Privacy policy

• 1. About This Policy
• 2. Information We Collect
• 3. HIPAA & Protected Health Information
• 4. SMS / Text Messaging
• 5. How We Use Your Information
• 6. How We Share Your Information
• 7. Data Security
• 8. Your Rights (CCPA / CPRA)
• 9. Cookies & Website Tracking
• 10. Children's Privacy
• 11. Changes to This Policy
• 12. Contact Us

🏥 HIPAA Notice  Our separate Notice of Privacy Practices governs use of your Protected Health Information. Request a copy at your visit or by texting (805) 218-7779. 

 Section 01

About This Privacy Policy

This Privacy Policy ("Policy") applies to Weigh Less Health Center, doing business as The Whole Health 2-Step Plan, located at 760 East Las Posas Road, Camarillo, California 93010 ("we," "us," or "our").

This Policy describes how we collect, use, disclose, and protect information we receive from you when you: visit our website at the-whole-health-2-step.info; contact us by phone, text message, email, or WhatsApp; schedule or attend a consultation or follow-up appointment; or enroll in any of our programs or subscriptions.

By using our website, texting or calling our number, or becoming a member, you agree to the terms described in this Policy. If you do not agree, please do not use our services or provide us with your personal information.

Important: This Policy is separate from our HIPAA Notice of Privacy Practices, which specifically governs how we handle your Protected Health Information (PHI) as a covered healthcare provider. Both documents apply to you as a patient/member.  

 Section 02

• Full name, date of birth, and gender
• Home address, city, state, and ZIP code
• Phone number (mobile and/or home)
• Email address
• Emergency contact information

• Current weight, height, body mass index (BMI), and weight history
• Medical history, current diagnoses, and health conditions relevant to weight management
• Current medications, supplements, and known allergies or sensitivities
• Prescription history at Weigh Less Health Center
• Insurance provider, member ID, and plan information
• Information provided to support insurance reimbursement claims

• Credit/debit card details (processed securely through our payment processor — we do not store full card numbers)
• Billing address and transaction history
• Subscription plan and billing cycle preferences

• Content of text messages, emails, and WhatsApp messages sent to us
• Appointment scheduling preferences and notes
• Feedback, reviews, or testimonials voluntarily provided

• IP address, browser type, and operating system
• Pages visited, time on page, and referring website
• Device type and screen resolution
• Cookie data (see Section 9) Section 01

About This Privacy Policy

This Privacy Policy ("Policy") applies to Weigh Less Health Center, doing business as The Whole Health 2-Step Plan, located at 760 East Las Posas Road, Camarillo, California 93010 ("we," "us," or "our").

This Policy describes how we collect, use, disclose, and protect information we receive from you when you: visit our website at the-whole-health-2-step.info; contact us by phone, text message, email, or WhatsApp; schedule or attend a consultation or follow-up appointment; or enroll in any of our programs or subscriptions.

By using our website, texting or calling our number, or becoming a member, you agree to the terms described in this Policy. If you do not agree, please do not use our services or provide us with your personal information.

Important: This Policy is separate from our HIPAA Notice of Privacy Practices, which specifically governs how we handle your Protected Health Information (PHI) as a covered healthcare provider. Both documents apply to you as a patient/member.  

 Section 03

Weigh Less Health Center is a covered entity under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its implementing regulations (45 C.F.R. Parts 160 and 164).

PHI is any individually identifiable health information that we create, receive, transmit, or maintain in connection with your care, including your weight history, prescriptions, diagnoses, payment records tied to health services, and any information that could reasonably identify you.

Under HIPAA, we may use and disclose your PHI for the following purposes without your written authorization:

• Treatment: To provide, coordinate, or manage your healthcare and related services, including sharing information with other treating providers if necessary.
• Payment: To obtain reimbursement for services, including billing insurance carriers and processing claims.
• Healthcare Operations: For internal activities such as quality assessment, staff training, business management, and compliance reviews.
• As Required by Law: To comply with federal, state, or local legal obligations, court orders, or government investigations.
• Public Health Activities: To report communicable diseases, adverse drug events, or child abuse as required by California law.

We will not use or disclose your PHI for marketing purposes, sale of PHI, or any purpose not described above without your written authorization. You may revoke such authorization at any time in writing.

Your HIPAA Rights include: the right to access and copy your medical records; the right to request corrections; the right to an accounting of disclosures; the right to request restrictions on certain uses; and the right to file a complaint with the U.S. Department of Health & Human Services (HHS) Office for Civil Rights if you believe your rights have been violated. No retaliation will occur for filing a complaint.

Our full HIPAA Notice of Privacy Practices is available at your appointment, upon request, or by texting (805) 218-7779..  

Section 04

⚠️ 10DLC Compliance Notice: Our text messaging program is registered with major U.S. carriers under the 10DLC (10-Digit Long Code) framework. The disclosures in this section satisfy carrier and CTIA requirements for legitimate healthcare SMS programs.

Weigh Less Health Center uses SMS (text messaging) at (805) 218-7779 for the following purposes:

• Appointment scheduling, confirmations, reminders, and cancellations
• Responses to your inbound inquiries and questions
• Prescription pickup notifications and refill reminders
• Program information, plan options, and pricing updates
• Notifications about new programs (such as the upcoming GLP-1 Challenge)
• Health and wellness tips related to your weight loss program (where consented)
• Subscription billing reminders and renewal notices

You provide express written consent to receive text messages from Weigh Less Health Center by any of the following actions:

• Texting our number (805) 218-7779 to initiate contact
• Checking an opt-in box on any intake or registration form
• Verbally confirming consent at your appointment (documented in your record)
• Replying YES or JOIN to an opt-in confirmation message

By opting in, you consent to receive both transactional messages (appointments, prescriptions) and, where separately indicated, informational or promotional messages about our programs.

Message frequency varies based on your appointment schedule, subscription status, and program enrollment. Active members may receive 2–6 messages per week. You will never receive unsolicited marketing messages without your consent.

Standard message and data rates may apply depending on your mobile carrier plan. Weigh Less Health Center does not charge separately for text messages. Contact your carrier for rate details.

You may opt out of non-essential text messages at any time. To stop receiving messages, reply STOP to any text message from us. You will receive one final confirmation message and then no further messages will be sent except those required for your direct care (such as prescription pickup notifications).

For help with our text messaging program, reply HELP to any message, call us at (805) 218-7779, or email Weigh-Less-Team@the-whole-health-2-step.info.

Our SMS program supports all major U.S. carriers, including AT&T, Verizon, T-Mobile, Sprint, US Cellular, and regional carriers. Carrier availability may vary.

Privacy of Text Messages: Text messages you send to us may contain Protected Health Information (PHI). While we take commercially reasonable precautions to protect our systems, SMS is not a fully encrypted channel. If you prefer to share sensitive health information, please call us directly or use our secure patient messaging if available. By texting us, you acknowledge this limitation.

Mobile opt-in data and consent information — including your phone number and messaging preferences — will not be shared with third parties for their marketing or promotional purposes. This data is used solely to communicate with you about your care and our programs.  

 Section 05

Beyond the HIPAA-governed uses described in Section 3, we use your non-PHI personal information for the following purposes:

• Scheduling and managing your appointments
• Processing subscription enrollments, cancellations, and modifications
• Dispensing and tracking your prescriptions and supplements
• Responding to your questions and communications

• Processing payments and maintaining billing records
• Improving our website, services, and member experience
• Analyzing aggregate (non-identifiable) data to measure program effectiveness
• Training staff and ensuring quality of care

• Sending appointment reminders and confirmations
• Notifying you of new programs, pricing changes, or service updates
• Responding to your requests for information or callbacks

• Maintaining records as required under California Business & Professions Code and federal healthcare regulations
• Responding to lawful legal requests, court orders, or government inquiries
• Enforcing our terms of service and subscription agreements
• Detecting and preventing fraud or unauthorized access

Section 06

We do not sell your personal information. We do not share your information with third parties for their own marketing purposes. We may share your information only in the following limited circumstances:

We may share information with trusted vendors who help us operate our business, such as payment processors, scheduling software, website hosting providers, and SMS platforms. These vendors are contractually required to protect your information and may only use it to provide services to us. Where PHI is involved, these vendors execute HIPAA Business Associate Agreements (BAAs).

With your consent, we may share relevant health and billing information with your health insurance carrier to support reimbursement claims for your Weigh Less consultations.

If you were referred to Weigh Less Health Center by a physician, we may communicate with that provider regarding your progress to coordinate your care, as permitted under HIPAA.

We may disclose information when required to do so by law, in response to a valid subpoena, court order, or government request, or to protect the rights, property, or safety of our patients, staff, or the public.

In the event of a merger, acquisition, or sale of substantially all of our assets, your information may be transferred to the acquiring entity. You will be notified via email or prominent notice on our website prior to such transfer, and the acquiring entity will be required to honor this Policy.

We will never: Sell your name, phone number, or health information to marketing companies, data brokers, or advertisers. We will never share your opt-in consent data with third parties for their own promotional purposes.

 Section 07

We implement commercially reasonable administrative, technical, and physical safeguards to protect your personal and health information against unauthorized access, loss, alteration, or disclosure. These measures include:

• Access controls limiting staff access to information on a need-to-know basis
• Encrypted storage and secure transmission of electronic health records and payment data
• Regular security assessments of our technology systems and vendors
• Staff training on HIPAA requirements and data privacy best practices
• Locked physical storage for any paper-based health records

Despite these precautions, no method of electronic transmission or storage is 100% secure. If you have reason to believe your information with us has been compromised, please contact us immediately at (805) 218-7779.

In the event of a data breach affecting your PHI, we will notify you in accordance with HIPAA's Breach Notification Rule (45 C.F.R. §§ 164.400–414) and California's data breach notification law (Cal. Civ. Code § 1798.29).

Section 08

As a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), subject to certain exceptions for PHI governed by HIPAA:

You have the right to request that we disclose what personal information we have collected about you, the categories of sources, the business purpose for collection, and any third parties with whom it was shared.

You have the right to request deletion of your personal information, subject to legal retention requirements (e.g., medical records must be retained for a minimum of 10 years under California law for adults).

You have the right to request correction of inaccurate personal information we hold about you.

We do not sell or share your personal information for cross-context behavioral advertising. No opt-out action is required.

We will not discriminate against you for exercising any of these rights. You will not receive reduced quality of care or higher prices for exercising your privacy rights.

To exercise any of the above rights, contact us by:

• Text / Call: (805) 218-7779
• Email: Weigh-Less-Team@the-whole-health-2-step.info
• Mail: 760 East Las Posas Road, Camarillo, CA 93010

We will respond to verifiable consumer requests within 45 days, with a possible 45-day extension if needed. We will need to verify your identity before processing your request.

We implement commercially reasonable administrative, technical, and physical safeguards to protect your personal and health information against unauthorized access, loss, alteration, or disclosure. These measures include:

• Access controls limiting staff access to information on a need-to-know basis
• Encrypted storage and secure transmission of electronic health records and payment data
• Regular security assessments of our technology systems and vendors
• Staff training on HIPAA requirements and data privacy best practices
• Locked physical storage for any paper-based health records

Despite these precautions, no method of electronic transmission or storage is 100% secure. If you have reason to believe your information with us has been compromised, please contact us immediately at (805) 218-7779.

In the event of a data breach affecting your PHI, we will notify you in accordance with HIPAA's Breach Notification Rule (45 C.F.R. §§ 164.400–414) and California's data breach notification law (Cal. Civ. Code § 1798.29).

 Section 09

Our website (the-whole-health-2-step.info) is built on GoDaddy Website Builder / Websites + Marketing. It may use cookies and similar tracking technologies for the following purposes:

Necessary for the website to function properly. These cannot be disabled and do not collect personal information.

We may use third-party analytics tools (such as Google Analytics) to understand how visitors interact with our website — including which pages are most visited and how long visitors stay. This data is aggregated and does not identify you personally.

You can control cookie settings through your browser preferences. Disabling cookies may affect website functionality. Most browsers allow you to refuse all cookies, delete existing cookies, or be warned before a cookie is stored.

We do not use cookies to track your health-related browsing behavior or to build advertising profiles. Our website does not display third-party advertisements.

Section 10

Our services are intended for adults aged 18 and over. We do not knowingly collect personal information from individuals under the age of 18 without verifiable parental consent.

If you are a parent or guardian and believe your minor child has provided us with personal information without your consent, please contact us at (805) 218-7779 or Weigh-Less-Team@the-whole-health-2-step.info and we will promptly delete that information.

This website and our text messaging program are not directed at children, and we do not knowingly send marketing messages to minors.

Section 11

We may update this Privacy Policy periodically to reflect changes in our practices, legal requirements, or carrier SMS compliance standards. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page
• Post the revised Policy on our website
• For material changes affecting your PHI rights, notify you directly by text or email

Your continued use of our services after any changes become effective constitutes your acceptance of the revised Policy. We encourage you to review this page periodically.