Privacy Policy

Privacy Policy and HIPAA Notice

Effective Date: 7th July 2026

HeartCare4life, the cardiology practice of Dr. Vimal Nanavati (Advanced Heart Care, Inc.), respects your privacy. This policy explains two related things. First, how we handle your protected health information as a HIPAA covered entity. Second, how we handle the information you give us or generate when you use this website.

By using our website, you acknowledge that you have read and understood this Privacy Policy.

We Are a HIPAA Covered Entity

HeartCare4life is a health care provider that transmits health information electronically in connection with covered transactions. That makes us a covered entity under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations, together known as HIPAA.

HIPAA requires us to keep your protected health information private. It requires us to give you notice of our legal duties and privacy practices. It requires us to follow the terms of the notice currently in effect. We take those duties seriously.

You can read the federal rules for yourself at hhs.gov/hipaa.

What Protected Health Information Means

Protected health information, often shortened to PHI, is individually identifiable health information that we create or receive. It covers your past, present, or future physical or mental health. It covers the care you receive from us. It covers payment for that care.

In practice, PHI includes your name, address, date of birth, telephone number, and email address when they are tied to your care. It includes your medical record number, insurance and account numbers, appointment history, test results, images, diagnoses, medications, and clinical notes.

Not everything on this website is PHI. Anonymous website analytics that cannot be linked to you as a patient are not PHI. Where the two overlap, we treat the information as PHI.

Website Forms Are Not a Secure Patient Portal

Please read this section before you send us anything.

The contact forms, appointment request forms, feedback forms, and general email addresses on this website are convenience tools. They are not a secure, encrypted patient portal. Ordinary email is not secure either.

Use these forms only to tell us who you are, how to reach you, and when you would like to be seen. Do not include detailed medical history. Do not include test results, imaging reports, medication lists, symptom narratives, or anything else you would consider sensitive.

If you need to send clinical information, call the office and we will tell you a secure way to do it. If your situation is urgent, call the office. If it is an emergency, call 911.

Once your information reaches us and becomes part of your record, it is protected as PHI under HIPAA. The risk sits in the transmission, not in our handling afterward.

How We Use and Disclose Health Information

We use and disclose your health information for treatment, for payment, and for our health care operations. HIPAA permits these uses without your separate written authorization.

Treatment means using your information to provide, coordinate, and manage your care. This includes sharing information with other physicians, hospitals, laboratories, imaging centers, and pharmacies involved in your care.

Payment means using your information to bill and collect for the care we provide. This includes verifying coverage, obtaining prior authorization, and submitting claims to your health plan.

Health care operations means the business activities that keep the practice running. This includes quality review, staff training, credentialing, audits, and administration.

We may also use or disclose your information where the law requires or permits it. Examples include public health reporting, court orders, and reporting suspected abuse or neglect.

For most other uses, including marketing and any sale of your information, we will ask for your written authorization first. You may revoke that authorization in writing at any time.

Your HIPAA Rights

HIPAA gives you specific rights over your health information. You have the right to:

• Access and inspect your record. You may ask to see and get a copy of the health information we hold about you. We may charge a reasonable, cost-based fee for copies.
• Request an amendment. If you believe information in your record is incorrect or incomplete, you may ask us to amend it. We may deny the request in limited circumstances, and we will explain the reason in writing if we do.
• Receive an accounting of disclosures. You may ask for a list of certain disclosures we have made of your health information. Disclosures for treatment, payment, and health care operations are generally excluded from this list.
• Request restrictions. You may ask us to limit how we use or disclose your information. We are not required to agree to every request. We must agree when you pay for a service in full out of pocket and ask us not to share that information with your health plan.
• Request confidential communications. You may ask us to contact you at a particular address or phone number.
• Receive a paper copy of the Notice of Privacy Practices. You have this right even if you agreed to receive the notice electronically.
• Be notified of a breach. We will notify you if a breach compromises the privacy or security of your health information.

To exercise any of these rights, contact the office. We may ask you to put the request in writing and to verify your identity before we act on it.

How to Get Our Notice of Privacy Practices

Our full Notice of Privacy Practices explains these rights and our duties in complete detail. It is the controlling document.

You can get a copy three ways. Ask the front desk at any of our offices. Call the office and ask us to mail one to you. Or ask us in writing at the address below.

How to File a Privacy Complaint

If you believe your privacy rights have been violated, please tell us. Contact the office and ask to speak with the person responsible for privacy at the practice. We will look into it.

You may also file a complaint directly with the federal government. Write to the U.S. Department of Health and Human Services, Office for Civil Rights. You can file online at hhs.gov/ocr/complaints.

You will not be penalized, and your care will not be affected, for filing a complaint with us or with the Office for Civil Rights.

Information We Collect Through This Website

We may collect personal information that you voluntarily provide, including:

• Name
• Email address
• Telephone number
• Mailing address
• Information submitted through contact forms, appointment requests, or other online forms
• Employment information submitted through career applications
• Any other information you choose to provide

We may also automatically collect certain information when you visit our website, including:

• IP address
• Browser type and version
• Device information
• Operating system
• Pages visited
• Time spent on our website
• Referring website
• Search terms and website interactions
• Cookie identifiers and similar technologies

How We Use Website Information

We may use this information to:

• Respond to your inquiries and requests
• Schedule appointments or process appointment requests
• Provide the health information or services you request
• Improve our website, services, and user experience
• Maintain the security and functionality of our website
• Detect, investigate, and prevent fraud or unauthorized activity
• Communicate with you regarding requested services or information
• Comply with applicable legal, regulatory, and contractual obligations

Cookies and Similar Technologies

Our website uses cookies and similar technologies to provide essential website functionality, remember your preferences, analyze website usage, improve performance, and enhance your browsing experience.

Where required by applicable law, non-essential cookies and similar technologies are activated only after you provide your consent through our cookie consent platform. You may manage your cookie preferences at any time through our Cookie Settings.

Analytics and Third-Party Services

We use trusted third-party service providers to operate, maintain, secure, and improve our website. These providers may include website hosting providers, analytics providers, accessibility providers, appointment scheduling services, embedded media providers, spam protection services, customer communication providers, and other technology partners.

These providers may collect technical information necessary to perform their services, including browser information, device information, IP address, and website interactions. We require these providers to use your information only as necessary to perform services on our behalf and in accordance with applicable privacy laws.

Where a vendor handles protected health information on our behalf, we require a business associate agreement as HIPAA provides.

Google Analytics

We use Google Analytics to understand how visitors interact with our website and to improve our online services. Google Analytics may collect information such as pages visited, time spent on pages, browser information, device information, and IP address, which may be anonymized where supported.

Where required by applicable law, Google Analytics is enabled only after you provide your consent through our cookie consent platform.

Google reCAPTCHA

To help protect our website from spam and automated abuse, we use Google reCAPTCHA. reCAPTCHA may collect hardware and software information, device information, and user interactions to determine whether a visitor is a human. This information is collected solely for security purposes.

Do Not Track and Global Privacy Control

Our website recognizes and responds to Global Privacy Control signals where required by applicable law. We also honor applicable browser-based privacy signals that we are legally required to recognize. You may also manage your cookie preferences through our Cookie Settings.

Disclosure of Website Information

We may disclose website information to trusted service providers that assist us in operating our business and website, including providers of:

• Website hosting
• Website analytics
• Security and fraud prevention
• Appointment scheduling
• Email communications
• Technical support
• Accessibility services
• Other website-related services

These service providers are authorized to use your information only as necessary to perform services on our behalf.

We may also disclose information if required by law, court order, or governmental request, or when necessary to protect our rights, patients, employees, or property.

Sale or Sharing of Personal Information

We do not sell your personal information.

We do not share your personal information with third parties for their own direct marketing purposes. Where applicable privacy laws provide additional rights regarding the sale or sharing of personal information, we will honor those rights in accordance with applicable law.

Your California Privacy Rights

Separate from your HIPAA rights, and depending on your jurisdiction, you may have the right to:

• Request access to the personal information we maintain about you
• Request correction of inaccurate personal information
• Request deletion of personal information, subject to applicable legal exceptions
• Request a copy of your personal information in a portable format, where applicable
• Withdraw consent where processing is based on consent
• Exercise any additional rights available under applicable privacy laws

Medical information held by a HIPAA covered entity is generally exempt from the California Consumer Privacy Act. Your HIPAA rights, described above, govern that information instead. To exercise any right, contact us using the information below. We may verify your identity before processing your request.

Data Retention

We retain personal information only for as long as reasonably necessary to fulfill the purposes described in this policy, comply with legal obligations, resolve disputes, and maintain appropriate business records. Medical records are retained for the periods required by California and federal law.

Data Security

We implement reasonable administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, or destruction. However, no method of transmitting or storing information over the Internet is completely secure, and we cannot guarantee absolute security.

Children's Privacy

Our website is not intended for children under the age of 13, and we do not knowingly collect personal information from children through our website. Health information about minor patients is handled under HIPAA and California law, and is generally accessible to a parent or legal guardian.

SMS Communications

If you provide your mobile phone number and opt in to receive SMS communications, you agree to receive text messages from HeartCare4life regarding appointments, services, or other requested communications. Message frequency may vary. Standard message and data rates may apply.

Text messages are not secure. We limit them to appointment reminders and similar administrative messages. Do not send clinical information by text.

You may opt out at any time by following the instructions in the message or by contacting us directly. We do not sell or share mobile phone numbers with third parties or affiliates for their own marketing or promotional purposes.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with a revised Effective Date. We reserve the right to make changes to our Notice of Privacy Practices effective for all health information we maintain, and the current notice will always be available at our offices.

Contact Us

If you have questions about this policy, wish to exercise a privacy right, or want to request our Notice of Privacy Practices, please contact us.

South San Diego (Bonita) 180 Otay Lakes Rd, Ste 110 Bonita, CA 91902 Phone: (619) 585-0476

North San Diego 5190 Governor Dr San Diego, CA 92122

Northern California (Redding) 2510 Airpark Drive, Ste 205 Redding, CA 96001 Phone: (530) 433-5427

Office hours are Monday through Thursday, 9:00 am to 5:00 pm, and Friday, 9:00 am to 12:00 pm. Selected Saturdays are available in Redding by appointment.

A printed copy of our full Notice of Privacy Practices is available at any of our offices on request, at no charge.