Privacy Policy

1. Who we are and what this covers

Weightabolism (Dr. V), 21021 Ventura Blvd, Suite 101, Woodland Hills, CA 91364, USA ("we", "us") runs the Dr. V Weight Management portal and is the controller of the personal information described here. This policy covers the portal and this website. Where a Dr. V clinic acts as a HIPAA covered entity, the clinic's Notice of Privacy Practices also governs how it uses and discloses protected health information. Privacy contact: drvaziri@doctorvaziri.com, (818) 704-1188.

2. Information we collect

3. How we use it, and our legal bases

We do not use your information for advertising or sell or "share" it for cross-context behavioral advertising. We do not make decisions with legal or similarly significant effects by automated means; the AI assistant only suggests, and you decide.

4. Who receives your information

• Your Dr. V clinic and care team, limited to the staff assigned to you and your clinic's administrators.
• Service providers (processors) that act only on our instructions under contract: cloud hosting (Amazon Web Services, United States); our text-message provider (Twilio), only if you verify a number; our payment provider (PayPal), only if you subscribe; our video-meeting provider (Zoom), only for online appointments where we create the meeting; and, only if you opt in, an AI provider (OpenAI) for the assistant.
• Google, only if you choose "Continue with Google". If you tap "Add to Google Calendar", your browser opens Google Calendar with the event details (time, clinic or meeting link, reminder title). We send Google nothing ourselves; Google's own terms and privacy policy apply to your calendar.
• Authorities and advisers where the law requires or permits, to protect rights and safety, or in a business transfer, with the same protections.
• Anyone else only with your consent.

4A. Text messages

Text messages are optional and off until you turn them on under Preferences. To start, you give your mobile number, agree to receive texts, and enter a code we send you. We then send only the texts you chose: reminders you set up, appointment confirmations, a reminder the day before an appointment, and notices if a clinic cancels. Texts are kept generic: they do not include your name or health details, because text messages are not a secure channel. They go through Twilio, which delivers them and sees the number and message. Message frequency depends on your reminders and appointments. Message and data rates may apply.

Reply STOP to any text to opt out, or HELP for help. You can also turn texts off or remove your number in Preferences. We keep a record of your consent and of any opt-out as proof. We do not sell or share your phone number or text-messaging consent with third parties for their marketing.

5. Where it is stored; international transfers

Data is stored in the United States. If you are in the EEA, UK or Switzerland, we transfer your data to the US on the basis of your explicit consent and, where available, appropriate safeguards such as standard contractual clauses with our processors. You can withdraw consent, though that ends the Service.

6. How long we keep it

We keep portal records while your account is active and afterwards for the period that medical-record, tax and other laws require or allow (in California generally up to 7 years from your last activity), then delete or de-identify them. Security and audit logs are kept for a shorter, limited period. Data we must keep is restricted to that purpose.

7. Your choices and rights

Depending on where you live you can: access your data and get a copy in a portable format; correct it; delete it; restrict or object to some processing; withdraw consent (the AI assistant, or all health data processing); and limit use of sensitive information. In California you also have the rights to know, delete, correct and limit under the CCPA/CPRA and the CMIA, and not to be treated worse for using them. In Washington and other states with consumer health data laws you can access, withdraw consent and request deletion. In the EU/UK you can complain to your data protection authority.

How: sign in and open Privacy & data to download your data, withdraw the AI consent, or send a request, or email us. We may need to verify your identity. We answer within 30 days (45 days in some US states, extendable once where the law allows) and tell you if we cannot fully comply and why, for example where a medical record must be kept.

8. Security

We use encrypted connections (HTTPS), role-based access limited to your clinic, hashed passwords, encrypted storage of the access keys we use for our providers, one-time codes for verifying phone numbers (stored hashed and short-lived), a captcha on sign-in, audit logging and consent records. No system is perfectly secure. If a breach affects your information we will notify you and regulators as the law requires.

9. Children

The Service is for adults aged 18 and over. We do not knowingly collect information from anyone younger. If you think a minor has an account, contact us and we will delete it.

10. Cookies, "Do Not Track" and Global Privacy Control

We use only the essential cookies described in the Cookie Notice. We do not track you across sites, so there is nothing to opt out of, and we treat a Global Privacy Control or Do Not Track signal as honored.

11. California disclosures

In the last 12 months we collected the categories in section 2 (identifiers, health information, internet activity for security, and your own content). We did not sell or share personal information for advertising. We use sensitive personal information only to provide the Service you requested, to keep it secure, and to meet legal duties.

12. Changes

When we change this policy in a way that matters we will update the version and date above and ask you to accept again. The previous versions are available on request.