Effective Date: October 1, 2026
PART A — WEBSITE PRIVACY POLICY
We are Shōka Health, LLC (“Shōka,” “we,” “our,” or “us”), a Georgia limited liability company. Shōka provides intravenous ketamine infusion therapy, stellate ganglion blocks, physician-directed wellness infusions, and related services. We operate the website at [www.shokahealth.com] (the “Website”).
We respect your privacy. This Privacy Policy explains what personal information we collect through the Website and our general communications, how we use and share it, and the choices you have. By accessing or using the Website, you agree to the practices described here. If you do not agree, please do not use the Website.
A.1 Scope — Website Information vs. Protected Health Information
This Part A applies to personal information we collect through the Website and through written or electronic communications with you before and outside of a treatment relationship. It does not govern Protected Health Information (“PHI”) as defined by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). Once you become a patient, the information we create or receive to provide, coordinate, or bill for your care is PHI and is governed by Part B of this document, our Notice of HIPAA Privacy Practices. If health-related information you submit through the Website later becomes part of a treatment relationship, we will treat it in accordance with HIPAA and applicable law.
A.2 Information We Collect
Information you provide to us
When you request a consultation, complete a contact or intake form, subscribe to communications, or otherwise interact with us, we may collect:
Your name and contact details (such as telephone number, mailing address, and email address);
Information you choose to share about your reason for contacting us or your interest in our services, which may include health-related information;
Communication preferences (such as preferred contact method or language); and
The content of correspondence and communications between you and us.
Please do not submit detailed medical history or sensitive health information through general Website forms. Secure intake occurs through our patient portal after you contact us.
You confirm that the information you provide to us is true, accurate, and complete. If you provide personal information about another person — for example, an emergency contact or someone who will accompany you to an appointment — you confirm that you have that person's permission to share their information with us.
Information collected automatically
When you visit the Website, certain information may be collected automatically, including:
Technical information such as IP address, browser type and version, device type, operating system, and time-zone setting;
Approximate, non-precise location (such as city or region) derived from your IP address;
Usage information such as the pages you view, referring and exit pages, dates and times of access, and how you interact with pages; and
Log and error data automatically recorded by our servers, including diagnostic details about any errors encountered while using the Website.
We use this information to operate, maintain, secure, and improve the Website and to understand how it is used.
A.3 How We Use Your Information
We use the personal information described above to:
Respond to your inquiries and consultation requests, and contact you about scheduling;
Provide information about our services and appointments, and, where you have opted in, educational content and updates;
Operate, maintain, secure, and improve the Website;
Process payments and, where applicable, provide receipts or documentation for HSA/FSA or out-of-network reimbursement; and
Comply with legal obligations and enforce our terms.
We do not sell or rent your personal information.
A.4 How We Share Your Information
We share personal information only as needed to operate our practice and as described below:
Service providers. We use trusted third parties to perform functions on our behalf, such as website hosting, electronic health records and telehealth, scheduling and secure messaging, payment processing, analytics, and email communications. These providers may access personal information only to perform services for us and are expected to protect it. Where they handle PHI, we enter into Business Associate Agreements as required by HIPAA. Our current providers include, or are expected to include:
Osmind — electronic health record, patient portal, secure messaging, scheduling, and HIPAA-compliant telehealth (see Osmind's own privacy policy here);
Stripe, Square, Venmo, Paypal — payment processing;
Framer — website hosting and delivery;
Google Analytics — website usage analytics;
Social media. Our Website links to our social media accounts, including Instagram and Facebook. Your use of those channels may result in collection or sharing of information by the platforms, which we do not control. Please review their privacy policies.
Legal and safety reasons. We may disclose information if required by law, subpoena, or legal process, or where we believe disclosure is necessary to protect the rights, property, or safety of Shōka, our patients, or others, or to prevent fraud or address security issues.
Business transfers. If Shōka is involved in a merger, acquisition, financing, reorganization, or sale of assets, personal information may be transferred as part of that transaction, subject to applicable law and, for PHI, our HIPAA obligations.
With your direction. We may share information when you ask us to or otherwise consent.
A.5 Cookies and Analytics
The Website may use cookies and similar technologies — small text files stored on your device — to make the site function, remember your preferences, and help us understand how the Website is used. These generally fall into a few categories: strictly necessary cookies required for the site to work; performance cookies that tell us how the site is used (for example, through Google Analytics); functionality cookies that remember your preferences; and social media cookies if you interact with sharing features.
Most browsers let you refuse or delete cookies through their settings. If you disable cookies, some features may not function properly.
A.6 Text Messaging (SMS)
If you provide your mobile number and opt in, we may send text messages such as appointment reminders and service-related communications. Message and data rates may apply. You can opt out at any time by replying STOP or by contacting us. Consent to receive texts is not a condition of receiving treatment.
A.7 Third-Party Links
The Website may link to third-party websites. We do not control and are not responsible for their privacy practices. Your interactions with them are governed by their own policies, and we encourage you to review them before providing personal information.
A.8 How We Protect Your Information
We use reasonable administrative, technical, and physical safeguards designed to protect personal information under our control, including encryption in transit where appropriate and access controls limiting who can view your information. However, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security. Any transmission of information to us is at your own risk.
If a breach involving your personal information occurs, we will notify you and applicable regulators as required by Georgia and federal law.
A.9 Data Retention
We retain personal information for as long as necessary to fulfill the purposes described in this Policy, to comply with our legal, regulatory, tax, and recordkeeping obligations, and to resolve disputes and enforce our agreements. Retention of medical records is governed by applicable law.
A.10 Children's Privacy
The Website is intended for adults. We do not knowingly collect personal information through the Website from anyone under 18 without appropriate consent. If you believe a child has provided us personal information through the Website, please contact us.
A.11 Your Choices and Rights
Depending on your state of residence and applicable law, you may have the right to request access to the personal information we hold about you, to request that we correct or update it, and to ask us to stop using it for marketing purposes.
You can unsubscribe from marketing emails using the link in those messages, and opt out of texts by replying STOP. To make a request, contact us using the information in Section A.14. Note that your rights with respect to Protected Health Information are separate and are described in Part B.
A.12 “Do Not Track” Signals
Some browsers offer a “Do Not Track” setting. Because there is no common industry standard for responding to these signals, the Website does not currently respond to them.
A.13 Changes to This Privacy Policy
We may update this Privacy Policy from time to time. When we do, we will revise the Effective Date above and post the updated version on this page. Changes are effective when posted.
A.14 How to Contact Us
If you have questions about this Privacy Policy, please contact us:
Shōka Health, LLC
6667 Vernon Woods Drive NE, Suite A40
Sandy Spring, GA 30328
Phone number TBD
hello@shokahealth.com
PART B — NOTICE OF HIPAA PRIVACY PRACTICES
As required by the Privacy Regulations promulgated under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”)
Effective Date: October 1, 2026
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
This Notice applies to Shōka Health, LLC and to all members of our workforce, including our physicians, nurses, clinical staff, and administrative staff.
B.1 What Is Protected Health Information?
“Protected Health Information” (PHI) is information about you, including demographic information, that may identify you and that relates to your past, present, or future physical or mental health or condition, the health care you receive, or payment for that care. It includes your medical records and information such as your name, address, phone number, and financial information.
B.2 Our Legal Duties
We are required by law to:
Maintain the privacy and security of your PHI;
Provide you with this Notice describing our legal duties and privacy practices, and give you a copy of it;
Notify you promptly if a breach occurs that may have compromised the privacy or security of your PHI;
Follow the terms of the Notice currently in effect; and
Abide by the terms of any restriction we agree to.
B.3 How We May Use and Disclose Your PHI
A. Treatment, Payment, and Health Care Operations
Treatment. We use and disclose your PHI to provide, coordinate, and manage your care. For example, we may share information with your psychiatrist, therapist, or primary care provider so they can coordinate your care with your ketamine or stellate ganglion block treatments, or with a physician to whom we refer you.
Payment. We use and disclose your PHI as needed to obtain payment for services. For example, we may use it to process your payment, to prepare a superbill you can submit to your insurer, or to document eligibility for HSA/FSA payment.
Health Care Operations. We use and disclose your PHI to support the operation of our practice — for example, for quality assessment and improvement, reviewing outcomes and psychometric measures, staff training and performance review, care coordination, licensing and accreditation, and business planning. We may also share PHI with individuals and organizations that help us with these activities, such as attorneys, accountants, and technology vendors, each of whom must agree to protect your information.
B. Uses and Disclosures Permitted Without Your Authorization
We may use or disclose your PHI without your authorization in the following circumstances:
As required by law — when federal, state, or local law requires disclosure, including workers' compensation laws.
Public health activities — to public health authorities to prevent or control disease, injury, or disability; report births and deaths; report reactions to medications or problems with products; or notify people of recalls.
Abuse, neglect, or domestic violence — to government authorities authorized to receive such reports.
Health oversight — to agencies conducting audits, investigations, inspections, and licensure activities.
Judicial and administrative proceedings — in response to a court or administrative order, subpoena, discovery request, or other lawful process.
Law enforcement — in limited circumstances, such as to identify or locate a suspect, witness, or missing person, to report a crime, or to provide information about a victim of a crime.
Coroners, medical examiners, and funeral directors — as necessary for them to carry out their duties.
Serious threat to health or safety — to prevent or lessen a serious and imminent threat to the health or safety of you or others.
Military, veterans, and national security — as authorized by law for national security and intelligence activities or protective services.
Inmates — to a correctional institution or law enforcement official having custody, as permitted by law.
Food and Drug Administration — in connection with product quality, safety, or effectiveness, including adverse event reporting.
Research — in most cases we will ask for your written authorization before using your PHI for research. In limited circumstances, we may use or disclose PHI without authorization if an Institutional Review Board or privacy board approves a waiver after determining the research poses minimal privacy risk, or where information identifying you does not leave our practice. Participation in research is always voluntary and will not affect your care.
De-identified and limited data — information from which identifying details have been removed, as permitted by law.
C. Uses and Disclosures Where You Have an Opportunity to Object
Family, friends, and others involved in your care — we may share PHI relevant to their involvement with a family member, relative, close friend, or other person you identify. If you are present and able, we will give you the opportunity to object. We will also assume that we may discuss your PHI in front of anyone you bring into the room with you. Please tell us if you would prefer otherwise.
Escort arrangements — where a treatment requires that a responsible adult accompany you home, we may confirm appointment logistics with the person you designate, limited to the minimum information necessary.
In our waiting area — we may call your name aloud. Tell our front desk if you would prefer we not do so.
Disaster relief — to authorized entities so your family can be notified of your location and general condition.
Appointment reminders and health-related information — we may contact you by phone, email, text, or through the Osmind patient portal with reminders, treatment information, or information about services that may interest you.
D. Uses and Disclosures That Require Your Written Authorization
The following uses and disclosures will be made only with your written authorization:
Marketing communications that involve payment from a third party;
Sale of PHI — we do not sell your PHI;
Use of your story, image, testimonial, or likeness in any promotional or public-facing material.
Any other use or disclosure not described in this Notice will be made only with your written authorization. You may revoke an authorization at any time, in writing, except to the extent we have already acted in reliance on it.
E. More Protective State and Federal Rules
Some categories of information receive additional protection under Georgia and federal law and may require your specific consent before disclosure — this can include mental health and substance use records. Where state law is more protective than HIPAA, we follow the more protective rule.
B.4 Your Rights Regarding Your PHI
You have the following rights with respect to your PHI. To exercise any of them, contact us using the information in Section B.7.
Right to inspect and receive a copy. You may inspect and obtain a copy of your medical and billing records, including an electronic copy where we maintain them electronically. We may charge a reasonable, cost-based fee. Limited exceptions apply, such as information compiled for use in a legal proceeding.
Right to request an amendment. If you believe information in your record is incorrect or incomplete, you may ask us to amend it. We may deny your request in certain circumstances, and if we do, you may submit a written statement of disagreement that will be included with your record.
Right to an accounting of disclosures. You may request a list of certain disclosures we have made of your PHI, other than those made for treatment, payment, health care operations, or those you authorized.
Right to request restrictions. You may ask us to limit how we use or disclose your PHI for treatment, payment, or health care operations, or to limit what we share with family or friends. We are not required to agree to most such requests.
Right to restrict disclosure to a health plan when you pay out of pocket. If you pay for a service in full, out of pocket, you have the right to ask us not to share information about that service with your health insurer, and we must honor that request unless the disclosure is otherwise required by law. Because many of our services are provided on a self-pay basis, this right may be particularly relevant to you.
Right to confidential communications. You may ask us to contact you in a specific way or at a specific location — for example, only by mobile phone, or at an address other than your home. We will accommodate reasonable requests.
Right to be notified of a breach. You have the right to be notified if a breach occurs that may have compromised the privacy or security of your PHI.
Right to a paper copy of this Notice. You may request a paper copy at any time, even if you agreed to receive it electronically.
Right to choose someone to act for you. If you have given someone medical power of attorney, or if someone is your legal guardian, that person can exercise your rights on your behalf. We will verify their authority before taking action.
B.5 Complaints
If you believe your privacy rights have been violated, you may file a complaint with us or with the U.S. Department of Health and Human Services. We will not retaliate against you in any way for filing a complaint, and filing one will not affect your care.
To complain to us, contact us using the information in Section B.7. To complain to the federal government, you may write to the Office for Civil Rights, U.S. Department of Health and Human Services, 200 Independence Avenue SW, Washington, D.C. 20201, call 1-877-696-6775, or file a complaint online here.
B.6 Changes to This Notice
We reserve the right to change this Notice and to make the revised Notice effective for PHI we already have as well as information we receive in the future. The current Notice will always be posted on our website and displayed in our office, with its effective date. You may request a copy at any time.
B.7 Questions and Complaints
If you have any questions about this Notice or would like an additional copy, please contact Shōka Health at hello@shokahealth.com.
If you think that we may have violated your privacy rights, or you disagree with a decision we made about access to your PHI, you may send a written complaint to:
Shōka Health
6667 Vernon Woods Drive NE, Suite A40
Sandy Springs, GA 30328