1. Why this notice exists
TRC may handle information about a person's cosmetic goals, possible procedures, photographs, surgical plans, and recovery. Such information deserves careful handling even when it is not legally categorized as protected health information (“PHI”) under the Health Insurance Portability and Accountability Act (“HIPAA”). This explanation supplements, but does not replace, TRC's Privacy Policy.
2. HIPAA depends on the function and relationship
Whether HIPAA applies to particular TRC activities is determined by law and the facts, not by a website label. A physician or practice may be a HIPAA-covered entity. TRC may be acting as a business associate on behalf of a covered provider for some functions if the legal requirements are satisfied, and may act independently as a consumer-facing non-clinical service for others. TRC must evaluate each data flow and maintain any required business associate agreements before regulated PHI is exchanged.
3. Not a HIPAA Notice of Privacy Practices
This page is an explanatory TRC information notice. It is not represented as the formal Notice of Privacy Practices required of HIPAA-covered healthcare providers. The treating physician or covered facility may issue its own notice. A HIPAA business associate generally does not issue its own HIPAA Notice of Privacy Practices solely by being a business associate.
4. Sources and uses of information
Sensitive information may be entered directly by users, submitted in messages or photographs, or—where authorized—provided by a treating practice. It may be used for account operation, patient-requested planning, authorized care coordination, education, service delivery, billing administration, security and legally permitted related purposes.
5. Sharing with selected providers
When a patient asks TRC to help communicate with a surgeon or practice, TRC may need appropriate patient permission and/or a lawful HIPAA basis, depending on the parties and data involved. A broad platform checkbox does not automatically serve as a valid HIPAA authorization for every disclosure. Some authorizations require specific elements and the ability to revoke, subject to legal limits.
6. Digital planning and photographs
Procedure interests, body-area selections, goal-state imagery, avatars, and uploaded photographs may reveal highly sensitive information. Do not include identifiable patient photos or health information in public examples, routine advertising, unnecessary vendor logs, or external generative AI tools without a proper legal basis and appropriate security arrangements. Where relevant, use access controls, secure transfer, vendor agreements, and retention/deletion schedules.
7. Advertising and analytics protections
Health-related pages and authenticated planning tools require careful review of cookies, tracking pixels, event logging, AI service providers and analytics. Unauthorized disclosure of identifiable health information may trigger privacy or breach-notification obligations even for businesses outside HIPAA.
8. Breach and incident obligations
Depending on TRC's functions and applicable laws, a security incident may implicate HIPAA breach rules, the FTC Health Breach Notification Rule, or state law. TRC must assess and provide notifications when legally required; no public statement substitutes for incident response procedures.
9. Patient requests and provider records
Questions concerning records held by a treating practice may need to be directed to that practice. Requests concerning information maintained by TRC can be submitted to care@tissuerestorationcenter.com; TRC should respond consistent with applicable law and its relationship to the data.
10. Medical emergencies
This is not a secure emergency consultation channel. For emergencies in the United States, call 911. For urgent clinical issues, contact the treating practice directly through its established emergency process.