HIPAA Notice of Privacy Practices and Web Privacy Policy

Scope of Notice

This Notice of Privacy Practices (“Notice”) applies to all protected health information (“PHI”) about you held or transmitted by Texas Digestive Disease Consultants, PLLC d/b/a GI Alliance and each of its subsidiaries and affiliates who are under common control and/or common ownership that are subject to HIPAA (as defined below) and are designated for HIPAA purposes as an affiliated covered entity (collectively, “we” or “our Practice”). All such affiliated entities follow the terms of this Notice and may share your information with each other for treatment, payment or health care operations. This list may be updated from time to time. For a current list of participating entities, contact the privacy officer at the contact information listed at the bottom of this notice.

PHI is any individually identifiable health information about your past, present or future physical or mental health or condition, the provision of healthcare to you, or your payment for healthcare.

PHI may include information about your condition or treatment, diagnostic tests and images, and related health information.

Our Responsibilities

Our Practice is dedicated to maintaining the privacy of your PHI. Our Practice is required by the Health Insurance Portability and Accountability Act (“HIPAA”) to maintain the privacy of your PHI and to provide you with notice of our legal duties and privacy practices with respect to your PHI. We are also required by law to notify affected individuals following a breach of unsecured PHI.

Our Practice must abide by the terms of this Notice while it is in effect. This Notice will remain in effect until our Practice replaces it. We reserve the right to change the terms of this Notice at any time, provided the changes comply with applicable law. If our Practice changes the terms of this Notice, the new terms will apply to all PHI we maintain, including PHI that was created or received before such changes were made. If our Practice changes this Notice, we will post the new Notice on our website and will provide copies upon request.

Uses and Disclosure of PHI that Do Not Require an Authorization

The following categories describe the different ways that our Practice may use and disclose your PHI without your authorization. Not every use and disclosure within a category will be listed. Your PHI may be stored in paper, electronic or other forms and may be disclosed electronically or by other methods.

Treatment

Our Practice may use and disclose your PHI for treatment purposes. For example, we may disclose PHI to another healthcare provider to whom we refer you. We may also disclose PHI about you to people, places and entities beyond our care partners who may be involved in your medical care. For example, we may give another physician treating you access to your medical information to assist the physician in treating you.

Payment

Our Practice may use and disclose your PHI to obtain reimbursement for the treatment and services you receive from us or another entity involved with your care. Payment activities include billing, collections and claims management. These activities also include determinations of eligibility and coverage to obtain payment from you, an insurance company, or another third party. For example, our Practice may send claims to your health insurance provider containing certain PHI.

Healthcare Operations

Our Practice may use and disclose your PHI for healthcare operations purposes. Healthcare operations include quality assessment and improvement activities, arranging for legal services, conducting training programs, reviewing the competence and qualifications of healthcare professionals, licensing activities, and sending you information about our health-related products and services, possible treatment options or alternatives that may interest you, or appointment reminders. We may make incidental disclosures of limited PHI, such as by mailing statements to you with your name on the envelope.

Business Associates

Our Practice may disclose your PHI to third parties who provide services to our Practice or on our Practice’s behalf, known as Business Associates. Our Practice requires our Business Associates to enter an agreement to safeguard your PHI and otherwise protect your privacy as required by law.

Electronic Data Exchanges

Consistent with applicable law and with your consent, we may send you text messages, emails or other electronic communications for treatment, payment, healthcare operations and other permitted purposes. Our Practice may participate in one or more Health Information Exchanges (HIEs) and may electronically share your PHI for treatment, payment, healthcare operations and other permitted purposes with other participants in the HIE. HIEs allow your healthcare providers to efficiently access and use your PHI as necessary for treatment and other lawful purposes.

Individuals Involved in Your Care or Payment for Your Care/Personal Representatives

Our Practice may disclose your PHI to your family or friends, or any other individual identified by you when they are involved in your care or in the payment for your care. Additionally, if a person has the authority by law to make healthcare decisions for you, we may disclose information about you to such patient representative and treat that patient representative the same way we would treat you with respect to your PHI. We may also disclose your PHI to a public or private entity authorized by law to assist in disaster relief efforts to notify, or assist in notifying, a family member or personal representative about your location, general condition, or death.

Required by Law

Our Practice may use or disclose your PHI when we are required to do so by law. For example, we may disclose PHI about you to the U.S. Department of Health and Human Services if it requests such information to determine that we are complying with federal privacy law.

Public Health Activities

Our Practice may disclose your PHI to public health authorities or other governmental authorities for public health purposes including preventing and controlling disease, reporting child abuse or neglect and reporting to the Food and Drug Administration regarding the quality, safety and effectiveness of a regulated product or activity. Our Practice may, in certain circumstances, disclose PHI to persons who have been exposed to a communicable disease or may otherwise be at risk of contracting or spreading a disease or condition as necessary in the conduct of a public health intervention or investigation.

Health Oversight Activities

Our Practice may disclose your PHI to a health oversight agency for authorized activities such as audits, investigations, inspections, licensing and disciplinary actions.

Abuse, Neglect or Domestic Violence

If our Practice reasonably believes you are a victim of abuse, neglect, or domestic violence, we may disclose your PHI to a government authority, including a social service protective agency, authorized by law to receive reports of abuse, neglect or domestic violence.

Judicial and Administrative Proceedings

Our Practice may disclose your PHI in response to an order from a court or administrative agency. We may also disclose your PHI in response to a subpoena, discovery request or other lawful process instituted by someone involved in the dispute, but only if efforts have been made to tell you about the request or to obtain an order protecting the information requested.

Law Enforcement

Our Practice may disclose your PHI for law enforcement purposes as permitted by HIPAA.

Coroners, Medical Examiners and Funeral Directors

Our Practice may disclose your PHI to coroners, medical examiners and/or funeral directors for purposes such as identification, determining the cause of death, and fulfilling duties relating to deceased individuals.

Research

Our Practice may use or disclose your PHI for research when permitted by law, including when an institutional review board or privacy board has reviewed the research proposal and established a process to ensure the privacy of the requested information and approved the research.

Serious Threat to Health or Safety

Our Practice may use or disclose PHI when permitted by the applicable law to prevent or lessen a serious and imminent threat to the health or safety of a person or the public.

Worker’s Compensation

Our Practice may disclose your PHI to the extent authorized by and to the extent necessary to comply with laws relating to worker’s compensation or other similar programs established by law.

Specialized Government Functions

Our Practice may use and disclose PHI for specialized government functions, including military and veterans’ activities, national security and intelligence activities, and to correctional institutions.

Organ Donation

Our Practice may use and disclose your PHI to entities involved in procuring, banking, and transplanting organs, eyes, and tissues to assist with donation or transplantation.

Limited Data and De-identified Data

Our Practice may remove most information that identifies you from a set of data and use and disclose this data set for research, public health, and healthcare operations, provided the recipients of the data set agree to keep it confidential. We may also de-identify your PHI and use and disclose the de-identified information for purposes permitted by law.

Use and Disclosure of PHI Pursuant to an Authorization

In any other situation not described in this Notice, our Practice will ask for your written authorization before using or disclosing information about you, in accordance with applicable law. Most uses and disclosures of PHI for marketing purposes and disclosures that constitute a sale of PHI will be made only with your written authorization. We will not use or disclose psychotherapy notes (private notes of a mental health professional kept separately from a medical record) without your written authorization. You may revoke an authorization in writing at any time. Upon receipt of the written revocation, we will stop using or disclosing your PHI for the purpose previously authorized, except to the extent that we have already taken action in reliance on the authorization.

Substance Use Disorder (SUD) Records, under 42 CFR Part 2

The Practice is not a part 2 provider, however we may receive and maintain Part 2 records. A "Part 2 provider," means a provider of substance use disorder treatment subject to the federal privacy regulations outlined in 42 CFR Part 2. If we receive records from a federally assisted substance use disorder program that are protected under 42 CFR Part 2, those records have special confidentiality protection. We will not use or disclose those records without your written consent, except as allowed by law. Once you authorize us to share these records, they may no longer be protected by Part 2, but they will still be protected by HIPAA. If you have questions about these protections, please contact our Privacy Officer as noted below.

Your Rights Regarding Your PHI

You have the following rights regarding the PHI maintained by our Practice. If you have given another individual a medical power of attorney, if another individual is appointed as your legal guardian or if another individual is authorized by law to make healthcare decisions for you (such as your custodial parent) (known as a “personal representative”), that individual may exercise any of the rights listed below for you.

Confidential Communications

You have the right to receive confidential communications of your PHI. You may request that our Practice communicates with you through alternate means or at an alternate location, and our Practice will accommodate your reasonable requests. You must submit your request in writing to our Practice. If we are unable to contact you using the ways or locations you have requested, we may contact you using the information we have.

Restrictions

You have the right to request restrictions on certain uses and disclosures of PHI for treatment, payment or healthcare operations. You also have the right to request that our Practice restrict its disclosures of PHI to only certain individuals involved in your care or the payment of your care. You must submit your request in writing to our Practice. Our Practice is not required to comply with your request, except we are required to agree if your request is to restrict disclosures to a health plan for purposes of carrying out payment or healthcare operations, and the information pertains solely to a healthcare item or service for which you, or a person on your behalf (other than the health plan), has paid us out-of-pocket in full. If our Practice agrees to comply with your request, we will be bound by such agreement, except when otherwise required by law or in the event of an emergency.

Access

You have the right to inspect and obtain copies of your PHI that we maintain and to direct us to send your PHI stored in an electronic record to another person designated by you, with limited exceptions. This right applies to PHI used to make decisions about you or payment for your care, subject to limited exceptions provided by law. You must submit your request in writing to our Practice using the information provided at the end of this Notice. In most cases, we will provide access to you or the person you designate to get access within 30 days of your request or, if applicable, any shorter time period required by law. Our Practice may deny your request to inspect and/or obtain a copy of your PHI in certain limited circumstances, such as if we reasonably conclude that it would be detrimental to you. If we deny your request, we will inform you of the reason for the denial, and, in most cases, you may request a review of the denial. If you request PHI that we maintain on paper, we may provide photocopies. If you request PHI that we maintain electronically, you have the right to an electronic copy. We will use the form and format you request if readily producible. We may impose a reasonable cost-based fee for the costs of copying, mailing, labor, and supplies associated with your request.

Amendment

You have a right to request that our Practice amend your PHI if you believe it is incorrect or incomplete, and you may request an amendment for as long as the information is maintained by our Practice. You must submit your request in writing to our Practice using the information provided at the end of this Notice and provide a reason to support the requested amendment. Our Practice may, under certain circumstances, deny your request by sending you a written notice of denial. If our Practice denies your request, you will be permitted to submit a statement of disagreement for inclusion in your records.

Accounting of Disclosures

You have a right to receive an accounting of certain disclosures our Practice has made of your PHI in the past 6 years. This right does not include disclosures made pursuant to an authorization by you or for disclosures for purposes of treatment, payment or our health care operations. You must submit your request in writing to our Practice using the information provided at the end of this Notice, and you must specify the time period involved (however, an accounting is only required for the prior 6 years). Your first accounting within a period of 12 months will be free of charge. However, our Practice may charge you a reasonable cost-based fee for the costs involved in fulfilling any additional request made within the same 12-month period. Our Practice will inform you of such costs in advance so that you may withdraw or modify your request to save costs.

Paper Copy of this Notice

You have the right to obtain a paper copy of this Notice from our Practice at any time upon request, even if you have agreed to receive this Notice electronically. To obtain a paper copy of this notice, please email complianceGIA@gialliance.com or ask for a copy at one of our offices.

Complaints

You may complain to our Practice and/or to the Secretary of the Department of Health and Human Services (“the Secretary”) if you believe that your privacy rights have been violated. You may submit complaints to our Practice by contacting our Practice’s Privacy Officer at complianceGIA@gialliance.com or by calling our Privacy Officer at 1-877-373-1630.

Our Practice will not retaliate against you if you file a complaint with our Privacy Officer or the Secretary. You may file a complaint with the Secretary by contacting:

U.S. Department of Health and Human Services Office for Civil Rights
200 Independence Avenue, S.W.
Washington, D.C. 20201

Phone:  (877) 696-6775; or

www.hhs.gov

Contact Information

For more information about your privacy rights, please contact our Privacy Officer at complianceGIA@gialliance.com or 1-877-373-1630.

Web Privacy Policy

Your privacy is important to us. It is GI Alliance policy to respect your privacy and comply with any applicable law and regulation regarding any personal information we may collect about you, including across our website, https://gialliance.com, and other sites we own and operate.

Personal information is any information about you which can be used to identify you. This includes information about you as a person (such as name, address, and date of birth), your devices, payment details, and even information about how you use a website or online service.

In the event our site contains links to third-party sites and services, please be aware that those sites and services have their own privacy policies. After following a link to any third-party content, you should read their posted privacy policy information about how they collect and use personal information. This Privacy Policy does not apply to any of your activities after you leave our site.

This policy is effective as of July 1, 2025

Last updated: June 11, 2025

Information We Collect 

Information we collect falls into one of two categories: “voluntarily provided” information and “automatically collected” information.

“Voluntarily provided” information refers to any information you knowingly and actively provide us when using or participating in any of our services and promotions.

“Automatically collected” information refers to any information automatically sent by your devices in the course of accessing our products and services.

Log Data 

When you visit our website, our servers may automatically log the standard data provided by your web browser. It may include your device’s Internet Protocol (IP) address, your browser type and version, the pages you visit, the time and date of your visit, the time spent on each page, and other details about your visit.

Additionally, if you encounter certain errors while using the site, we may automatically collect data about the error and the circumstances surrounding its occurrence. This data may include technical details about your device, what you were trying to do when the error happened, and other technical information relating to the problem. You may or may not receive notice of such errors, even in the moment they occur, that they have occurred, or what the nature of the error is.

Please be aware that while this information may not be personally identifying by itself, it may be possible to combine it with other data to personally identify individual persons.

Device Data 

When you visit our website or interact with our services, we may automatically collect data about your device, such as:

• Device Type
• Operating System

Data we collect can depend on the individual settings of your device and software. We recommend checking the policies of your device manufacturer or software provider to learn what information they make available to us.

Personal Information

We may ask for personal information — when you contact us — which may include one or more of the following:

• Name
• Email
• Phone/mobile number
• Legitimate Reasons for Processing Your Personal Information

We only collect and use your personal information when we have a legitimate reason for doing so. In which instance, we only collect personal information that is reasonably necessary to provide our services to you.

Collection and Use of Information

We may collect personal information from you when you do any of the following on our website:

Use a mobile device or web browser to access our content

Contact us via email, social media, or on any similar technologies

When you mention us on social media

We may collect, hold, use, and disclose information for the following purposes, and personal information will not be further processed in a manner that is incompatible with these purposes:

• to provide you with our platform’s core features and services
• to contact and communicate with you

We may combine voluntarily provided and automatically collected personal information with general information or research data we receive from other trusted sources. For example, our marketing and market research activities may uncover data and insights, which we may combine with information about how visitors use our site to improve our site and your experience on it.

Security of Your Personal Information

When we collect and process personal information, and while we retain this information, we will protect it in compliance with applicable law and industry standards and within commercially reasonable and acceptable means to prevent loss and theft, as well as unauthorized access, disclosure, copying, use, or modification.

Although we will do our best to protect the personal information you provide to us, we advise that no method of electronic transmission or storage is 100% secure, and no one can guarantee absolute data security.

You are responsible for selecting any password and its overall security strength, ensuring the security of your own information within the bounds of our services. For example, ensuring you do not make your personal information publicly available via our platform.

How Long We Keep Your Personal Information

We keep your personal information only for as long as we need to. This time period may depend on what we are using your information for, in accordance with this privacy policy. For example, if you have provided us with personal information such as an email address when contacting us about a specific enquiry, we may retain this information for the duration of your enquiry remaining open as well as for our own records so we may effectively address similar enquiries in future. If your personal information is no longer required for this purpose, we will delete it or make it anonymous by removing all details that identify you.

However, if necessary, we may retain your personal information for our compliance with a legal, accounting, or reporting obligation or for archiving purposes in the public interest, scientific, or historical research purposes or statistical purposes.

Children’s Privacy

We do not aim any of our products or services directly at children under the age of 13, and we do not knowingly collect personal information about children under 13.

Disclosure of Personal Information to Third Parties

We may disclose personal information to:

• a parent, subsidiary, or affiliate of our company
• third-party service providers for the purpose of enabling them to provide their services, including (without limitation) IT service providers, data storage, hosting and server providers, analytics, error loggers, debt collectors, maintenance or problem-solving providers, professional advisors, direct marketing to you on behalf of us, and payment systems operators
• our employees, contractors, and/or related entities
• our existing or potential agents or business partners
• credit reporting agencies, courts, tribunals, and regulatory authorities, in the event you fail to pay for goods or services we have provided to you
• courts, tribunals, regulatory authorities, and law enforcement officers, as required by law, in connection with any actual or prospective legal proceedings, or in order to establish, exercise, or defend our legal rights
• an entity that buys, or to which we transfer all or substantially all of our assets and business
• Third parties we currently use include:
• Google Analytics

Your Rights and Controlling Your Personal Information

Your choice: By providing personal information to us, you understand we will collect, hold, use, and disclose your personal information in accordance with this privacy policy. You do not have to provide personal information to us, however, if you do not, it may affect your use of our website or the products and/or services offered on or through it.

Information from third parties: If we receive personal information about you from a third party, we will protect it as set out in this privacy policy. If you are a third party providing personal information about somebody else, you represent and warrant that you have such person’s consent to provide the personal information to us.

Marketing permission: If you have previously agreed to us using your personal information for direct marketing purposes, you may change your mind at any time by contacting us using the details below.

Access

You may request details of the personal information that we hold about you.

Deletion

You may also request that we delete all personal information that we hold about you. Such a deletion request will also affect your use of our website or the products and/or services offered on or through it.

Correction

If you believe that any information we hold about you is inaccurate, out of date, incomplete, irrelevant, or misleading, please contact us using the details provided in this privacy policy. We will take reasonable steps to correct any information found to be inaccurate, incomplete, misleading, or out of date.

Non-discrimination

We will not discriminate against you for exercising any of your rights over your personal information. Unless your personal information is required to provide you with a particular service or offer (for example providing user support), we will not deny you goods or services and/or charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties, or provide you with a different level or quality of goods or services.

Notification of data breaches

We will comply with laws applicable to us in respect of any data breach.

Complaints

If you believe that we have breached a relevant data protection law and wish to make a complaint, please contact us using the details below and provide us with full details of the alleged breach. We will promptly investigate your complaint and respond to you, in writing, setting out the outcome of our investigation and the steps we will take to deal with your complaint. You also have the right to contact a regulatory body or data protection authority in relation to your complaint.

Unsubscribe

To unsubscribe from our email database or opt-out of communications (including marketing communications), please contact us using the details provided in this privacy policy, or opt-out using the opt-out facilities provided in the communication. We may need to request specific information from you to help us confirm your identity.

Business Transfers

If we or our assets are acquired, or in the unlikely event that we go out of business or enter bankruptcy, we would include data, including your personal information, among the assets transferred to any parties who acquire us. You acknowledge that such transfers may occur, and that any parties who acquire us may, to the extent permitted by applicable law, continue to use your personal information according to this policy, which they will be required to assume as it is the basis for any ownership or use rights we have over such information.

Limits of Our Policy

Our website may link to external sites that are not operated by us. Please be aware that we have no control over the content and policies of those sites, and cannot accept responsibility or liability for their respective privacy practices.

Changes to This Policy

At our discretion, we may change our privacy policy to reflect updates to our business processes, current acceptable practices, or legislative or regulatory changes. If we decide to change this privacy policy, we will post the changes here at the same link by which you are accessing this privacy policy.

If required by law, we will get your permission or give you the opportunity to opt in to or opt out of, as applicable, any new uses of your personal information.

Do Not Track

We do not track users over time and across third-party websites to provide targeted advertising.  Accordingly, at this time, we do not respond to browser “Do Not Track” signals.”

We adhere to the standards outlined in this privacy policy, ensuring we collect and process personal information lawfully, fairly, transparently, and with legitimate, legal reasons for doing so.

Contact Us

For any questions or concerns regarding your privacy, you may contact us using the following details:

GI Alliance

950 E. State Highway 114, Ste 200

Southlake, TX 76092

(800) 255-0234