Effective date: Preparation only — effective date will be completed at actual general-patient release: [Actual general-patient launch date; completed at release]
Practice: Luma Wellness, LLC, referred to below as “Luma,” “we,” or “our practice.” The public clinic name is Luma Wellness Clinic.
Privacy contact
Cordelia Okwuosah, FNP-BC — Practice Manager / Privacy Contact
Luma Wellness, LLC
Telephone: 386-227-7580
Administrative email: contact@golumawellness.com
Mailing address: 1070 Montgomery Rd, Unit 318, Altamonte Springs, FL 32714-7420, US
This address is a mailing contact, not an invitation to attend an in-person clinic. Contact us to request this notice, ask a privacy question, exercise a privacy right, or arrange a confidential way to communicate. Do not include symptoms, medication history, records, or other medical details in ordinary email. Ask us to arrange an appropriate secure method when your request needs sensitive information. The telephone and email are not emergency services and may not be answered immediately.
Who and what this notice covers
This notice describes the privacy practices of Luma Wellness, LLC and its authorized workforce when handling your protected health information. Protected health information includes information that identifies you and relates to your health, health care, or payment for care, whether held electronically, on paper, or communicated verbally.
Separate pharmacies, laboratories, other treating providers, and other independent organizations may have their own privacy notices and duties. This is not a joint notice covering those organizations.
Your rights and how to use them
Contact the Privacy Contact above to make a request. We may ask for a written request and reasonable identity or representative-authority verification, as appropriate. We will explain the process and arrange a suitable channel. You do not have to use an AI assistant to exercise these rights.
See or receive a copy of your records
You may ask to inspect or receive an electronic or paper copy of your medical and billing records and other information in the records used to make decisions about you. We will provide the requested form and format when readily producible, or agree with you on an available alternative. A summary is provided instead only if you agree to it.
HIPAA generally requires action within 30 days, with a limited written extension when permitted. We follow shorter applicable state deadlines. For example, California law generally provides inspection within five working days and transmission of copies within 15 days, subject to its applicable exceptions. Florida requires copies in a timely manner. We may charge only a fee permitted by applicable law and will explain any fee. We will not withhold your records because of an unpaid bill for care.
Certain information has limited access exceptions under law. If we deny a request, we will explain the reason and any available review rights in writing.
Ask for a correction
You may ask in writing to amend information you believe is incorrect or incomplete and explain why. Under HIPAA we generally act within 60 days; a limited extension requires written notice. If we deny the request, we will explain why and how you may submit a statement of disagreement. An amendment does not necessarily delete the original record.
Request confidential communications
You may ask us to contact you in a particular way or at a different location, such as a particular telephone number or mailing address. We will accommodate reasonable requests. We will not require you to explain why you are requesting confidential communications. Our preference for secure messages does not take away this right. Tell us if you need an accessible alternative or human assistance.
Ask us to limit a use or disclosure
You may ask us not to use or disclose certain information for treatment, payment, or health care operations. We are generally not required to agree, but will explain our decision. An agreed restriction may have an emergency-treatment exception permitted by law.
If you pay out of pocket in full for a health care item or service, you may ask us not to disclose information about that item or service to your health plan for payment or health care operations. We must agree unless the disclosure is required by law. Tell us about the request so it can be recorded and applied. This restriction does not automatically bind a separate provider or pharmacy.
Receive an accounting of disclosures
You may request a list of certain disclosures made during the six years before your request, identifying the recipient and purpose. HIPAA excludes certain disclosures from this accounting, including most disclosures for treatment, payment, and health care operations and disclosures you authorized. We will include any additional disclosures required by applicable law. The first accounting in a 12-month period is free. We will explain any permitted fee for additional accountings and let you change or withdraw the request before charging it.
Receive this notice
You may request a paper copy at any time, even if you agreed to receive it electronically. We will provide a paper copy promptly. You may also request an electronic copy.
Have a representative act for you
A legally authorized personal representative may exercise applicable rights on your behalf. We verify the person's authority and its scope before releasing information. Applicable law may limit representative access, including in certain abuse, neglect, or endangerment circumstances.
Make a complaint without retaliation
You may complain to Luma or to the U.S. Department of Health and Human Services Office for Civil Rights (OCR). You do not have to complain to Luma first. We will not retaliate against you for filing a complaint or exercising your privacy rights. Instructions appear below.
How we ordinarily use and disclose information
We may use or disclose information for the purposes below when permitted or required by applicable law. More protective state law and special-record restrictions may require additional permission or prohibit a disclosure otherwise allowed by HIPAA.
Treatment
We use information to evaluate and care for you and may share it with other professionals involved in your treatment.
Example: Your clinician reviews your intake and shares relevant information with a treating specialist, laboratory, or pharmacy to coordinate appropriate care.
Payment
We use relevant information to bill, collect payment, maintain payment records, and resolve billing questions. If legally permitted and relevant, information may be shared with a payer or other entity responsible for payment. This does not mean Luma accepts or bills every insurance plan.
Example: We reconcile your prepaid visit against the appointment and payment confirmation received through ClinikEHR's native payment workflow. We do not need your full medical history in a card-payment description.
Health care operations
We use relevant information to operate the practice, review care quality, manage records and appointments, train authorized personnel, and carry out permitted audit, compliance, and administrative work.
Example: The Practice Manager reviews whether the correct secure intake and consent documents were delivered and whether access was limited to authorized personnel.
Service providers
We may use service providers for records, telehealth, billing, and other approved functions. Where legally required, a provider that handles protected health information on our behalf must be subject to an appropriate business associate agreement and safeguards. Access is limited to the authorized purpose and applicable legal requirements.
Luma's designated workflow uses ClinikEHR for clinical records, private intake, and video visits, and Stripe through ClinikEHR for payment processing. Naming a vendor does not certify every feature as HIPAA-compliant or mean a payment processor may receive a complete clinical record. Card details belong in the designated payment system, not email, public chat, or intake narrative fields. Future vendors or AI functions must be reviewed before receiving health information.
Appointment and care-related communications
We may contact you about appointments, secure-document invitations, follow-up arrangements, or treatment-related services when permitted. We use reasonable safeguards and respect reasonable confidential-communication requests. A general reminder or invitation may still reveal that you have a relationship with Luma to someone with access to your inbox or device.
Other legally permitted or required uses and disclosures
These categories are not blanket permission to release your records. We assess the applicable conditions, restrictions, and required permissions before disclosure.
- Public health and safety: Reporting certain diseases, adverse medication reactions, product recalls, or other public health information; reporting suspected abuse, neglect, or domestic violence under applicable law; or helping prevent a serious and imminent threat where legally permitted.
- Health oversight: Cooperating with legally authorized licensing, audit, inspection, or other health oversight activities.
- Required by law: Providing information when a law requires it, including to HHS for a lawful privacy-compliance review.
- Legal proceedings and law enforcement: Responding to a valid court or administrative order, subpoena, or other legally authorized request only after the required legal conditions and any special protections are satisfied. A request by itself does not automatically authorize disclosure.
- Workers' compensation: Disclosing information as authorized by applicable workers' compensation law.
- Research: Using or disclosing information only through a legally permitted research pathway, such as your authorization, an applicable approved waiver, or properly de-identified information. This notice does not enroll you in research.
- Organ or tissue donation and deceased persons: Providing legally permitted information to organ procurement organizations, coroners, medical examiners, or funeral directors.
- Special government functions: Disclosures allowed by law for specified military, national security, protective-service, or correctional/custodial functions, where relevant and subject to applicable restrictions.
Your choices and written authorizations
We may share information relevant to a family member, friend, or other person involved in your care or payment if you agree, have an opportunity to object and do not object, or another legal basis applies. Tell us your preferences. When you cannot express a choice, a clinician may use professional judgment to make a legally permitted disclosure in your best interests. Similar limits apply to permitted disaster-relief communications.
Most uses or disclosures of separately maintained psychotherapy notes, marketing uses requiring authorization, and sales of protected health information require your written authorization, subject to limited legal exceptions. Other uses and disclosures not described in this notice will be made only with your written authorization unless another applicable law permits or requires them. You may revoke an authorization in writing at any time, except to the extent we have already relied on it or another legal exception applies.
Luma does not sell patient health information or use it for third-party advertising. Luma does not currently operate a patient-information fundraising program. If fundraising is introduced, legally required notices and opt-out rights must be provided first. For Part 2 records, any fundraising use must include a clear and conspicuous advance opportunity to choose not to receive fundraising communications. Receipt of this notice is not marketing, fundraising, recording, AI-training, or treatment consent.
Additional protection for sensitive records and state law
When applicable California or Florida law is more protective than HIPAA, we follow that more protective law. California's Confidentiality of Medical Information Act limits disclosures without authorization except through its specified legal pathways. Florida law generally limits furnishing records or discussing a patient's condition outside the patient, legal representative, and treating providers without written authorization, subject to statutory exceptions. State law may also impose additional requirements for particular information, such as HIV-related, mental health, genetic, or reproductive-health information. We obtain additional permission or apply other restrictions when required.
Substance use disorder records — only when applicable
If we receive or maintain your substance use disorder patient records protected by 42 CFR Part 2, the special protections for those records apply in addition to HIPAA and state law. We will not use or disclose such records, or testimony relaying their contents, in civil, criminal, administrative, or legislative investigations or proceedings against you without your applicable written consent or a qualifying court order following the required notice and opportunity to be heard. A court order authorizing disclosure must also be accompanied by a subpoena or other legal requirement compelling disclosure. Other Part 2 uses or disclosures must meet the applicable consent or exception requirements.
This conditional statement does not mean every mention of substance use in a general medical record is a Part 2 record or that Luma operates a Part 2 program.
Electronic communication, telehealth, and future chat
Clinical history and documents should be submitted only through the clinic-designated secure clinical workflow. Public website chat, social media, and contact@golumawellness.com are not designated clinical-intake channels. Do not put medical details there. Contact the Privacy Contact to arrange an appropriate secure or confidential alternative.
Luma may prefer secure written messages for routine administration so the clinician can focus on scheduled visits. Phone and mail remain available for privacy requests and arranging reasonable alternatives; choosing not to use an AI assistant does not waive your rights. Messages and forms are not continuously monitored. For a medical emergency, call 911 or seek immediate emergency care rather than wait for chat, email, a form, or a callback.
A future administrative AI assistant, if introduced, must identify itself and have a way to request human assistance. It will not diagnose, prescribe, determine urgent-care eligibility, or replace a clinician's assessment. This notice does not authorize a chatbot, clinical AI processing, call recording, video recording or AI transcription. Relevant vendor agreements, data flows, security controls, and any necessary separate disclosures/consents must be established first.
Our responsibilities
We are required to maintain the privacy of protected health information, provide notice of our legal duties and privacy practices, and follow the notice currently in effect. We apply safeguards required by applicable privacy and security law. We notify affected individuals following a breach of unsecured protected health information as required by law.
We will not use or disclose your information beyond what is described in the effective notice unless you authorize it in writing or applicable law permits or requires it. We restrict access to authorized purposes and apply minimum-necessary requirements where they apply. No electronic system can be promised to eliminate every privacy or security risk.
Changes to this notice
We reserve the right to revise this notice and, where permitted by law, apply new terms to information we already maintain as well as information received later. A material change will be reflected in a revised notice with an effective date before the changed practice is implemented, except where law requires otherwise.
The current approved notice will be available on request and prominently accessible on our public website. If we maintain a physical service-delivery site, it will also be available and prominently posted there as required. You may request the current version using the Privacy Contact above.
How to complain
To Luma: Call 386-227-7580 or write to Cordelia Okwuosah, FNP-BC, Practice Manager / Privacy Contact, at the mailing address above. You may email contact@golumawellness.com to ask for a secure way to submit a complaint; ordinary email is not the requested place for medical details. We will help arrange an appropriate confidential channel.
To HHS/OCR: Visit HHS's privacy complaint instructions or the OCR Complaint Portal. You may also submit a written complaint to:
Centralized Case Management Operations
U.S. Department of Health and Human Services
200 Independence Avenue, S.W., Room 509F HHH Bldg.
Washington, D.C. 20201
HHS's model lists 1-877-696-6775 for telephone information. OCR complaints generally must be filed within 180 days of when you knew of the issue; OCR may extend this for good cause. You may complain directly to OCR without first contacting Luma. We will not retaliate against you.