Website Privacy Policy

01

Introduction and Scope

Welcome to Cellara Pain Institute (“Cellara,” “we,” “us,” or “our”). This Website Privacy Policy describes how we collect, use, process, and share personal information from visitors to our website (https://cellarapain.com), prospective patients, and active patients of our clinic located at 1149 W Lancaster Ave, Suite U-5, Rosemont, PA 19010.

This policy applies to information collected through our website, online forms, telephone communications, email, SMS messaging, and our integrated software platforms. It is designed to ensure transparency regarding our data practices.

Important Note Regarding Medical Information: This Website Privacy Policy governs general personal and commercial information. Protected Health Information (PHI) subject to the Health Insurance Portability and Accountability Act (HIPAA) is governed by our separate HIPAA Notice of Privacy Practices. Where there is a conflict between this Website Privacy Policy and the HIPAA Notice of Privacy Practices regarding PHI, the HIPAA Notice of Privacy Practices shall control.

02

Information We Collect

We may collect the following categories of information from website visitors, prospective patients, and active patients:

Contact and Identifying Information: When you interact with our website, submit inquiries, or request an appointment, we may collect your name, email address, telephone number, physical address, date of birth, and other identifying details.

Medical History, Treatment, and Health Information: As a pain management clinic, we collect sensitive information necessary for your care. This includes medical history, treatment records, intake and consent forms, diagnostic imaging references, and other health-related information.

Appointment and Booking Information: We collect information related to your requested and scheduled appointments, including service preferences, appointment history, and scheduling communications.

Payment and Transaction Information: If you receive services, we collect transaction details and payment information. Payment processing is handled securely by trusted third-party payment processors, and we do not store full payment card numbers on our systems. Certain treatments (including peptide and regenerative therapies) are cash-based; others may be billed to commercial PPO insurance with out-of-network benefits.

Telephone Calls and Communications: We collect communication records, call metadata, and records of telephone calls made to or received from our clinic.

Website, Browser, and Device Information: We automatically collect technical data when you visit our website. This includes your IP address, browser type and version, operating system, referring URLs, pages visited, and interaction data. This information is collected using cookies and analytics tools.

03

How We Use Your Information

We use the personal information we collect for the following purposes:

Providing Services and Care: To schedule appointments, manage patient profiles, provide treatments, document care, and maintain accurate medical and electronic records.

Communication and Customer Service: To respond to your inquiries, provide appointment confirmations and reminders, send follow-up messages, manage your account, and deliver patient support.

Marketing and Promotions: To send newsletters, educational content, and communications regarding our services, provided you have given appropriate consent where required. You may opt out of marketing communications at any time.

Operations and Quality Assurance: To operate our clinic, improve our services, train our staff, and ensure the quality and security of our communications.

Legal and Regulatory Compliance: To comply with applicable laws, regulations, and professional standards; to prevent fraud; to enforce our terms and policies; and to respond to lawful requests from law enforcement or government authorities.

04

Third-Party Platforms and Service Providers

To operate our clinic efficiently and securely, we utilize specialized third-party platforms and service providers. These platforms process patient, lead, and communication data on our behalf.

Electronic Health Records and Practice Management: We use a HIPAA-compliant electronic health records (EHR) and practice management platform to manage patient profiles, medical history, intake and consent forms, treatment documentation, appointment scheduling, and billing. We have signed a Business Associate Agreement (BAA) with this platform.

Scheduling and Communications: We may use third-party scheduling and communications platforms for appointment reminders, patient outreach, and administrative workflows. Where such platforms process PHI, we require and maintain appropriate BAAs.

Pennsylvania Law — Call Recording: Pennsylvania law generally requires the consent of all parties to record a telephone communication. If we record calls for quality assurance or training purposes, you will be notified at the start of the call.

Other Service Providers: We may also share information with other third-party providers that support our operations, including website hosting, analytics, cybersecurity, and professional services (such as legal and accounting). These providers are permitted to use the information only as necessary to perform services on our behalf.

05

Email and SMS Communications

By providing your telephone number and email address, you consent to receive communications from Cellara Pain Institute.

Transactional Messages: You may receive appointment confirmations, reminders, follow-ups, account-related messages, and service communications.

Marketing Messages: Marketing messages are sent only where permitted and based on appropriate consent. Consent to receive marketing messages is not a condition of receiving any treatment or service.

Rates and Frequency: Message and data rates may apply according to your mobile carrier plan. Message frequency varies based on your interactions with us (typically 1–5 messages per appointment or inquiry cycle).

Opting Out: You may opt out of receiving SMS marketing messages at any time by replying “STOP” to any text message you receive from us. For assistance, reply “HELP.” Please note that unsubscribing from marketing messages may not stop essential appointment, transaction, or safety-related communications where legally permitted.

06

Cookies, Analytics, and Tracking Technologies

Our website uses cookies and similar tracking technologies to improve functionality, analyze traffic, and deliver relevant information.

Cookies: Cookies are small text files stored on your device. We use session cookies (which expire when you close your browser) and persistent cookies (which remain on your device until deleted) to recognize you, remember your preferences, and ensure our services function smoothly.

Analytics: We may use third-party analytics tools to understand how users interact with our website. These tools may collect your IP address and browsing behavior in aggregated, anonymized form.

Managing Preferences: Most modern web browsers allow you to monitor, limit, or prevent the use of cookies. Disabling cookies may affect the functionality of certain website features.

07

Information Sharing and Disclosure

We do not sell your personal information to third parties. We may share your information in the following circumstances:

• With Service Providers: As described above, we share data with vendors who perform services on our behalf, subject to appropriate confidentiality and data processing agreements.
• For Legal and Safety Reasons: We may disclose information if required by law, regulation, subpoena, or legal process; to enforce our policies; to investigate fraud; or to protect the rights, property, and safety of Cellara, our patients, our staff, or the public.
• Business Transfers: In the event of a merger, acquisition, reorganization, or sale of assets, personal information may be transferred as part of the transaction.

08

Data Security and Retention

We implement administrative, technical, and physical safeguards designed to protect your personal information from unauthorized access, use, or disclosure. However, no internet transmission or electronic storage system is entirely secure. We cannot guarantee absolute security.

We retain your personal information for as long as necessary to fulfill the purposes outlined in this policy, comply with our legal and regulatory obligations (including Pennsylvania medical records retention requirements), resolve disputes, and enforce our agreements.

09

Third-Party Websites

Our website may contain links to third-party websites or applications. We do not control and accept no liability for the privacy practices or content of these external sites. We encourage you to review the privacy policies of any third-party website you visit.

10

Children's Privacy

Our website and services are not directed to individuals under the age of 18 without appropriate parental or guardian involvement. We do not knowingly collect personal information from children without appropriate parental or guardian consent.

11

Changes to This Privacy Policy

We may update this Website Privacy Policy from time to time to reflect changes in our practices, technologies, or legal requirements. We will post the updated policy on our website and update the “Last Updated” date at the top of the page.

12

Social Media, Photography, and Marketing Consent

This section explains the difference between reading this policy and giving us permission to use your image, voice, story, or health information in social media or marketing. They are not the same thing. This section is a notice of our practices. It is not an authorization, and it does not itself permit us to use your information for marketing.

Using this website or our social media is not consent. Visiting this website, following or interacting with our social media accounts, “liking” or sharing a post, submitting a contact or appointment request form, or receiving care from us does not give Cellara permission to photograph you, record you, publish your testimonial, or use your Protected Health Information (PHI) in marketing. We do not treat any of those actions as consent for those purposes.

A separate written authorization is required. If we would like to use a photograph, video, audio recording, written testimonial, or other identifiable information about you on social media, on this website, in advertising, or in other marketing, we will ask you to sign a separate Patient Authorization for Use or Disclosure of Health Information (or a separate media release where no PHI is involved). Federal law requires a valid authorization for most uses and disclosures of PHI for marketing and specifies what a valid authorization must contain (45 CFR 164.508). We will give you a copy of anything you sign.

What the authorization will cover. Our authorization form is written in plain language and identifies, at a minimum:

• the specific information that may be used or disclosed — for example, a particular photo, video, or audio clip, your first name and last initial, or a description of your condition or treatment;
• who at Cellara may make the use or disclosure, and which platforms, pages, or materials may receive it;
• each purpose of the use or disclosure;
• an expiration date or expiration event;
• where applicable, a statement describing any payment to Cellara from a third party, or any sale of your health information, involved in the use or disclosure (45 CFR 164.508(a)(3)(ii), (a)(4)(ii));
• your right to revoke the authorization in writing, how to revoke it, and the limited exceptions to that right (45 CFR 164.508(b)(5), (c)(2)(i));
• a statement that information disclosed under the authorization may be redisclosed by the recipient and may no longer be protected by HIPAA (45 CFR 164.508(c)(2)(iii));
• a statement that you may refuse to sign, and that we may not condition treatment, payment, enrollment, or eligibility for benefits on whether you sign (45 CFR 164.508(b)(4), (c)(2)(ii)(A)); and
• your signature and the date, or the signature of your personal representative together with a description of that person's authority to act for you (45 CFR 164.508(c)(1)(vi)).

Your choice is voluntary, and your care is never conditioned on it. We do not condition treatment, payment, enrollment, or eligibility for benefits on whether you sign a marketing or media authorization. You may decline, or ask us to use only part of what we proposed, and you will still receive the same care. If you decline, we will not use your photograph, recording, testimonial, or PHI for marketing.

Revoking your authorization. You may revoke a signed authorization at any time by writing to our HIPAA Privacy Officer using the contact information in Section 14. Revocation stops future uses and disclosures, but it does not undo uses or disclosures we already made in reliance on the authorization, and it cannot reach copies that other people or platforms have already shared. We will confirm in writing when we process your revocation and will remove the content from accounts and pages we control as promptly as practicable.

Minors and patients who lack capacity. For a patient under 18, a parent or legal guardian must give the authorization, consistent with applicable law. For an adult patient who lacks capacity, a legally authorized representative may act on the patient's behalf.

Public platforms and information you share yourself. Our social media pages are hosted by third parties whose own terms and privacy policies apply. We do not control those platforms or how other users copy or re-share content. If you comment on our posts, tag us, or post about your own care, you are choosing to share that information publicly. We may respond, but we will not republish your comment or post as a testimonial without your separate written authorization. We do not ask patients to “check in” at our office or to identify themselves as patients in public posts.

Our staff. Staff may not post identifiable patient information on personal or practice social media accounts without a signed authorization. If you believe your image, story, or health information has been used without your permission, contact our HIPAA Privacy Officer so we can investigate and, where appropriate, remove the content.

Uses and disclosures of PHI are also governed by our HIPAA Notice of Privacy Practices. Where this section and the HIPAA Notice conflict about PHI, the HIPAA Notice controls.

13

Telehealth Services

Cellara may offer telehealth appointments when telehealth is clinically appropriate for your situation and when the service is available. Telehealth is not appropriate for every condition, treatment, or visit, and availability may change. Scheduling a telehealth visit does not guarantee that telehealth is appropriate for you; your provider may determine that an in-person examination is needed.

Technology, privacy, and your location. Telehealth visits are conducted by telephone or video using a platform selected by Cellara. Before the visit we will tell you which platform to use and where to review that vendor's privacy and security practices. You are responsible for joining from a private location, using a device and connection that work, and limiting who can overhear the visit. If you cannot participate safely, we may reschedule or ask you to come in person.

Telehealth is not for emergencies. If you are experiencing a medical emergency, call 911 or go to the nearest emergency department. Do not wait for a telehealth response.

Licensure and where you are located. The provider treating you must be licensed or otherwise authorized under state law to practice in the state where you are physically located during the visit. Before the visit, we will confirm your location and that the treating provider is authorized to provide care there. If you are outside a state where that provider is licensed, we cannot conduct the visit and will offer to reschedule for a time when you are in an eligible location or help you arrange alternatives. Please tell us immediately if your location changes.

Risks and limitations. Telehealth has benefits, but it also has limits you should weigh before consenting:

• Electronic communication carries privacy and security risks, including possible unauthorized access, interception, or disclosure, even though we use safeguards designed to protect your information.
• Your provider cannot perform a hands-on examination, and may have less information than an in-person visit would provide.
• Technology can fail: connections may drop, audio or video may be poor, and a visit may be delayed, interrupted, or ended early.
• Your provider may decide that an in-person visit, imaging, or laboratory testing is needed before care can continue.
• Some medications, including certain controlled substances, and some procedures may not be appropriate or permitted through telehealth and may require an in-person evaluation.
• Insurance coverage and your cost may differ for telehealth compared with an in-person visit.

Informed consent before the visit. Before your first telehealth visit, we will explain what to expect, the risks and limitations above, your responsibilities, and your right to ask questions or stop the visit. You will be asked to give informed consent before care is provided, either verbally at check-in or on a written form, and we will document it in your medical record. If a form is required, we will provide it ahead of the visit when possible. Consent to telehealth is separate from consent to treatment generally and from any marketing authorization. You may withdraw consent at any time and ask for an in-person visit instead. If anyone else is present or observing at either end, we will tell you and obtain your agreement before the visit begins.

Alternatives. Alternatives to telehealth include an in-person visit at our Rosemont office, a referral to an appropriate local provider, or rescheduling. You may ask about these options at any time, and choosing one will not be used to penalize you.

Recording. We will not record a telehealth visit without your permission, and we ask that you not record or photograph the visit unless you and your provider agree in advance. Pennsylvania law generally requires the consent of all parties to record a conversation, and we apply that same all-party standard to telehealth visits. If a visit will be recorded for education, quality, or training, we will ask for your separate permission first and explain how the recording will be used, stored, and deleted.

Your records. Information discussed and generated during a telehealth visit is part of your medical record and is protected under HIPAA and our HIPAA Notice of Privacy Practices. Telehealth does not change your privacy rights or our obligations.

14

Contact Information

If you have questions, concerns, or requests regarding this Website Privacy Policy or our data practices, please contact us. For matters concerning Protected Health Information (PHI) and HIPAA, please contact our HIPAA Privacy Officer, Mohamed Osman, MD.