PRIVACY POLICY

Wunderlich Chiropractic

Last Updated: 3-10-2026

This Privacy Policy explains how Wunderlich Chiropractic collects, uses, stores, and protects the personal information of our patients and website visitors. We are committed to handling your information with the highest standards of privacy, confidentiality, and security, in full compliance with applicable federal and Wisconsin state law, including the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its implementing regulations.

This policy applies to all patients who receive chiropractic care at our clinic, individuals who contact us via phone, email, or our website, and anyone who uses our online booking system. Please read this policy carefully. By receiving care from us or using our website, you acknowledge that we may handle your information as described here. If you have any questions, please contact us using the details in Section 15.

Wunderlich Chiropractic is a limited liability company (LLC) providing chiropractic services to patients in the Fitchburg, Wisconsin area. Under HIPAA, we are a Covered Entity because we provide healthcare services and transmit health information in connection with insurance billing. This means we are legally required to protect your Protected Health Information (PHI) and to provide you with this Notice of Privacy Practices.

Clinic Name: Wunderlich Chiropractic

Business Structure: Limited Liability Company (LLC)

Address: 2940 Chapel Valley Rd., Fitchburg, WI 53711

Phone: 608-274-7660

Email: matt@wunderlichchiro.com

Website: www.WunderlichChiro.com

We collect a range of personal information to provide you with safe and effective chiropractic care, manage your appointments, process payments, and meet our legal obligations. The categories of information we may collect include the following.

• Full name, date of birth, and gender

• Home address, email address, and telephone number

• Emergency contact name and relationship

Because we provide chiropractic care, we collect detailed health information, which is considered Protected Health Information (PHI) under HIPAA. This includes:

• Chief complaints, symptoms, and reason for visit

• Medical history, including past injuries, surgeries, and illnesses

• Medications and supplements you are currently taking

• Chiropractic examination findings, including postural and range-of-motion assessments

• Spinal and musculoskeletal assessment records

• Diagnosis and treatment plans

• Progress notes, SOAP notes, and clinical records from every appointment

• Referrals to or correspondence from other healthcare providers

• X-ray or diagnostic imaging records, if applicable

• Health insurance provider, policy number, and group number

• Insurance billing records and explanation of benefits (EOB) documents

• Payment method details (card, cash, check)

• Billing address and payment history

• IP address and browser type when you visit our website

• Pages visited, time and duration of visits

• Device information

• Cookies and similar tracking technologies (see Section 12)

• Records of emails, phone calls, or messages you send us

• Appointment booking requests and confirmations

• Marketing email engagement data, if you have opted in to our communications

We collect your information through a number of different channels, depending on how you interact with our clinic.

Directly from you: When you complete intake forms, health history questionnaires, or consent documents — either in our clinic or through our online booking system. Also when you contact us by phone, email, or in person.

Through our online booking system: We use an online appointment booking platform to manage scheduling. When you book an appointment online, we collect the personal and contact information you provide during that process. Please see Section 6 for details about this platform.

Through insurance billing: When we submit claims to your insurance provider on your behalf, we exchange certain Protected Health Information with your insurer as required to process your claim and obtain payment.

Through payment processing: When you pay for services by card, we use secure payment processing systems to handle your payment. We do not store full card numbers ourselves.

Through our website: Certain technical data is collected automatically when you visit www.WunderlichChiro.com, including cookies and browser information.

As a HIPAA Covered Entity, we are permitted to use and disclose your Protected Health Information for the following purposes without requiring your separate written authorization, unless we state otherwise. For any uses or disclosures outside these permitted categories, we will obtain your written authorization before proceeding.

We use your health information to provide, coordinate, and manage your chiropractic care. This includes using your health history to develop treatment plans, reviewing past clinical notes during your appointments, and coordinating with other healthcare providers involved in your care, such as your primary care physician or a specialist, if applicable.

We use and disclose your Protected Health Information to obtain payment for the services we provide. This includes submitting insurance claims to your health insurer, verifying your coverage and benefits, and pursuing payment for any outstanding balances.

We may use your information for our internal clinic operations, including quality assurance, reviewing the effectiveness of treatment approaches, staff training, compliance activities, and business management. This information is used internally and is not shared with third parties for operational purposes unless specifically permitted by HIPAA.

We use your contact information to schedule your appointments, send appointment confirmations, and provide reminders. These communications are part of your care and are not marketing communications.

We may use or disclose your information where required to do so by law, such as in response to a valid court order, subpoena, or public health reporting requirement. We will only disclose the minimum information necessary to comply.

If you have opted in to receive marketing emails from us through our email marketing platform (GoHighLevel), we will use your email address to send you health tips, clinic news, promotional offers, and other communications you have consented to receive. This is entirely separate from your clinical care communications. You may unsubscribe at any time. See Section 11 for details.

Any use or disclosure of your PHI that is not described above will require your written authorization. You have the right to revoke any authorization you have given us at any time, in writing. A revocation will not affect actions we have already taken in reliance on your prior authorization.

We do not sell your personal information. We only share your information with third parties where it is necessary for your care, required by law, or where you have given your authorization. The following parties may have access to your information.

Your clinical records and personal information are accessed only by the treating chiropractor. We do not have additional administrative staff who access patient records. All handling of your information within the clinic is the sole responsibility of the clinic owner.

Where you have provided your insurance information and authorized us to bill on your behalf, we will share the minimum necessary Protected Health Information with your health insurance provider or their authorized representatives to process claims, obtain authorization for treatment, and receive payment. Your insurer has its own privacy practices governing how they handle your information, and we encourage you to review their privacy notice.

We use an online booking platform to manage appointment scheduling. When you book an appointment, your name, contact information, and appointment details are processed through this platform. We have confirmed with our booking provider that patient data is handled in compliance with applicable privacy standards. You should confirm the platform's data processing location by contacting the clinic, as we will update this section once confirmed.

If you have opted in to receive marketing communications from us, your name and email address are stored and processed through GoHighLevel, a customer relationship management and marketing platform. GoHighLevel processes data in the United States. We use this platform solely for marketing communications you have consented to receive, and we do not use it to store your clinical health records. For more information about GoHighLevel's data practices, please visit their website.

Payments made by credit or debit card are processed through secure, industry-standard payment processing systems. We accept card payments in-clinic. We do not store your full card details. Our payment processing arrangements comply with Payment Card Industry Data Security Standards (PCI DSS).

We may disclose information to law enforcement, courts, regulatory bodies, or public health authorities where we are legally required to do so. This may include mandatory reporting obligations under Wisconsin state law or federal regulations.

Any third-party service provider that handles your PHI on our behalf is required under HIPAA to enter into a Business Associate Agreement (BAA) with us. This agreement legally obligates them to protect your information in accordance with HIPAA standards. We ensure that appropriate BAAs are in place with any vendor that qualifies as a Business Associate.

We retain patient records for a minimum of 8 years from the date of the last clinical service, in accordance with HIPAA requirements and Wisconsin state law. This retention period allows us to comply with our legal obligations, support continuity of care, and defend ourselves in the event of a legal or regulatory dispute.

For patients who were under the age of 18 at the time of treatment, records will be retained until the patient's 19th birthday or for 8 years from the last date of service, whichever period is longer. This ensures compliance with Wisconsin statutes governing the retention of minor patient records.

Once the applicable retention period has expired, records will be securely destroyed or de-identified in a manner that prevents unauthorized access or reconstruction. Electronic records will be permanently deleted from our system. Paper records, if any, will be shredded. We will not retain your information longer than is necessary for its stated purpose or required by law.

If you have opted in to marketing communications, your email and contact details will be held on our GoHighLevel platform until you unsubscribe or request removal. Upon unsubscribing, your information will be removed from active marketing lists promptly.

We take the security of your information seriously and have implemented a range of technical and organizational safeguards to protect your personal and health information from unauthorized access, loss, alteration, or disclosure. The following measures are in place.

• Patient clinical records are stored digitally using a secure electronic health record (EHR) system protected by password authentication and, where applicable, encryption.

• Our website uses HTTPS encryption to protect data transmitted between your browser and our website.

• Payment card data is processed through PCI DSS-compliant systems. We do not store full card numbers.

• Access to digital records is protected by unique login credentials and is limited to authorized individuals.

• Patient records are accessed only by the treating chiropractor. Access is strictly limited on a need-to-know basis.

• We maintain a HIPAA compliance program, including policies and procedures governing the handling of Protected Health Information.

• Any third-party service provider handling PHI is required to sign a Business Associate Agreement and maintain appropriate security standards.

In the event of a data breach involving your Protected Health Information, we will comply with HIPAA's Breach Notification Rule. This means we will notify affected individuals, the U.S. Department of Health and Human Services, and, where required by the scale of the breach, prominent media outlets — within the timeframes specified by law.