Privacy Policy & HIPAA Notice of Privacy Practices

District Physical Therapy, PLLC ("DCPT," "we," "our," or "us") respects your privacy. This page combines two related notices:

1. Website Privacy Policy — how we handle information collected through districtphysicaltherapy.com.
2. HIPAA Notice of Privacy Practices (NPP) — how we may use and disclose your protected health information ("PHI") when you receive treatment from us, and your rights regarding that information.

If you have questions about either notice, contact our Privacy Officer at frontdesk@districtphysicaltherapy.com or (202) 964-0323.

Part 1 — Website Privacy Policy

Information we collect

We collect only the information needed to respond to you and run the site:

• Information you provide. Name, email, phone, and any details you include when you submit our contact or appointment request forms, or when you email or call us.
• Automatically collected. IP address, browser type, device type, pages viewed, referring URL, and timestamps. This is standard server log data.
• Cookies and analytics. We use cookies and similar technologies to remember preferences and measure traffic. You can disable cookies in your browser; the site will still work.

We do not knowingly collect PHI through this website. Please don't include diagnoses, conditions, or other sensitive health details in our contact form. If you need to share clinical information, call the clinic or wait until your visit.

How we use information

• To respond to inquiries and schedule appointments.
• To operate, maintain, and improve the website.
• To send appointment confirmations, reminders, or follow-up communications you've requested.
• To comply with our legal obligations and protect against fraud or abuse.

How we share information

We do not sell your personal information. We share it only with:

• Service providers who help us run the site and the practice (hosting, email, analytics, EHR, payment processing). These vendors are contractually required to protect your information and, where applicable, sign Business Associate Agreements (BAAs) covering PHI.
• Legal and safety reasons — when required by law, subpoena, or to protect rights, property, or safety.

Third-party services

Pages may include links or embedded tools from third parties (e.g., Google Maps for clinic locations). Their privacy practices are governed by their own policies. We're not responsible for content or practices on third-party sites.

Data security

We use industry-standard administrative, physical, and technical safeguards to protect the information we collect. No method of transmission over the internet is 100% secure, but we work to keep your data safe and limit access to authorized personnel only.

Data retention

We keep website-collected information for as long as needed to respond to you, provide ongoing care, and meet legal and accounting requirements. Treatment records are retained per applicable state law.

Your choices

• Email opt-out. You can unsubscribe from any marketing email by using the link in the footer of the email or by emailing us.
• Cookies. You can disable cookies in your browser settings.
• Access and corrections. Contact us to ask what information we have or to correct inaccuracies.

Children's privacy

Our website is not directed to children under 13, and we do not knowingly collect their information online. Pediatric patients are seen only with a parent or guardian present, and intake forms are completed by a parent or guardian.

Changes to this policy

We may update this policy from time to time. The "Effective" date at the top of this page reflects the most recent revision. Material changes will be highlighted on this page.

Part 2 — HIPAA Notice of Privacy Practices

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

Our pledge regarding your health information

DCPT understands that health information about you and your health care is personal. We are committed to protecting it. We are required by law to:

• Maintain the privacy and security of your PHI.
• Provide you with this notice of our legal duties and privacy practices.
• Follow the terms of the notice currently in effect.
• Notify you if a breach occurs that may have compromised the privacy or security of your information.

How we may use and disclose your PHI

The following describes the ways we may use and disclose PHI without your written authorization:

• Treatment. To provide, coordinate, or manage your care — including sharing information with referring physicians, surgeons, or other providers involved in your care.
• Payment. To bill and collect payment from you, your insurance plan, or a third party — including verifying benefits, obtaining prior authorization, and submitting claims.
• Health care operations. For internal activities necessary to run the practice, such as quality improvement, outcomes measurement (e.g., FOTO surveys), staff training, credentialing, and audits.
• Appointment reminders. To remind you of upcoming visits via phone, text, or email.
• Treatment alternatives & health-related benefits. To tell you about treatment options or services that may interest you.
• Required by law. When federal, state, or local law requires disclosure (e.g., reporting to public health authorities, responding to court orders, reporting suspected abuse).
• Public health and safety. To prevent or control disease, report adverse events to the FDA, or address serious threats to health or safety.
• Workers' compensation. When a claim is being processed.
• Business associates. With vendors who perform services for us (billing, EHR, IT, outcomes tracking, payment processing). All business associates sign agreements requiring them to protect your PHI.

Uses and disclosures that require your authorization

The following uses and disclosures will be made only with your written authorization:

• Most uses and disclosures of psychotherapy notes.
• Marketing communications.
• Sale of your PHI.
• Any other use or disclosure not described in this notice or required by law.

You may revoke a written authorization at any time, in writing, except to the extent we have already acted in reliance on it.

Your rights regarding your PHI

• Right to inspect and copy. You may request access to your medical and billing records. We will respond within 30 days. A reasonable, cost-based fee may apply for copies.
• Right to amend. You may request a correction to records you believe are inaccurate or incomplete. We may deny certain requests in writing with an explanation.
• Right to an accounting of disclosures. You may request a list of certain disclosures we made of your PHI in the six years prior to your request.
• Right to request restrictions. You may ask us to limit how we use or disclose your PHI for treatment, payment, or operations. We are not required to agree, except for disclosures to a health plan for services you paid for in full out of pocket.
• Right to confidential communications. You may request that we contact you at a specific phone number or address.
• Right to a paper copy of this notice. You may request a paper copy at any time, even if you've agreed to receive it electronically.
• Right to be notified of a breach involving your unsecured PHI.

Changes to this notice

We reserve the right to change this notice and to make the revised notice effective for PHI we already have about you, as well as any information we receive in the future. The current notice is posted in our clinics and on this website with the effective date listed at the top.

Complaints

If you believe your privacy rights have been violated, you may file a complaint with us or with the U.S. Department of Health and Human Services, Office for Civil Rights. We will not retaliate against you for filing a complaint.

• Privacy Officer, DCPT: frontdesk@districtphysicaltherapy.com · (202) 964-0323
• HHS Office for Civil Rights: hhs.gov/ocr/privacy/hipaa/complaints