Website Privacy Policy

This Website Privacy Policy explains how Lonestar Rheumatology, PLLC ("we," "us," or "our") collects, uses, and shares information when you visit www.lsrheum.com (the "Website"). It applies only to the Website. By using the Website, you agree to this Policy and to our Website Terms & Conditions.

Your health information is covered by our Notice of Privacy Practices

Medical information about you that we create or receive as your health care provider, including information you submit through our patient forms, patient portal, or secure messaging, is protected health information under HIPAA and Texas law. How we use and protect that information is described in our Notice of Privacy Practices, not in this Policy. If this Policy and our Notice of Privacy Practices conflict about your health information, the Notice of Privacy Practices controls.

Please do not send medical information through general website contact forms, email, or social media messages. Use our patient portal or call our office instead. In an emergency, call 911.

Information we collect

• Information you give us: your name, phone number, email address, and anything else you include when you contact us, request an appointment, or use a link on our Website to complete forms or book a visit.
• Information collected automatically: like most websites, our Website and the tools on it may collect your IP address, browser and device type, the pages you visit, the date and time of your visit, the website that referred you, and similar technical information, using cookies and similar technologies.

How we use information

• To respond to your questions and requests, and to help you schedule an appointment or complete patient forms.
• To operate, maintain, secure, and improve the Website.
• To understand how visitors use the Website (for example, which pages are most visited).
• To comply with law and protect our rights, our patients, and the Website.

We do not sell your personal information, and we do not use information collected through the Website for third-party advertising.

Third-party services

Our Website uses or links to services run by other companies. These companies have their own privacy policies, which we encourage you to review:

• Website hosting (Webit): hosts and operates the Website.
• Google Tag Manager and related Google tools: help us manage website features and understand Website use. Google Maps is embedded to show our location.
• Curogram: patient forms, appointment booking, and text messaging links.
• Healow / eClinicalWorks: our secure patient portal.
• Social media (YouTube, Facebook, Instagram, LinkedIn, TikTok): links to our social media pages. Information you share on those platforms is governed by their policies.

Vendors that handle patient health information for us, such as our patient forms, portal, and electronic health record vendors, are required to protect it under HIPAA business associate agreements.

Calls and text messages

If you give us your phone number, we may call or text you about appointments, forms, billing, and other health care matters, as described in our Website Terms & Conditions and patient forms. Message and data rates may apply. You can opt out of text messages at any time by replying STOP or by calling our office.

Cookies and your choices

You can set your browser to block or delete cookies, and many browsers let you send a "Do Not Track" or Global Privacy Control signal. If you block cookies, some parts of the Website may not work as intended. The Website does not currently respond differently to Do Not Track signals.

Security

We use reasonable administrative, technical, and physical safeguards to protect information collected through the Website. No method of internet transmission or storage is completely secure, so we cannot guarantee absolute security.

Children

Our practice treats patients 18 years and older. The Website is not directed to children under 13, and we do not knowingly collect personal information from children under 13 through the Website.

Links to other websites

The Website links to other websites, such as patient education resources. We are not responsible for the content or privacy practices of other websites.

Changes to this Policy

We may update this Policy from time to time. The updated Policy will be posted on this page with a new effective date. Your continued use of the Website after an update means you accept the updated Policy.

Contact us

Questions about this Policy or our privacy practices may be directed to:

Lonestar Rheumatology, PLLC — Attn: Privacy Officer
11914 Astoria Blvd, Suite 355
Houston, TX 77089
Phone: (713) 588-1674
Email: info@lsrheum.com

---

Notice of Privacy Practices

Lonestar Rheumatology, PLLC
Nilanjana Bose, MD
11914 Astoria Blvd, Suite 355, Houston, TX 77089
Phone: 713-588-1674

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Originally effective: April 1, 2022
Revised effective date: November 1, 2026

This Notice applies to Lonestar Rheumatology, PLLC, its providers and employees (the "Practice"). We are required by law to maintain the privacy of your protected health information ("medical information"), give you this Notice of our legal duties and privacy practices, notify you following a breach of unsecured medical information, and follow the Notice currently in effect.

How we may use and disclose your medical information

• Treatment: to provide and coordinate your care, including sharing with other physicians and providers (for example, a specialist we refer you to).
• Payment: to bill and collect from you, your insurer, or a third party, including obtaining prior authorization (for example, sending a claim with service codes to your plan).
• Health care operations: to run the Practice and improve care, including quality assurance, utilization review, credentialing and peer review, and business management.
• Appointment reminders, treatment alternatives & health-related services: including phone messages, texts, and email.
• Business associates: vendors (such as billing, IT, or AI service providers) who perform services for us and are required to protect your information.
• Family and others involved in your care or payment: as allowed by law, with an opportunity for you to agree or object when required.
• Other uses permitted or required by law: as required by federal, state, or local law; to avert a serious and imminent threat to health or safety (to medical or law enforcement personnel); organ and tissue donation; research (with required approvals or de-identified data); military and veterans; workers' compensation; public health (disease reporting, births and deaths, child abuse or neglect, adverse drug reactions, product recalls, exposure notification, and abuse/neglect/domestic violence reporting as required or authorized by law); health oversight; lawsuits and legal proceedings (court or administrative orders, subpoenas, lawful process); law enforcement as required or permitted by federal and Texas law; national security and intelligence; coroners, medical examiners, and funeral directors; and inmates in custody.
• Electronic disclosures: Texas law requires us to notify you that your medical information may be disclosed electronically for treatment, payment, health care operations, or as otherwise authorized or required by law.
• Marketing & fundraising: We will not use your information for paid marketing communications without your authorization (except face-to-face communications or promotional gifts of nominal value). If we contact you for fundraising, you may opt out.

Uses that require your written authorization

• Most uses of psychotherapy notes, marketing, and any sale of medical information require your authorization, as does any use not described in this Notice. You may revoke an authorization in writing at any time, except for actions already taken in reliance on it.
• Texas law: Texas prohibits the sale of your medical information (Tex. Health & Safety Code §181.153) and requires your authorization for electronic disclosures other than for treatment, payment, health care operations, or as authorized or required by law (§181.154). HIV/AIDS test results, mental health records, and genetic information receive additional protection, and we follow the more protective law.
• Substance use disorder records: If we receive records protected by 42 C.F.R. Part 2, we will not use or disclose them, or testimony about their content, in civil, criminal, administrative, or legislative proceedings against you without your written consent or a court order issued after notice and an opportunity to be heard. You may opt out of any fundraising using these records.

Your rights

• Inspect and copy: You may inspect or get a paper or electronic copy of your medical and billing records by written request to our HIPAA Officer. We will respond within 15 business days as required by Texas law. Fees will not exceed Texas limits (22 TAC §163.3) and, for your own records, a reasonable cost-based fee; no fee for disability benefits claims; records are not withheld for unpaid balances. If we deny access in limited circumstances, you may request review by another licensed professional.
• Amend: You may request in writing, with a reason, that we amend information you believe is incorrect or incomplete. We may deny requests in limited circumstances and will tell you in writing.
• Accounting of disclosures: You may request a list of certain disclosures made in the past six years (not including treatment, payment, operations, or authorized disclosures). The first list in 12 months is free.
• Restrictions: You may request limits on uses or disclosures. We are not required to agree, except that if you (or someone other than a health plan) pay in full out of pocket for a service, we must honor your request not to disclose information about that service to your health plan for payment or operations, unless required by law.
• Confidential communications: You may ask us to contact you in a certain way or at a certain location. We will accommodate reasonable requests without asking why.
• Paper copy: You may ask for a paper copy of this Notice at any time.
• Breach notification: You will be notified if your unsecured medical information is affected by a breach, as required by HIPAA and Texas law.

Changes, questions & complaints

We may change this Notice and apply changes to all information we hold. The current Notice is posted in our office and available on request.

If you believe your privacy rights were violated, contact:

Lonestar Rheumatology, PLLC
Attn: HIPAA Officer
11914 Astoria Blvd, Suite 355
Houston, TX 77089
Phone: 713-588-1674

You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights,
200 Independence Avenue S.W.
Washington, D.C. 20201
1-877-696-6775
www.hhs.gov/ocr/privacy/hipaa/complaints/
We will not retaliate against you for filing a complaint.

Third-Party Text Messaging Disclaimer

Any 3rd party text messaging through SMS text is not through SiteFLEX.com (formerly Webit.com). Lonestar Rheumatology PLLC has the sole responsibility of the 3rd party who provides this text message service. SiteFLEX.com will not and does not offer text messaging. SiteFLEX.com is not held responsible for any text messaging done by any 3rd party text message service.