Privacy Policy

This Privacy Policy is issued by BraveWorms Medical, P.C. and describes the personal information we process about visitors to the website at braveworms.com. It also serves as the California "Notice at Collection" required by the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, "CCPA/CPRA"), Cal. Civ. Code § 1798.100 et seq.

It does not cover information you share with a clinician during a clinical encounter. That information is protected health information (PHI) and is held by us subject to HIPAA (45 C.F.R. Parts 160 and 164), the California Confidentiality of Medical Information Act (Cal. Civ. Code § 56 et seq.), and the Notice of Privacy Practices.

In the past 12 months we have collected the following categories of personal information, mapped to Cal. Civ. Code § 1798.140(v):

• Identifiers — name, email, IP address, device identifiers (when you contact us or subscribe to editorial updates).
• Customer records — billing email and ZIP code (when you book a visit; collected by our payment processor on our behalf).
• Internet or network activity — pages viewed, referrer, approximate region (state/city), browser and OS — collected by privacy-respecting first-party analytics that do not use cross-site tracking cookies.
• Geolocation — coarse, IP-derived only; we do not collect precise GPS location from the website.
• Sensitive personal information — we do not collect government IDs, financial account numbers, race, religion, union membership, biometric data, or precise geolocation through the website. Health information collected through clinical intake is PHI and handled under the NPP.

We do not collect personal information about minors under 16, and we do not knowingly process such information through the website.

• Directly from you (forms, email, newsletter signup, intake portal handoff).
• Automatically from your device (server logs, analytics).
• From service providers acting on our behalf (e.g., the payment processor confirming a charge succeeded).

• To operate, maintain, and secure the website.
• To respond to inquiries and process appointment bookings.
• To send editorial updates you have requested (you can unsubscribe at any time).
• To prevent fraud, debug errors, and meet legal obligations.
• To produce aggregate, de-identified analytics about website usage.

We retain personal information only as long as needed for the purpose collected:

• Server logs and analytics: 30 days, then aggregated.
• Email correspondence: up to 24 months from last contact.
• Billing and business records: 7 years for tax purposes.
• Medical records (under HIPAA/CMIA): at least 7 years from the last date of service for adults; for minors, until age 19 or 7 years after last service, whichever is longer (consistent with Cal. Health & Safety Code § 123145 and Cal. Bus. & Prof. Code § 2266).

We share personal information only with service providers who process it on our behalf under written contracts that limit their use. Categories include:

• Hosting and infrastructure (website hosting, content delivery, error monitoring).
• Payment processing (for visit fees).
• Email delivery (transactional and editorial messages).
• Privacy-respecting first-party analytics.
• Clinical software (intake portal, e-prescribe, lab orders, secure messaging) — these vendors are HIPAA Business Associates.

We may disclose information when required by law (subpoena, court order, regulatory request) or to protect rights, safety, or property. We will challenge overbroad requests where appropriate.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising as those terms are defined under CCPA/CPRA.

If you are a California resident, you have the right to:

• Know what personal information we have collected about you, the categories, sources, purposes, and recipients.
• Access and receive a copy of your personal information.
• Correct inaccurate personal information.
• Delete personal information, subject to legal exceptions (e.g., medical records that must be retained).
• Limit use of sensitive personal information — not applicable because we do not use sensitive PI for purposes beyond what is necessary to provide our services.
• Opt out of sale or sharing — not applicable because we do not sell or share. We honor the Global Privacy Control browser signal automatically.
• Non-discrimination for exercising any of these rights.

How to submit a request

Email privacy@braveworms.com with the request type and the email address you used with us. We will verify your identity by replying to that email and may ask for limited additional information. We respond within 45 days, with one 45-day extension if reasonably necessary, as permitted by CCPA/CPRA.

Authorized agents

You may designate an authorized agent. We will require written, signed permission from you and may verify your identity directly.

Appeals

If we deny a request, you may appeal by replying to the denial. You may also file a complaint with the California Privacy Protection Agency (cppa.ca.gov) or the California Attorney General (oag.ca.gov).

Cal. Civ. Code § 1798.83 lets California residents request information about disclosures of personal information to third parties for those parties' direct marketing. We do not make such disclosures.

We do not offer any financial incentives in exchange for the collection, sale, or deletion of personal information.

The website and the clinical service are intended for adults 18 and older. We do not knowingly collect personal information from children under 13 in violation of the Children's Online Privacy Protection Act (COPPA) or from minors under 16 in violation of CCPA/CPRA. If you believe we have collected such information, please contact privacy@braveworms.com and we will delete it.

We use TLS in transit, encryption at rest, role-based access, and audit logging. Clinical systems are operated by HIPAA-compliant vendors under Business Associate Agreements. No system is perfectly secure; we will notify you and applicable regulators of a breach as required by Cal. Civ. Code § 1798.82, HIPAA Breach Notification Rule (45 C.F.R. §§ 164.400–414), and CMIA.

If you visit the Site from outside California or the United States, your information will be processed in the United States. By using the Site you consent to that transfer. Clinical services are available only to people physically located in California at the time of the visit.

BraveWorms Medical, P.C.
4251 Long Beach Blvd, Suite 102, Long Beach, CA 90807
privacy@braveworms.com

Material changes will be posted here with a new effective date and, where required, communicated by email.