Legal
How Brazelia MedSpa & Integrative Wellness collects, uses, protects and shares information about you — both on this website and in our Boca Raton practice.
Brazelia MedSpa & Integrative Wellness (“Brazelia,” “we,” “us,” or “our”) is a physician-led integrative medical and aesthetic practice located at 101 Plaza Real South, Suite G, Boca Raton, Florida 33432. Our Medical Director is Herbert R. Slavin, M.D.
This Privacy Policy applies to brazeliamedspa.com and to the information we collect through it, including our contact form, online booking, live chat and newsletter sign-up. It also describes, in the Notice of Privacy Practices at the end of this page, how we handle the medical information we create and maintain when we care for you.
By using this website you agree to this Privacy Policy and to our Terms and Conditions. If you do not agree, please do not use the site.
This is the most important distinction in this policy, so we state it first.
Website and marketing information — what you type into our contact form, the pages you visit, your IP address, the messages you send us before you become a patient — is governed by this Privacy Policy.
Protected Health Information (PHI) — your medical record, treatment notes, lab results, prescriptions, photographs taken for clinical purposes, and billing records created in the course of your care — is governed by the Notice of Privacy Practices below, by the federal Health Insurance Portability and Accountability Act (HIPAA), and by Florida law, including Florida Statutes section 456.057.
If this Privacy Policy ever conflicts with HIPAA, Florida law, or our Notice of Privacy Practices with respect to your health information, the Notice of Privacy Practices and the applicable law control. Nothing in this Privacy Policy reduces the protections the law gives your medical record.
We maintain your health information in accordance with HIPAA and Florida law. Florida Statutes section 456.057 independently protects the records of every Florida-licensed practitioner regardless of how care is paid for, so your medical record is confidential whether or not any given service is billed to insurance.
Information you send us before you are a patient is not yet part of a medical record. A message sent through our website contact form, our live chat, or ordinary email is a business communication. Please do not use those channels to send medical history, symptoms, photographs of a medical concern, medication lists, or any detail you would not want read by someone other than your provider. See section 8.
Some of what you may choose to tell us — for example, that you are interested in hormone therapy, weight-loss treatment, or sexual wellness services — can reveal something about your health. Information of that kind is treated as sensitive. We ask you to share only what is necessary to schedule a consultation, and to save the detail for your appointment.
We do not ask for, and you should never send us through this website: your Social Security number, your driver license or passport number, your insurance member number, or your credit or debit card number. We do not process payments on this website.
We do not buy personal information from data brokers.
We use a small number of cookies and similar technologies to keep the site working, to keep it secure, and to understand in aggregate how it is used. Our full Cookie Policy lists each one, what it does and how long it lasts, and explains how to control them.
Two commitments are worth stating here as well:
We do not use automated decision-making or profiling to make decisions that produce legal or similarly significant effects about you.
We share information only as described here.
We do not sell your personal information. We do not sell or rent your mobile telephone number or your text-message consent to anyone, and we do not share them with third parties or affiliates for their own marketing.
Ordinary email, website contact forms, live chat and text messages are not secure methods of communication. Messages sent this way travel over open networks and can be intercepted, misdirected, forwarded, or read by anyone with access to the device or account they arrive on. We cannot guarantee the confidentiality of information you send us through them.
Please do not use this website, email, chat or text to send medical details, or for anything urgent. If you have a medical emergency, call 911 or go to the nearest emergency department. For an urgent but non-emergency concern, telephone the practice at 561.353.2265.
If you choose to communicate with us by email or text anyway, you do so at your own risk, and you accept that risk. Communicating with us this way is voluntary and you may withdraw at any time.
You have the right to ask us to communicate with you by a different method or at a different address or telephone number, and we will accommodate reasonable requests. Just tell us what you prefer.
If you give us your mobile number and consent, we may send you appointment-related messages and, separately, marketing messages. Consent to receive marketing text messages is never a condition of purchasing anything or receiving care.
Your mobile opt-in information and your consent are never sold, rented or shared with third parties or affiliates for their marketing purposes. They are used only by us, and by the messaging provider that delivers our messages on our behalf.
When you submit a form on this site or give us your number, you may be authorizing us to contact you by telephone, text, email or voicemail about your enquiry or appointment. You can withdraw that authorization at any time by telling us, and we will stop.
Marketing emails include a clear unsubscribe link and our postal address. Unsubscribing stops marketing email. It does not stop messages about an appointment you have booked, your care, or your account, which we may still need to send you.
| Type of information | How long we keep it |
|---|---|
| Medical and treatment records | At least five years from the date of your last contact with the practice, as Florida rule 64B8-10.002 requires. In practice we retain adult records longer — generally seven to ten years — and records of patients treated as minors are kept longer still. |
| Financial and billing records | Seven years, for tax and accounting purposes. |
| Contact-form and enquiry submissions | Up to 24 months from submission if you do not become a patient. |
| Marketing contacts and preferences | Until you unsubscribe, or up to 36 months after your last interaction with us, whichever comes first. |
| Records of consent and opt-out | At least four years, so we can prove that consent was given and that an opt-out was honored. |
| Website analytics and server logs | Up to 14 months, usually in aggregate form. |
| De-identified and aggregated information | Indefinitely. This information can no longer be linked to you. |
Where a longer period is required by law, a regulator, an insurer, or a pending or anticipated legal claim, we keep the information for that longer period.
We use administrative, physical and technical safeguards designed to protect the information we hold. These include access controls that limit information to staff who need it, encryption of our website traffic, secured and locked storage for physical records, workforce training, vendor agreements, and monitoring for unauthorized activity.
No website, server or method of transmission is completely secure, and we cannot promise that our safeguards will never fail. We do not overstate what they do. If you believe your interaction with us is no longer secure, contact us immediately at 561.353.2265.
Some browsers and extensions send a Global Privacy Control (GPC) signal. We treat a GPC signal as a valid request to opt out of any sale or sharing of personal information for targeted advertising. Because we do not sell personal information and do not run advertising trackers, there is nothing for the signal to switch off — but we honor it as an instruction rather than ignore it. A GPC signal applies to the browser and device that sends it.
There is still no agreed technical standard for older “Do Not Track” browser settings, and we do not respond to them. The GPC signal described above is the mechanism we honor.
We want to be straightforward about this rather than claim obligations we do not have. Brazelia is a single-location Florida practice. We are well below the size thresholds that trigger the comprehensive consumer privacy laws now in force in other states, and the Florida Digital Bill of Rights applies only to companies with more than one billion dollars in annual revenue, so it does not apply to us.
We nevertheless extend the following rights to everyone who contacts us, wherever you live. Subject to verification of your identity and to exceptions the law allows, you may ask us to:
To make a request, contact us using the details in section 19. We will respond within 45 days, and will tell you if we need up to 45 more. An authorized agent may act for you with written permission and verification. There is no charge unless a request is excessive or repetitive, and we will never treat you differently or refuse you care for exercising a right.
If we decline a request, you may appeal by replying to our decision in writing. We will respond to an appeal within 45 days and explain our reasoning. If your appeal is denied, you may contact the Florida Attorney General or the attorney general of your own state.
Some information is outside these rights because the law requires us to keep it — most importantly, your medical record. Requests relating to your medical record are handled under the Notice of Privacy Practices and Florida Statutes section 456.057, which give you stronger rights of access and amendment than a general privacy request would.
Several states — Washington and Nevada in particular — regulate “consumer health data” separately from medical records, and define it broadly enough to include the fact that someone looked at, asked about, or booked a health-related service.
Information that is part of your medical record is exempt from those laws, because HIPAA and Florida law already govern it. This section covers everything else.
Any information that is linked or reasonably linkable to you and that identifies your past, present or future physical or mental health status. For us that means: the service you enquired about or booked, anything you tell us about your health in a form or chat, and any inference about your health interests that could be drawn from the pages you visited.
You may ask us to confirm whether we collect, share or sell your consumer health data; to give you a list of the third parties with whom we have shared it; to delete it; and to withdraw a consent you previously gave. Contact us using the details in section 19, and see the appeal process in section 13.
If this section ever conflicts with the rest of this Privacy Policy in relation to consumer health data, this section controls.
This website is intended for adults. We do not knowingly collect personal information from anyone under 13, and we do not direct this site to children.
Our medical, prescription, hormone, weight-loss, peptide, regenerative and IV services are provided only to patients 18 and older. A small number of aesthetic services may be provided to a patient under 18 only in person, only where clinically appropriate, and only with the documented consent of a parent or legal guardian, who must accompany the patient.
If you believe a child has given us personal information, contact us and we will delete it.
If a breach of security compromises personal information we hold, we will investigate, take steps to contain and mitigate it, and notify affected individuals as the law requires.
Where both apply, we work to the shorter deadline.
This site links to other websites — social media, financing providers, manufacturers, and reference sources. We do not control them and are not responsible for their content, security or privacy practices. Read their privacy policies before giving them information.
We may update this Privacy Policy. When we do, we will change the “Last updated” date at the top. If a change materially affects how we handle information we already hold about you, we will provide more prominent notice — a notice on this website and, where we have your address and it is appropriate, by email. Your continued use of the site after a change takes effect means you accept the updated policy.
Privacy Officer
Brazelia MedSpa & Integrative Wellness
101 Plaza Real South, Suite G
Boca Raton, FL 33432
Telephone: 561.353.2265 · Fax: 561.353.2267
Email: drb@brazeliamedspa.com
Or use our contact form — but please do not include medical details.
This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.
Effective date of this Notice: September 13, 2026.
This Notice is provided by Brazelia MedSpa & Integrative Wellness, 101 Plaza Real South, Suite G, Boca Raton, Florida 33432, and applies to all of our providers, employees, students, volunteers and contractors.
We are required by law to maintain the privacy of your protected health information, to give you this Notice of our legal duties and privacy practices with respect to it, to notify you following a breach of unsecured protected health information, and to abide by the terms of the Notice currently in effect.
Protected health information, or PHI, is information about you — including demographic information — that may identify you and that relates to your past, present or future physical or mental health, the care you receive, or payment for that care. It includes your chart, treatment notes, lab and imaging results, prescriptions, clinical photographs, and billing records.
We use and share your PHI to provide, coordinate and manage your care. Example: your provider reviews your hormone panel and shares the result with a compounding pharmacy in order to have your prescription prepared, and with another physician you have asked us to coordinate with.
We use and share your PHI to bill and collect for the services we provide. Example: if you apply for third-party financing for a treatment plan, we may confirm the services provided and the amount owed. If you pay in full yourself, we may still use your information to produce your receipt and maintain our financial records.
We use and share your PHI to run the practice and keep the quality of care high. Example: we review records to evaluate the performance of our providers, to train staff, to obtain legal and accounting advice, and to arrange our professional liability coverage.
We may use or disclose your PHI without your authorization in the following circumstances, each subject to the conditions and limits the law imposes:
Florida Statutes section 456.057 provides that your records may not be furnished to, and your medical condition may not be discussed with, any person other than you, your legal representative, or other health care practitioners and providers involved in your care, except on your written authorization or in the specific circumstances the statute permits. Where Florida law or any other law is more protective than HIPAA, we follow the more protective standard.
Other than as described above, we will not use or disclose your PHI without your written authorization. In particular, your written authorization is required for:
You may revoke an authorization at any time, in writing. Revocation stops any further use or disclosure going forward. It cannot undo something already done in reliance on the authorization, and material already published or distributed may not be able to be recalled. We will never condition your treatment on signing a marketing or photography authorization.
Information we disclose to someone else may be re-disclosed by that person and may no longer be protected by federal privacy law.
You may inspect and obtain a copy of your health and billing records. Ask us in writing. If the record is kept electronically, you may ask for an electronic copy, and you may ask us to send a copy to a person you name. We will respond within the time the law requires and without delays for legal review. We may charge a reasonable, cost-based fee; for your own access request we apply the federal cost-based limit, which is generally lower than the per-page amount Florida permits for third-party requests. In very limited circumstances we may deny access, and where the law allows you may ask for that denial to be reviewed.
If you believe information in your record is incorrect or incomplete, you may ask us in writing to amend it, and to state the reason. We may deny the request if the record was not created by us, is not part of the information you are permitted to inspect, or is accurate and complete. If we deny it, you may file a written statement of disagreement, which we will include with the record.
You may request a list of certain disclosures we have made of your PHI. The list does not include disclosures for treatment, payment or health care operations, disclosures you authorized, or certain others the law excludes. Your request must state a period of time not longer than six years. The first accounting in any twelve-month period is free; we may charge a reasonable cost-based fee for additional requests and will tell you the cost first so you can withdraw or modify your request.
You may ask us to restrict how we use or disclose your PHI for treatment, payment or health care operations, or to a person involved in your care. We are not required to agree to most restrictions, and we will tell you if we cannot.
There is one restriction we must honor. If you pay for a service or item in full, out of pocket, we must agree to your request not to disclose information about that service to a health plan for payment or operations purposes, unless the law otherwise requires the disclosure. Because most of our services are paid for directly, this right is likely to be relevant to you — just tell us at the time of service.
You may ask us to communicate with you about medical matters by a particular method or at a particular location — for example, only by mail, or only at a work number. We will accommodate all reasonable requests and will not ask you why.
You may ask for a paper copy of this Notice at any time, even if you agreed to receive it electronically. Ask at the front desk or call us and we will provide one.
You have the right to be notified if there is a breach of your unsecured protected health information.
We reserve the right to change this Notice and to make the revised Notice effective for protected health information we already hold as well as information we receive in the future. The current Notice will always be posted on this page with its effective date, and a copy will be available at the practice. We will offer you a copy of a materially revised Notice at your next visit.
If you believe your privacy rights have been violated, you may file a complaint with us, with the Secretary of the U.S. Department of Health and Human Services, or both.
To complain to us: contact our Privacy Officer in writing at Brazelia MedSpa & Integrative Wellness, 101 Plaza Real South, Suite G, Boca Raton, FL 33432, or telephone 561.353.2265, or email drb@brazeliamedspa.com. Please describe what happened and what you would like us to do.
To complain to the federal government: Office for Civil Rights, U.S. Department of Health and Human Services, 200 Independence Avenue SW, Washington, D.C. 20201. Telephone 1-800-368-1019, TDD 1-800-537-7697. Complaints may be filed online at hhs.gov/ocr/complaints and must generally be filed within 180 days of when you knew the act occurred.
You will not be retaliated against, penalized, or denied care for filing a complaint or for exercising any right described in this Notice.
Privacy Officer
Brazelia MedSpa & Integrative Wellness
101 Plaza Real South, Suite G, Boca Raton, FL 33432
Telephone: 561.353.2265 · Email: drb@brazeliamedspa.com
This Privacy Policy and Notice of Privacy Practices were prepared to reflect federal and Florida requirements as of September 2026. Law in this area changes. Brazelia MedSpa & Integrative Wellness reviews these documents periodically and recommends that patients with specific concerns contact our Privacy Officer directly.