Privacy Policy

Effective 07/20/2026  ·  Last updated 10/10/2026

Newport Integrative Medicine & Aesthetics, doing business as NIMA Wellness (“NIMA Wellness,” “we,” “us,” or “our”), respects your privacy. This policy explains what information we collect through our website, our booking and payment pages, our forms, and the NIMA mobile app, how we use it, who we share it with, and the choices you have.

1Scope of this policy

This policy applies to nimawellness.com, our booking page at book.nimawellness.com, our plan, membership and payment links, and the NIMA mobile app. It does not apply to third-party websites we link to, which have their own privacy policies (see section 9).

2Medical records and HIPAA

Once you become a patient, the information we create and keep about your care is protected health information. We use and disclose it only as permitted by HIPAA — principally to treat you, to obtain payment, and to run the practice — and as described in our Notice of Privacy Practices. We do not sell protected health information, and we do not use it for advertising.

Information you submit through this website before you are a patient — for example a contact form asking about a treatment — is handled under this policy. If it later becomes part of your medical record, it is protected as PHI from that point forward.

3Information we collect

Information you give us

• Contact and inquiry details — your first and last name, email address, phone number, and the treatments you tell us you are interested in, when you submit a form on our site.
• Appointment requests — the information you enter when booking.
• App account details — the name, email address, phone number, and date of birth you provide when creating a NIMA account, plus anything you upload through the app.
• Documents you give us — intake forms, prior records, and lab reports you upload or bring in.
• Messages you send us — email, text messages, chat messages sent through the assistant on our site, and voicemails.

Information collected automatically

• Device and usage data — IP address, browser type, device type, pages viewed, and the date and time of your visit, recorded in standard server logs.
• Cookies and similar technologies — described in section 7.

We do not ask for, and you should not send us, detailed medical information through a website form, email, or text message. Those channels are not encrypted end to end. Use the app, a phone call, or your appointment to share anything sensitive.

4How we use your information

• To respond to your questions and schedule appointments.
• To provide, and to follow up on, the care and services you request.
• To operate the NIMA app, including clinic check-in.
• To send appointment reminders and practice updates you have asked for.
• To send marketing about our services, where you have consented and only until you opt out.
• To keep our website and app secure, and to diagnose technical problems.
• To meet our legal, regulatory, and professional obligations.

5Text messages

We text you only if you opt in — by checking the text-message box on a form, agreeing when you book or sign up in the app, or asking us in person. Texts are sent through our messaging provider, Twilio, and cover appointment confirmations and reminders, forms to complete, payment and membership notices, video-visit links and, if you agreed to them, offers and practice news. Message frequency varies, and message and data rates may apply. Consent to marketing texts is not a condition of any purchase.

Reply STOP to any message to opt out, or HELP for help. Opting out of marketing texts does not stop messages about an appointment you have booked.

Your mobile number and text-messaging consent are never sold, and are never shared with third parties or affiliates for their marketing. They are shared only with the providers that deliver the messages for us.

6Artificial intelligence

We use artificial intelligence tools in two places, to save staff time and reduce errors:

• Reading documents you give us. When you upload paperwork or a lab report, an AI tool (Anthropic's Claude) reads it and drafts the matching entries in your chart.
• Summarizing video visits. Our video platform, doxy.me, can produce a written summary of a telehealth visit (its “Scribe” feature), which is saved to your chart.

AI output is a draft. Our staff and your provider review it before it is relied on, and no treatment decision is made by AI. These vendors handle your information under HIPAA business associate agreements. Wherever a vendor offers the choice, we set it so your information is not used to train their AI models. You can ask us not to use these tools for your records or visits — tell the front desk or your provider.

7Cookies and analytics

Cookies are small files stored by your browser. We use essential cookies to keep the site working and to remember your choices.

With your permission, we also use Metricool web analytics to count visits and see which pages people find useful. Metricool loads only after you press Accept on the cookie notice; if you press Decline, or your browser sends a Global Privacy Control signal, it does not load at all. We do not use advertising cookies or pixels.

You can change your mind at any time:

Change cookie choice

You can also block or delete cookies in your browser settings. Essential cookies are needed for the site to function, so blocking them may affect how it behaves. We honor Global Privacy Control; because there is no common standard for the older “Do Not Track” signal, we do not respond to it separately.

8How we share information

We do not sell your personal information, and we do not share it with third parties for their own marketing or for cross-context behavioral advertising. We share it only in these situations:

• Service providers who work on our behalf — website hosting, our records and booking systems, messaging, payments, analytics, and IT support. They may use the information only to provide their service to us, under contract. Where they handle protected health information, they do so under a HIPAA business associate agreement.
• Professional advisers such as our accountants, insurers, and attorneys, where necessary.
• Legal and safety reasons — when required by law, subpoena, or court order, or to protect the rights, property, or safety of our patients, staff, or the public.
• Business transfers — if the practice is sold or reorganized, information may transfer as part of that transaction, subject to this policy and applicable law.

9Third-party services

Some features are provided by companies we work with, and using them means sharing information with those companies:

• Payments — card payments are taken on Bank of America's secure payment page, and financing through Affirm and the other lenders listed on our financing page. We never receive your full card number. Lenders handle your application under their own privacy policies.
• Messages — texts are sent through Twilio and email through Resend.
• Video visits — telehealth visits run on doxy.me.
• Document reading — Anthropic, as described in section 6.
• Analytics — Metricool, only if you accept (section 7).
• Website assistant — the chat assistant on our site processes the messages you type in order to answer your question. Please do not enter medical details into it.
• Hosting and infrastructure — our site and systems are hosted by third-party providers that process requests and keep standard access logs on our behalf.
• Fonts and embedded media — pages may load fonts, maps, or embedded video from third parties, which receive your IP address in order to serve that content.

10How long we keep information

• Medical records — retained for the period required by California law and professional standards, generally at least seven years after the last date of service, and longer for patients treated as minors.
• Billing records — retained as required by tax, accounting, and insurance rules.
• Inquiries and marketing contacts — kept while you remain interested in hearing from us, and removed on request or after a period of inactivity.
• App account data — kept while your account is active; see section 14.
• Server logs — kept for a short period for security and troubleshooting.

11How we protect information

We use administrative, technical, and physical safeguards appropriate to a medical practice, including encryption of data in transit, access controls that limit information to staff who need it, and staff training. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a breach affects your information, we will notify you as required by law.

12Your privacy rights

Depending on the information involved and where you live, you may have the right to:

• Know what personal information we hold about you and how we use it.
• Request a copy of it, or of your medical record.
• Ask us to correct information that is inaccurate.
• Ask us to delete information we are not required to keep.
• Opt out of marketing email and text messages at any time.
• Be free from discrimination for exercising any of these rights.

Rights over your medical record are explained in our Notice of Privacy Practices. California residents have the additional rights in section 13.

13California privacy rights

If you live in California, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), gives you the right to:

• Know the categories and specific pieces of personal information we have collected about you, where it came from, why we collected it, and who we disclosed it to.
• Delete personal information we collected from you, subject to legal exceptions.
• Correct inaccurate personal information.
• Opt out of the sale or sharing of your personal information.
• Limit the use of sensitive personal information to what is needed to provide the services you asked for.
• Not be discriminated against for using any of these rights.

Do Not Sell or Share My Personal Information

We do not sell personal information and do not share it for cross-context behavioral advertising, and we have not done so in the past 12 months. Our only optional tracker is Metricool analytics, which runs only if you accept it. To opt out of it — or to make sure it never runs — press Decline on the cookie notice, use the Change cookie choice button in section 7, or turn on Global Privacy Control in your browser. We treat a Global Privacy Control signal as a valid request to opt out of sale and sharing for that browser, and the tracker does not load. You may also send an opt-out request by email, as below.

How to make a request

Email info@nimawellness.com with the subject “California privacy request,” or call (949) 763-9255. Tell us which right you are using. We will confirm receipt within 10 business days and respond within 45 days. We verify your identity by matching details you give us against our records before acting. You may use an authorized agent, who must show your signed permission.

Medical information

Medical information is protected by the California Confidentiality of Medical Information Act (CMIA) and HIPAA rather than the CCPA. We do not disclose your medical information without your written authorization except as those laws allow — for example, for your treatment, payment for your care, and our health care operations. To get a copy of your medical record or ask about it, see our Notice of Privacy Practices.

14Mobile app and account deletion

The NIMA app lets you check in at the clinic, manage your appointments, complete forms, and pay. It collects the account details listed in section 3 and, with your permission, may use your device's camera or photo library when you choose to upload something.

You can delete your app account and its associated personal data at any time. Full instructions are on our account deletion page. Deleting your app account does not delete your medical record, which we are legally required to retain.

15Age requirement

Our website, booking pages, and app are intended for adults 18 and older. They are not directed to anyone under 18, and we do not knowingly collect personal information from minors online. Minors are treated at the practice only with the consent and involvement of a parent or legal guardian. If you believe a minor has given us information online, contact us and we will delete it.

16Changes to this policy

We may update this policy as our services or the law change. The date at the top reflects the most recent version. If we make a material change, we will make that clear on this page.

17How to contact us

For questions about this policy, to exercise any of the rights above, or for a paper copy of our Notice of Privacy Practices: