Notice of Privacy Practices & Website Privacy Policy

Effective Date: May 16, 2026
Last Reviewed: May 16, 2026

This document is the combined Notice of Privacy Practices (“NPP”) required by the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations at 45 C.F.R. Parts 160 and 164 (“HIPAA”), as amended by the Health Information Technology for Economic and Clinical Health Act (“HITECH”) and the HIPAA Omnibus Rule, together with the Website Privacy Policy applicable to visitors of brightlifept.com (the “Website”). For brevity, “we,” “us,” “our,” “BrightLife,” and the “Practice” each refer to ZARAS Wellness LLC, a Georgia limited liability company doing business as BrightLife PT & Wellness. “You” and “your” refer to any patient of the Practice or visitor to the Website.

Table of Contents

1. Scope and Applicability
2. Definitions
3. Our Pledge Regarding Protected Health Information
4. How We May Use and Disclose Your Protected Health Information
5. Uses and Disclosures Requiring Your Written Authorization
6. Your Rights With Respect to Your PHI
7. Our Duties as a Covered Entity
8. Website Privacy Practices
9. Cookies, Analytics, and Advertising Technologies
10. Third-Party Services and Links
11. Children's Privacy
12. Georgia and Other State-Specific Disclosures
13. California, Virginia, and Other State Consumer Privacy Rights
14. Data Retention
15. Security Safeguards
16. Breach Notification
17. Changes to This Notice
18. Complaints
19. Contact Information

1. Scope and Applicability

The Practice is a “covered entity” under HIPAA because it furnishes physical therapy and related wellness services and transmits health information electronically in connection with transactions for which the U.S. Department of Health and Human Services (“HHS”) has adopted standards. This Notice applies to all protected health information (“PHI”) created or maintained by the Practice, regardless of the medium in which it is stored or transmitted, including paper records, electronic health records, and oral communications.

Sections 8 through 13 additionally describe how we collect, use, and share information from visitors to the Website who are not patients of the Practice. Where a website visitor is also a patient and submits or transmits information that is or becomes PHI, the more protective provisions of HIPAA and the NPP sections of this document control.

2. Definitions

For purposes of this Notice, the following terms have the meanings set forth below. Capitalized terms not otherwise defined herein have the meanings given in 45 C.F.R. § 160.103.

• “Authorization” means a written permission that satisfies the requirements of 45 C.F.R. § 164.508.
• “Business Associate” means a person or entity that performs functions or activities on behalf of, or provides services to, the Practice that involve the use or disclosure of PHI, as defined in 45 C.F.R. § 160.103.
• “Breach” means the acquisition, access, use, or disclosure of PHI in a manner not permitted by the Privacy Rule that compromises the security or privacy of the PHI, as defined in 45 C.F.R. § 164.402.
• “Designated Record Set” means the group of records described in 45 C.F.R. § 164.501 that we maintain to make decisions about you, including your medical and billing records.
• “Personal Information” means information that identifies, relates to, describes, or is reasonably capable of being associated with you, collected through the Website outside of the treatment relationship.
• “Protected Health Information” or “PHI” means individually identifiable health information transmitted or maintained by the Practice in any form or medium, as defined in 45 C.F.R. § 160.103, excluding information specifically excepted from that definition.
• “Treatment, Payment, and Health Care Operations” or “TPO” has the meaning set forth in 45 C.F.R. § 164.501.

3. Our Pledge Regarding Protected Health Information

The Practice understands that information about you and your health is personal. We are committed to protecting that information. We create a record of the care and services you receive in order to provide quality care and to comply with legal requirements. This Notice applies to all records of your care generated by the Practice, whether made by Practice personnel or by your personal physician or other healthcare provider acting through the Practice.

We are required by law to:

• (a) maintain the privacy and security of your PHI;
• (b) provide you with this Notice of our legal duties and privacy practices regarding your PHI;
• (c) notify you following a Breach of unsecured PHI in accordance with 45 C.F.R. §§ 164.400–164.414; and
• (d) abide by the terms of this Notice currently in effect.

4. How We May Use and Disclose Your Protected Health Information

The following categories describe the ways we are permitted to use and disclose your PHI without your written Authorization. Not every permitted use or disclosure within a category is listed; however, every permissible use or disclosure will fall within one of the categories described below.

4.1 For Treatment

We may use and disclose your PHI to provide, coordinate, or manage your physical therapy care and any related services. For example, we may share your treatment plan with a referring physician, an orthopedist, a primary care provider, a home-health agency, or another therapist who is or will be involved in your care. We may also disclose PHI to durable medical equipment providers when ordering braces, orthotics, or similar items.

4.2 For Payment

We may use and disclose your PHI so that the treatment and services you receive may be billed to and payment may be collected from you, an insurance company, Medicare, Medicaid, or another third party. For example, we may share information with your health plan to obtain prior authorization for services, to confirm coverage, to submit claims, or to appeal a denied claim. If you pay in full out-of-pocket for an item or service and request in writing that we not disclose PHI relating solely to that item or service to your health plan for payment or health care operations purposes, we will comply with that request to the extent required by 45 C.F.R. § 164.522(a)(1)(vi).

4.3 For Health Care Operations

We may use and disclose your PHI for health care operations, which include quality assessment and improvement activities, credentialing, licensing, audits, legal services, business planning, and customer service. For example, we may use your PHI to evaluate the performance of our staff, to train students or interns, or to assess patient satisfaction.

4.4 Business Associates

We contract with third parties to perform certain services on our behalf, including electronic health record hosting, billing, scheduling, secure messaging, and online appointment booking. These vendors are “Business Associates” and are required by HIPAA and by written agreement to safeguard your PHI. For example, our online appointment booking is provided through BetterAccess, the patient-scheduling service of BetterPT, Inc. (doing business as BetterHealthcare), which connects to our practice-management and records platform, WebPT.

4.5 Appointment Reminders, Treatment Alternatives, and Health-Related Benefits

We may use and disclose your PHI to contact you with appointment reminders, to inform you of treatment alternatives, or to describe health-related products and services that may be of interest to you. Such communications may be delivered by telephone, text message, email, or U.S. mail to the contact information you have provided. You may opt out of any non-required communication at any time by notifying the Privacy Officer in writing.

4.6 Individuals Involved in Your Care or Payment for Your Care

Unless you object, we may disclose to a family member, other relative, close personal friend, or any other person you identify, PHI directly relevant to that person’s involvement in your care or payment for your care. We may also disclose PHI to notify or assist in notifying a family member, personal representative, or another person responsible for your care of your location, general condition, or death.

4.7 As Required by Law

We will disclose PHI when required to do so by federal, state, or local law, including disclosures required by the Secretary of HHS to investigate or determine our compliance with HIPAA.

4.8 Public Health Activities

We may disclose PHI for public health activities, including (i) to a public health authority for purposes of preventing or controlling disease, injury, or disability; (ii) to report births, deaths, and reactions to medications or product problems; (iii) to notify a person of a recall of a product they may be using; or (iv) to notify a person of exposure to a communicable disease.

4.9 Victims of Abuse, Neglect, or Domestic Violence

If we reasonably believe you to be a victim of abuse, neglect, or domestic violence, we may disclose your PHI to a government authority authorized by law to receive such reports, including pursuant to the mandatory reporting provisions of O.C.G.A. § 19-7-5 (suspected child abuse) and O.C.G.A. § 30-5-4 (suspected exploitation, neglect, or abuse of disabled adults or elder persons).

4.10 Health Oversight Activities

We may disclose PHI to a health oversight agency for activities authorized by law, such as audits, investigations, inspections, licensure, and disciplinary actions.

4.11 Judicial and Administrative Proceedings

We may disclose PHI in response to a court order, subpoena, discovery request, or other lawful process, provided the applicable requirements of 45 C.F.R. § 164.512(e) are satisfied.

4.12 Law Enforcement

We may disclose PHI for law-enforcement purposes as permitted by 45 C.F.R. § 164.512(f), including in response to a court order, warrant, grand jury subpoena, or administrative request; to identify or locate a suspect, fugitive, material witness, or missing person; to provide information about a victim of a crime under certain conditions; or to alert law enforcement of a death that may have resulted from criminal conduct.

4.13 Decedents

We may disclose PHI to a coroner, medical examiner, or funeral director as necessary to carry out their duties.

4.14 Organ and Tissue Donation

We may disclose PHI to organizations that handle organ procurement or transplantation, or to an organ-donation bank, to facilitate organ or tissue donation and transplantation.

4.15 Research

We may use or disclose PHI for research purposes when an Institutional Review Board or Privacy Board has approved a waiver of Authorization in accordance with 45 C.F.R. § 164.512(i), or under other limited circumstances permitted by law.

4.16 To Avert a Serious Threat to Health or Safety

We may use or disclose PHI when necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public, consistent with applicable law and ethical standards.

4.17 Specialized Government Functions

We may disclose PHI of members of the armed forces as required by military command authorities, to authorized federal officials for national security and intelligence activities, or for the protective services of the President.

4.18 Workers’ Compensation

We may disclose PHI as authorized by, and to the extent necessary to comply with, Georgia workers’ compensation laws codified at O.C.G.A. Title 34, Chapter 9, and analogous programs that provide benefits for work-related injuries or illness without regard to fault.

4.19 Inmates

If you are an inmate of a correctional institution or under the custody of a law-enforcement official, we may disclose PHI to the correctional institution or law-enforcement official as permitted by 45 C.F.R. § 164.512(k)(5).

5. Uses and Disclosures Requiring Your Written Authorization

Other uses and disclosures of PHI not described in Section 4 will be made only with your written Authorization. In particular, the following categories of uses and disclosures require your prior written Authorization:

• (a) Marketing Communications. Except for face-to-face communications, communications involving a promotional gift of nominal value, and certain refill reminders, we will not use or disclose your PHI for marketing purposes without your Authorization.
• (b) Sale of PHI. We will not sell your PHI without your Authorization. The Practice does not sell, rent, or trade PHI for monetary or other valuable consideration.
• (c) Psychotherapy Notes. Although the Practice does not ordinarily create psychotherapy notes, any such notes would be disclosed only with your Authorization, except as expressly permitted by 45 C.F.R. § 164.508(a)(2).

You may revoke an Authorization at any time, in writing, except to the extent that we have already taken action in reliance on it. Revocation may be delivered to the Privacy Officer at the address set forth in Section 19.

6. Your Rights With Respect to Your Protected Health Information

You have the following rights regarding the PHI we maintain about you. To exercise any of these rights, please submit a written request to the Privacy Officer at the address in Section 19. Forms are available on request.

6.1 Right to Inspect and Copy

You have the right to inspect and obtain a copy of the PHI in your Designated Record Set, in the form and format you request if readily producible, including in an electronic format if we maintain the records electronically. We will respond within thirty (30) days of your request, or notify you of a single thirty-day extension. We may charge a reasonable, cost-based fee as permitted by 45 C.F.R. § 164.524(c)(4) and O.C.G.A. § 31-33-3. We may deny your request in limited circumstances; if denied, you may request a review of our decision.

6.2 Right to Amend

If you believe that PHI we maintain about you is incorrect or incomplete, you may request that we amend it. We may deny your request if the information was not created by us, is not part of the Designated Record Set, would not be available for inspection, or is accurate and complete. If we deny your request, you may submit a written statement of disagreement, which we will include with any future disclosures of the disputed information.

6.3 Right to an Accounting of Disclosures

You have the right to request an accounting of certain disclosures of your PHI made by us during the six (6) years preceding your request, other than disclosures made for TPO, disclosures made to you, disclosures pursuant to an Authorization, and other disclosures excepted by 45 C.F.R. § 164.528(a)(1). The first accounting in any 12-month period is provided without charge; for additional requests, we may charge a reasonable, cost-based fee.

6.4 Right to Request Restrictions

You have the right to request a restriction on certain uses and disclosures of your PHI for TPO or to persons involved in your care. We are not required to agree to your request, except that we must agree to a restriction on disclosure to a health plan for payment or health-care-operations purposes when the PHI pertains solely to a health care item or service for which you, or someone other than the health plan on your behalf, has paid in full.

6.5 Right to Request Confidential Communications

You have the right to request that we communicate with you about medical matters in a certain way or at a certain location. We will accommodate all reasonable requests; we will not require you to provide a reason for your request.

6.6 Right to a Paper Copy of This Notice

You have the right to a paper copy of this Notice at any time, even if you have agreed to receive it electronically. You may request a paper copy from the receptionist at any visit, by telephone at 678-292-6150, or by writing to the Privacy Officer.

6.7 Right to Be Notified of a Breach

You have the right to be notified following a Breach of your unsecured PHI in accordance with the Breach Notification Rule at 45 C.F.R. §§ 164.400–164.414. See Section 16.

6.8 Right to Choose Someone to Act for You

If you have given someone medical power of attorney, or if someone is your legal guardian, that person may exercise your rights and make choices about your PHI. We will verify that the person has this authority before taking any action.

6.9 Right to Complain

You may complain to us or to the Secretary of HHS if you believe your privacy rights have been violated. See Section 18. We will not retaliate against you for filing a complaint.

7. Our Duties as a Covered Entity

We are required by law to maintain the privacy of your PHI, provide you with this Notice of our legal duties and privacy practices, follow the terms of the Notice currently in effect, and notify you in the event of a Breach of your unsecured PHI. We reserve the right to change the terms of this Notice and to make the new provisions effective for all PHI we maintain. Any revised Notice will be posted at the reception desk of the Practice and on the Website, and a copy will be available upon request.

8. Website Privacy Practices

The Website is an informational and appointment-scheduling resource. Consistent with the Practice’s HIPAA obligations and to minimize the risk of inadvertent disclosure of PHI, the Website does not provide any custom contact form, symptom checker, intake form, or other mechanism for transmitting health information to the Practice through the brightlifept.com domain. Patients wishing to communicate health information are directed to: (i) telephone the Practice at 678-292-6150; (ii) request an appointment through our online-booking service, BetterAccess (operated by BetterPT, Inc., d/b/a BetterHealthcare), which connects to our WebPT records system; or (iii) visit the Practice in person.

8.1 Information Collected Automatically

When you visit the Website, our hosting provider and analytics tools automatically receive certain information from your browser or device, including:

• Internet Protocol (IP) address (in truncated form where supported by Google Analytics IP-anonymization);
• browser type and version, operating system, device type, and screen size;
• the referring URL and the pages or resources accessed during your visit;
• date and time of access and approximate geographic location derived from IP address; and
• diagnostic information necessary to deliver and secure the Website.

This information is collected for the purposes set forth in Section 9.

8.2 Information You Voluntarily Provide

The Website does not request or accept the submission of names, email addresses, telephone numbers, dates of birth, medical history, symptoms, insurance information, or any other Personal Information through any form, field, or chat interface hosted on brightlifept.com. If you choose to send us an email to an address listed on the Website or to call a phone number listed on the Website, you do so outside the Website itself, and the information you provide in that communication will be governed by the HIPAA-related provisions of this Notice (where the information constitutes PHI) and applicable telecommunications-carrier and email-provider policies.

8.3 Online Booking via BetterAccess

If you click a “Book Appointment” or similar link, you will be directed — in a new browser tab — to an external scheduling page operated by BetterPT, Inc. (doing business as “BetterHealthcare”), whose “BetterAccess” service provides online scheduling for our practice-management and records platform, WebPT. The information you submit there — such as your name, contact details, and requested appointment time — is used to schedule your visit in our WebPT system and is treated as PHI by the Practice upon receipt. Your use of that scheduling page is also governed by the privacy policies and terms of BetterHealthcare and WebPT, which we encourage you to review.

9. Cookies, Analytics, and Advertising Technologies

The Website uses cookies, pixels, tags, and similar technologies (collectively, “Tracking Technologies”) to operate the site, measure usage, and support our online advertising. These technologies are configured to avoid transmitting PHI to third parties, in accordance with the HHS Office for Civil Rights’ Bulletin on Use of Online Tracking Technologies (as updated).

9.1 Strictly Necessary Cookies

Certain cookies are required for the Website to function (for example, to enable navigation and to support security features). These cookies do not require your consent and cannot be disabled through the Website.

9.2 Analytics

We use Google Analytics 4 (property G-VS1CT2YPS2) and Google Tag Manager (container GTM-TN226TZN), both operated by Google LLC, to collect aggregated information about how visitors use the Website, such as the pages most frequently viewed and the average duration of visits. IP-address collection is configured to anonymize the final octet where supported. We do not transmit PHI to Google through these tools, and we have configured the implementation to avoid collecting URL parameters, page titles, or form-field contents that could reveal an individual’s health condition.

You may opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on, available at tools.google.com/dlpage/gaoptout.

9.3 Conversion Tracking and Advertising

We use Google Ads conversion tracking (account AW-17913775056) to measure the effectiveness of our online advertising. When you take a measurable action on the Website — for example, clicking the click-to-call link or clicking a link to book an appointment online — Google Ads may record that the action occurred and attribute it to a prior ad click. We do not transmit your name, telephone number, email address, or any health-related information to Google as part of this tracking. We do not use remarketing audiences built from visitors to pages that suggest a specific medical condition.

Where dynamic-number insertion is used to substitute a tracking telephone number on the Website, the displayed number always corresponds to a number controlled by the Practice and forwards to our main line at 678-292-6150.

9.4 Third-Party Embeds

The Website embeds a Google Reviews widget powered by EmbedSocial (operated by EmbedSocial Ltd.). The widget may set cookies and collect usage information consistent with EmbedSocial’s privacy policy. The widget displays publicly available Google Business Profile reviews and does not collect PHI.

9.5 Your Choices

You may configure your browser to refuse cookies, to delete cookies after each session, or to alert you when a cookie is being set. Restricting cookies may impair the functionality of the Website. We honor the Global Privacy Control (“GPC”) signal where required by applicable law as a valid request to opt out of the “sale” or “sharing” of Personal Information (see Section 13). The Website does not respond to “Do Not Track” browser signals because no uniform standard for such signals has been adopted.

10. Third-Party Services and Links

The Website may link to third-party websites, including our Google Business Profile, the BetterAccess online-scheduling portal, social-media pages, insurance carriers, and educational resources. We are not responsible for the privacy practices or content of any third-party site. We encourage you to review the privacy policy of any third-party site you visit.

11. Children’s Privacy

The Website is directed to a general adult audience and is not intended for children under the age of thirteen (13). We do not knowingly collect Personal Information from children under thirteen through the Website. If we become aware that a child under thirteen has provided Personal Information through the Website, we will delete that information promptly. The Practice may treat minor patients in person and will, in all such cases, comply with HIPAA, the Georgia Mental Health Code, and other applicable state laws regarding minors’ health information.

12. Georgia and Other State-Specific Disclosures

Where Georgia law affords privacy protections more stringent than HIPAA, we comply with Georgia law. The following categories of records receive heightened protection under Georgia law and will be disclosed only as expressly permitted by the applicable statute, even if HIPAA would otherwise permit disclosure:

• Mental-health records are governed by O.C.G.A. §§ 37-3-166, 37-4-125, and 37-7-166;
• AIDS-confidential information is governed by O.C.G.A. § 24-12-21;
• Drug- and alcohol-abuse treatment records subject to 42 C.F.R. Part 2 will be disclosed only with patient consent or as otherwise permitted by that regulation;
• Genetic information is treated in accordance with the Genetic Information Nondiscrimination Act, 42 U.S.C. § 2000ff et seq., and O.C.G.A. § 33-54-1 et seq.; and
• Records of minors are governed by O.C.G.A. §§ 31-9-2 and 37-3-4 to the extent applicable.

In addition, we comply with mandatory reporting obligations under Georgia law, including the reporting of suspected child abuse (O.C.G.A. § 19-7-5) and the reporting of suspected abuse, neglect, or exploitation of disabled adults and elder persons (O.C.G.A. § 30-5-4).

13. California, Virginia, and Other State Consumer Privacy Rights

PHI maintained by a HIPAA-covered entity is generally exempt from state consumer-privacy statutes, including the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (“CCPA/CPRA”), the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Connecticut Data Privacy Act, and the Utah Consumer Privacy Act. To the extent that any Personal Information we collect about you through the Website is not PHI and is subject to such a statute, you may have the following rights, which we honor regardless of your state of residence:

• the right to know what categories of Personal Information we have collected, the sources from which it was collected, the business purposes for collection, and the categories of third parties with whom it has been shared;
• the right to request deletion of your Personal Information, subject to applicable exceptions;
• the right to correct inaccurate Personal Information;
• the right to opt out of the “sale” or “sharing” of your Personal Information (the Practice does not sell or share Personal Information for cross-context behavioral advertising as those terms are defined in the CCPA/CPRA);
• the right to limit use of “sensitive personal information” (the Practice does not use or disclose sensitive personal information for purposes beyond those permitted by Cal. Civ. Code § 1798.121(d)); and
• the right not to receive discriminatory treatment for exercising any of the foregoing rights.

To exercise these rights, contact the Privacy Officer at the address in Section 19. We will verify your identity using the contact information we have on file before responding to a request.

14. Data Retention

We retain PHI for the period required by Georgia law and applicable federal law, and in no event for less than:

• Adult patient records — eleven (11) years from the date of last contact, consistent with O.C.G.A. § 31-33-2(a)(1)(B) and the Georgia statute of repose for medical malpractice (O.C.G.A. § 9-3-71(b));
• Minor patient records — until the patient’s twenty-eighth (28th) birthday or eleven (11) years from the date of last contact, whichever is longer; and
• Billing records and claims — at least seven (7) years from the date of the transaction, consistent with Medicare and commercial-payer recordkeeping requirements.

Personal Information collected through the Website is retained for the period reasonably necessary to fulfill the purpose for which it was collected, after which it is deleted or de-identified. Aggregated, de-identified analytics data may be retained indefinitely.

15. Security Safeguards

The Practice maintains administrative, physical, and technical safeguards designed to protect the confidentiality, integrity, and availability of electronic PHI in accordance with the HIPAA Security Rule, 45 C.F.R. Part 164, Subpart C. These safeguards include workforce training, access controls based on the minimum-necessary standard, encryption of electronic PHI in transit and at rest where appropriate, audit logging, contingency planning, periodic risk analysis, and Business Associate Agreements with all vendors that handle PHI.

The Website is served over HTTPS using current Transport Layer Security (“TLS”) cryptographic protocols. The Practice cannot, however, guarantee that any transmission over the Internet or method of electronic storage is one hundred percent (100%) secure.

16. Breach Notification

If we discover a Breach of your unsecured PHI, we will notify you without unreasonable delay and in no case later than sixty (60) days following discovery, in accordance with 45 C.F.R. § 164.404. The notification will include, to the extent known: a brief description of what happened; the types of PHI involved; steps you should take to protect yourself from potential harm; a brief description of what the Practice is doing to investigate, mitigate harm, and prevent further breaches; and contact information for additional questions. Where required by 45 C.F.R. § 164.406, we will also notify prominent media outlets serving Georgia, and we will report Breaches affecting fewer than 500 individuals to the Secretary of HHS on an annual basis as required by 45 C.F.R. § 164.408.

17. Changes to This Notice

We reserve the right to change this Notice at any time and to make the revised Notice effective for all PHI we maintain, including PHI created or received before the effective date of the revision. The current Notice will be posted prominently in our reception area and on the Website with a revised “Effective Date.” You may obtain a copy of the current Notice at any time by request to the Privacy Officer.

18. Complaints

If you believe your privacy rights have been violated, you may file a complaint with the Practice by contacting the Privacy Officer (see Section 19) or with the Secretary of the U.S. Department of Health and Human Services by writing to:

We will not retaliate against you for filing a complaint, and your decision to file a complaint will not affect the care you receive from the Practice.

19. Contact Information

For questions about this Notice, to exercise any of the rights described above, or to request a paper copy of this Notice, please contact:

Acknowledgment of Receipt

New patients receive a paper copy of this Notice at their first visit and are asked to sign a written acknowledgment of receipt, as required by 45 C.F.R. § 164.520(c)(2)(ii). If you would like a paper copy in advance, contact the Privacy Officer using the information above.

Effective Date: May 16, 2026 · Last Reviewed: May 16, 2026

See also: Notice of Privacy Practices (standalone).