Agreement.
• Our payment processor for secure billing.
• Imaging, lab, and pharmacy partners coordinating your care, with your authorization.
• Professional advisors (legal, accounting, compliance) bound by confidentiality.
• Government or law enforcement when required by valid legal process.

We use a combination of administrative, physical, and technical safeguards to protect the information you entrust to us — including encrypted transmission (TLS), restricted access, audit logging, and staff training on privacy and security best practices.

No method of transmission or storage is 100% secure. While we work hard to protect your information, we cannot guarantee absolute security. If we ever become aware of a breach affecting your data, we will notify you in accordance with applicable law.

We retain personal information for as long as needed to provide our services, comply with legal and regulatory obligations, resolve disputes, and enforce our agreements. Medical records are retained for the period required by Kentucky law and applicable federal regulation. Marketing data is retained until you opt out or request deletion.

You have the right to:

• Access the personal information we hold about you.
• Request correction of inaccurate or incomplete information.
• Request deletion of personal information, subject to legal retention requirements.
• Opt out of non-essential marketing communications at any time.
• Withdraw consent for optional cookies via our cookie banner.

For PHI specifically, your rights under HIPAA are described in our Notice of Privacy Practices. To exercise any of these rights, contact us using the details below.

Our website is not directed to children under 13, and we do not knowingly collect personal information from them online. Pediatric patients seen in clinic are handled under standard parental consent and HIPAA processes. If you believe a child has submitted information through our website, please contact us so we can remove it.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will post the revised policy on this page with an updated "Last updated" date. Material changes will be communicated more prominently when appropriate.

If you have questions about this Privacy Policy or how your information is handled, please reach out:

• Email: info@echelondirectcare.com
• Phone: 270-748-0850
• Address: 2413 Ring Road Suite 121, Elizabethtown, KY 42701