Heidi Snyder Flagg MD PLLC d/b/a FLUXX

Notice of Privacy Practices

Effective June 5, 2026

Heidi Snyder Flagg MD PLLC (d/b/a FLUXX) is required by law to maintain the privacy of your Protected Health Information (PHI), to provide you with this Notice of our legal duties and privacy practices, and to abide by the terms of the Notice currently in effect. This Notice supplements our Privacy Policy.

Our Duty to Protect Your PHI

We are committed to protecting the privacy of your Protected Health Information — the individually identifiable health information we create, receive, maintain, or transmit about your care, including your symptom check-ins, Menopause Rating Scale entries, cycle data, and survey answers. We will not use or disclose your PHI without your authorization, except as described in this Notice or as otherwise permitted or required by law.

How We May Use & Disclose Your PHI

A. Without your authorization

We may use and disclose your PHI without your written authorization for:

Treatment — to provide, coordinate, or manage your care, including sharing PHI with the clinician you choose to consult.
Payment — to bill and obtain payment for services you request.
Healthcare operations — for quality, administrative, and operational activities that support care.
As required by law — when federal, state, or local law requires the use or disclosure.

B. Only with your written authorization

The following uses and disclosures will be made only with your written authorization, which you may revoke in writing at any time:

Marketing — we will not use or disclose your PHI for marketing purposes without your signed authorization.
Research outside of activities covered by an IRB or privacy-board waiver.
Highly sensitive information — and any other use or disclosure not described in this Notice.

Your HIPAA Rights

You have the following rights with respect to your PHI:

Access PHI: You may inspect and request a copy of your PHI. Email drheidiflagg@fluxx-it.com to request a copy; we will respond within the time allowed by law.
Request Amendments: If you believe your PHI is inaccurate or incomplete, you may request a correction in writing to drheidiflagg@fluxx-it.com, including the reason for the request.
Restrict Disclosures: You may request restrictions on certain uses and disclosures of your PHI. We will consider your request; in some cases we are required to agree to it.
Accounting of Disclosures: You may request a list of certain disclosures of your PHI we have made, other than for treatment, payment, or healthcare operations.
Confidential Communications: You may request that we communicate with you about your PHI by alternative means or at an alternative location, and we will accommodate reasonable requests.
File a Complaint: You may file a complaint with us or with the U.S. Department of Health and Human Services if you believe your privacy rights have been violated. See Complaints below. We will not retaliate against you for filing a complaint or exercising any of these rights.

Our Safeguards

We protect your PHI with administrative, physical, and technical safeguards, including:

Encryption in transit using TLS 1.2 or higher.
Encryption at rest using AES-256.
Role-based access controls with unique user IDs, limiting PHI to authorized personnel on a need-to-know basis.
Annual risk assessments and ongoing monitoring.
Workforce HIPAA training conducted at least annually.
Business Associate Agreements (BAAs) with every vendor that handles PHI on our behalf.

Breach Notification

If a breach of your unsecured PHI occurs, we will notify you without unreasonable delay and in no case later than 60 days from discovery, and we will report the breach to the U.S. Department of Health and Human Services (HHS). For a breach affecting 500 or more individuals, we will also notify prominent media outlets serving the affected area as required by law.

Policy Changes

We reserve the right to change this Notice and to make the revised Notice effective for PHI we already have as well as any we receive in the future. The current Notice will be posted with its effective date, and we will provide a revised Notice where required by law.

Complaints

If you believe your privacy rights have been violated, please contact us first at kate@fluxx-it.com so we can address your concern.

You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, at hhs.gov/hipaa/filing-a-complaint or by calling 1-800-368-1019.

We will not retaliate against you for filing a complaint.

HIPAA rights & appeals: drheidiflagg@fluxx-it.com
Complaints & general questions: kate@fluxx-it.com
Mailing address: Heidi Snyder Flagg MD PLLC
135 Spring Street, 2nd Floor
New York, NY 10012