Privacy Policy & Notice of Privacy Practices

Holistic Family Practice · Last updated: November 2026 · Effective on posting

This Privacy Policy and Notice of Privacy Practices explains how Holistic Family Practice ("the Practice," "we," "us," or "our") collects, uses, stores, and protects your information, including your health information, across our website, the Holistic Life+ app, and all of our services. We are a virtual integrative, functional, and naturopathic practice established in Virginia in 2009, serving patients across the United States and internationally through our Virtual Global Holistic Healthcare Model.

1. Who We Are

Holistic Family Practice is led by Dr. Erica Steele, DNM, ND, MPH, MBA, BCND, CFMP, a nationally board-certified naturopathic doctor (Board Certified Naturopathic Doctor through the American Naturopathic Association). Naturopathy is not a licensed profession in Virginia. Dr. Steele practices under her national board certification, not a state medical license, and is not a medical doctor (MD or DO). Our services include:

Virtual consultations with patients in the United States and internationally
Integrative, functional, naturopathic, and mind-body evaluation and care planning
Holistic wellness coaching and non-clinical programs
Digital health education courses, programs, and content, including the Holistic Life+ app
Medical records management and release for the practice period January 2009 to the present

Practice address: 5510 Cherokee Avenue, Suite #300, Alexandria, VA 22312
Phone: +1 757-600-6872
Email: [email protected]

2. Notice of Privacy Practices

We follow the privacy and security standards of the Health Insurance Portability and Accountability Act (HIPAA), 45 CFR Parts 160 and 164. This section is our Notice of Privacy Practices.

What is protected health information?

Protected health information (PHI) is any individually identifiable health information we create, receive, maintain, or transmit in connection with your care, including your name, date of birth, health history, assessments, care plans, lab results, billing information, and any other information that could identify you in connection with your health.

How we use and disclose your information

We use and disclose PHI for these purposes without separate authorization:

Care: to provide, coordinate, and manage your care, including sharing information with your primary care provider and other providers involved in your care, and with the independent licensed physicians who order laboratory tests on your behalf.
Payment: to invoice and collect payment for services, to bill insurance for laboratory tests where applicable, and to prepare superbills you may submit yourself for HSA, FSA, or out-of-network reimbursement.
Practice operations: for quality review, training, administration, and practice management.
As required by law: in response to valid court orders, subpoenas with appropriate patient authorization, public health reporting, and other legally required disclosures.

Uses that require your written authorization

We will not use or disclose your PHI for the following without your signed written authorization:

Release of records to third parties (attorneys, insurers, other individuals)
Psychotherapy notes
Substance use disorder records (42 CFR Part 2)
HIV/AIDS-related records
Genetic information (GINA)
Marketing communications that involve PHI
Sale of PHI. We do not sell your information.

Your rights

Access your records: you may request a copy of your records. We respond within the time required by Virginia Code § 32.1-127.1:03 and HIPAA. Fees follow our published fee schedule.
Request an amendment: you may ask us to correct inaccurate or incomplete information. We respond within 60 days.
An accounting of disclosures: you may request a list of disclosures made outside of care, payment, and operations for the past 6 years.
Request restrictions: you may ask us to limit how we use or disclose your information. We are not always required to agree.
Confidential communications: you may ask us to contact you by a different method or at a different location.
A paper copy of this notice: available on request at any time.
File a complaint: with us, or with the U.S. Department of Health & Human Services, Office for Civil Rights, at hhs.gov/ocr. We will not retaliate against you for filing a complaint.

Technology platforms and partners

We use the following platforms to store, process, and transmit your information:

Google Workspace (Google Drive): secure cloud storage of legacy medical records (2009–2023). Business Associate Agreement (BAA) in place with Google LLC.
Heidi Health: clinical documentation for current patients (2023–present). BAA in place.
BodySite (Holistic Life+ app): patient portal, programs, document storage, and secure records delivery. BAA in place.
GoHighLevel: intake forms, scheduling, invoicing, and communications. BAA in place.
Stripe and PayPal: payment processing. We do not store full card numbers.
Fullscript: supplement dispensary. When you order supplements through our dispensary, Fullscript receives the information needed to fill your order.
Rupa Health: laboratory test ordering and results, through its network of independent licensed ordering physicians. Rupa and the labs receive the information needed to order, run, and report the tests you choose.

We review our vendor agreements and security practices every year.

3. Information We Collect

Health information

When you use our clinical services, including virtual consultations, intake forms, the Holistic Life+ app, and records requests, we collect health history, assessments, care plans, laboratory results, supplement and medication records, vitals you enter, and other information needed to provide care.

Personal and contact information

We collect your name, date of birth, address, phone number, email address, and payment information as needed to provide services, process invoices, and communicate with you.

International patients

If you are in the European Union, European Economic Area, or United Kingdom, you have additional rights described in Section 8. If you are in another country, your information may be transferred to and processed in the United States, where data protection laws may differ from those in your country. By using our services, you consent to this transfer.

Website and technical information

We collect standard technical data through cookies, web beacons, and log files, including IP address, browser type, pages visited, and session length. We use it to improve our website and services. It is not linked to your health record. Tools on our website, such as the macro calculator, run in your browser and do not store the numbers you enter.

4. Virtual Care: Additional Privacy Provisions

All of our care is delivered virtually, across state and international borders. These provisions apply to that model.

Telehealth

Virtual consultations are held on secure, encrypted platforms. By joining a session, you consent to the electronic transmission of your health information over those connections. You are responsible for making sure your own device, internet connection, and surroundings are private during sessions.

Scope of practice

Dr. Steele is a nationally board-certified naturopathic doctor, not a licensed physician. She does not prescribe medication. When a laboratory test or prescription is appropriate, it is ordered by an independent licensed physician. Every patient is required to maintain a relationship with a primary care provider. Patients outside the United States are served in a wellness consultation, coaching, or health education capacity, and agree that the laws of Virginia and the United States govern our obligations.

Coaching and wellness programs

Our coaching and non-clinical programs are not the practice of medicine. Information you share in a coaching program is used to guide your program and is handled with the same care and confidentiality as clinical information, though it may not be PHI as defined by HIPAA. We treat all health information you share with us as confidential, whatever its classification.

Digital courses and the Holistic Life+ app

When you enroll in a course or program, we collect enrollment information, learning activity, and any health information you choose to provide. We use it to run the program and improve its content. It is not used for clinical decisions unless you are also an active patient.

5. Intellectual Property

Ownership

All content, materials, frameworks, programs, and brand elements created by or for Holistic Family Practice are the exclusive intellectual property of the Practice and its principal clinician, including:

Protocols and care frameworks: all integrative, functional, naturopathic, and mind-body protocols, care frameworks, decision tools, root-cause methods, supplement protocols, and case summary frameworks developed by the Practice.
Written content: all articles, blog posts, patient education materials, newsletters, summaries, intake questionnaires, and other written materials.
Brand identity: the names "Holistic Family Practice," "Holistic Life+," "Holistic Doctor in Your Pocket," and "Virtual Global Holistic Healthcare Model," and all associated logos, taglines, colors, and visual identity.
Digital programs and courses: all courses, programs, coaching frameworks, recordings, presentations, worksheets, and program materials, in any format.
Website content: all text, graphics, photographs, audio, video, software, and tools on our websites and platforms.

Prohibited uses

Without our prior written permission, you may not:

Reproduce, copy, or distribute any of our content, protocols, or materials, in whole or in part
Modify, adapt, translate, or create derivative works from our intellectual property
Use our protocols, frameworks, or program content in your own practice, programs, or courses
Sell, license, or otherwise commercialize any of our intellectual property
Remove or alter any copyright, trademark, or proprietary notice
Use our names or logos to imply endorsement, affiliation, or association
Scrape or systematically collect content from our websites or platforms with automated tools

Enforcement

We monitor for unauthorized use of our intellectual property. Violations may result in legal action for copyright infringement, trademark infringement, and unfair competition under United States federal law, including the Digital Millennium Copyright Act (17 U.S.C. § 512), and international treaties. We may seek injunctive relief, damages, and attorneys' fees to the fullest extent the law allows.

Limited license for personal use

You may access and view our public website content and patient education materials for your own personal, non-commercial use in connection with your own health. This license does not permit you to reproduce, distribute, or create derivative works from our content without our written permission.

6. Data Security

We use administrative, technical, and physical safeguards to protect your information, including:

Encrypted video and messaging platforms for telehealth
Encrypted cloud storage with access controls on platforms that hold health information
Access limited to authorized personnel
An annual review of vendor agreements and security practices
Secure payment processing through Stripe and PayPal

If a breach affects your PHI, we will notify you as required by the HIPAA Breach Notification Rule (45 CFR §§ 164.400–414) and applicable state law.

7. Data Retention

Adult patients: 6 years from the date of last service, or longer where Virginia law requires.
Minor patients: until the patient reaches age 23, or 6 years from the date of last service, whichever is later.
Disclosure logs: 6 years from creation.
Coaching, course, and app records: 3 years from your last program activity, then securely deleted.

8. International Privacy Rights (GDPR)

If you are in the European Union, European Economic Area, or United Kingdom, you have the following rights regarding your personal data:

Access: request a copy of the personal data we hold.
Rectification: request correction of inaccurate data.
Erasure: request deletion of your data, subject to our legal retention obligations.
Restriction: request that we limit how we use your data.
Portability: request your data in a portable, machine-readable format.
Objection: object to certain processing, including direct marketing.

To use any of these rights, email [email protected]. We respond within 30 days. We are the data controller for your personal data, and the platforms listed in Section 2 process it on our behalf.

9. Cookies and Tracking

Our websites use cookies and similar technologies to improve your experience, measure traffic, and support our communications. You can control cookies in your browser settings. Turning cookies off may limit some features. We do not use cookies to store or access your health information.

10. Children's Privacy

Our website and digital programs are not directed to children under 13, and we do not knowingly collect their personal information without verifiable parental consent. For patients under 18, a parent or legal guardian must authorize care and records requests.

11. Changes to This Policy

We may update this policy at any time. Changes will be posted on this page with a new "last updated" date. Continuing to use our services after an update means you accept the revised policy.

12. Contact Us

For privacy questions, HIPAA requests, records requests, or intellectual property inquiries:

Holistic Family Practice
5510 Cherokee Avenue, Suite #300
Alexandria, VA 22312
Phone: +1 757-600-6872
Email: [email protected]

This page does not constitute legal advice. See also our Terms & Conditions, Disclaimer, and Financial Terms.