Savannah River Advanced Surgery PC

Notice of Privacy Practices

Effective Date: August 27, 2026 Last Updated: August 27, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

1. Who This Notice Covers

This Notice is provided by Savannah River Advanced Surgery PC ("SRAS PC," "the practice," "we," "us," or "our"), a Georgia professional corporation. SRAS PC is a covered entity under the Health Insurance Portability and Accountability Act of 1996 and its privacy, security, and breach notification regulations ("HIPAA").

This Notice applies to all protected health information we create, receive, maintain, or transmit about you, whether on paper or electronically, in connection with:

  • in-person surgical and general surgery care provided by SRAS PC, including care associated with the practice website savannahriversurgery.com; and
  • the LeanDreams virtual medical weight management program (the "LeanDreams Program"), which SRAS PC operates as a program and brand, including care associated with leandreamsweightloss.com.

It applies to all clinicians, employees, contractors, students, and volunteers who provide care or perform services for SRAS PC, and to the business associates that handle protected health information on our behalf.

Savannah River Practice Management LLC ("SRPM LLC") provides administrative, technology, billing, scheduling, and marketing support to SRAS PC. SRPM LLC does not practice medicine and is not your healthcare provider. When SRPM LLC handles your protected health information, it does so as a business associate of SRAS PC under a written business associate agreement that requires it to protect your information and use it only as permitted.

In this Notice, "health information" and "PHI" mean protected health information: information that identifies you, or could reasonably be used to identify you, and that relates to your health, your health care, or payment for your health care.

2. Our Legal Duties

We are required by law to:

  • keep your health information private, except as this Notice permits or as the law otherwise allows or requires;
  • give you this Notice explaining our legal duties and privacy practices;
  • follow the terms of the Notice currently in effect;
  • notify you if a breach of your unsecured health information occurs that compromises its privacy or security; and
  • obtain your written authorization for uses and disclosures not described in this Notice.

Where Georgia law, South Carolina law, or another law is more protective of your health information than HIPAA — for example, laws governing HIV/AIDS information, mental health and substance use disorder records, genetic information, or minors' records — we follow the more protective law.

3. How We May Use and Disclose Your Health Information Without Your Written Authorization

3.1 For Treatment

We use and disclose your health information to provide, coordinate, and manage your care, and to share it with other clinicians involved in your care.

Example: Your surgeon reviews your imaging and laboratory results before an operation and shares your operative plan and history with the anesthesiologist, the operating-room nurses, and the hospital or surgery center where the procedure will be performed. In the LeanDreams Program, we send your prescription and relevant clinical details to a contracted compounding pharmacy so your medication can be prepared and shipped to you.

3.2 For Payment

We use and disclose your health information to obtain payment for the care we provide and to determine coverage and eligibility.

Example: For surgical care that is billed to insurance, we send your health plan information about your diagnosis and the procedure performed so the claim can be processed, and we may seek prior authorization before scheduling. For the cash-pay LeanDreams Program, we use your information to charge the payment method you have authorized and to resolve billing questions.

3.3 For Health Care Operations

We use and disclose your health information for our business and administrative activities, including quality assessment and improvement, reviewing the competence and qualifications of our clinicians, training, accreditation and licensing, care coordination, resolving grievances, business planning, and general practice administration.

Example: We review a sample of charts internally to evaluate outcomes after bariatric and hernia procedures, and we use aggregate program data to improve how we follow up with weight management patients between visits.

3.4 Appointment Reminders, Treatment Alternatives, and Health-Related Benefits

We may contact you by telephone, text message, email, secure portal message, voicemail, or mail to remind you of appointments, to confirm shipments and refills, to tell you about treatment alternatives, and to describe health-related benefits or services that may be of interest to you. If you would prefer that we use a specific method or a specific telephone number or address, tell us and we will accommodate reasonable requests (see Section 5.6).

3.5 Individuals Involved in Your Care or Payment

We may disclose relevant health information to a family member, relative, close friend, or other person you identify as being involved in your care or in payment for your care. If you are present and able to make decisions, we will give you the opportunity to object first. If you are not present or are unable to agree or object — for example, in an emergency — we may use professional judgment to disclose information that is directly relevant to that person's involvement in your care. We may also tell a family member or personal representative your location, general condition, or death.

3.6 Business Associates

We may disclose your health information to business associates that perform services for us — such as our practice management and telehealth platform, secure messaging and communications vendors, billing and revenue cycle vendors, information technology and hosting providers, medical record storage and release services, transcription, secure document destruction, and SRPM LLC. Each business associate is required by written agreement to safeguard your information and use or disclose it only as permitted.

3.7 Other Uses and Disclosures Permitted or Required by Law

We may use or disclose your health information without your authorization in the following circumstances, subject to the conditions and limits the law imposes:

  1. When required by law. When a federal, state, or local law requires the use or disclosure.
  2. Public health activities. To prevent or control disease, injury, or disability; to report births and deaths; to report child abuse or neglect; to report reactions to medications or problems with products to the U.S. Food and Drug Administration; to notify people of recalls; and to notify a person who may have been exposed to a communicable disease.
  3. Victims of abuse, neglect, or domestic violence. To a government authority authorized to receive such reports, including reports of suspected abuse or neglect of a child or of an elderly or disabled adult, as required or permitted by law.
  4. Health oversight activities. To a health oversight agency for audits, investigations, inspections, licensure and disciplinary actions, and other activities authorized by law.
  5. Judicial and administrative proceedings. In response to a court or administrative order, and in response to a subpoena, discovery request, or other lawful process where the required assurances about notice to you or a protective order have been provided.
  6. Law enforcement. To a law enforcement official in response to a court order, warrant, subpoena, or summons; to identify or locate a suspect, fugitive, material witness, or missing person; about a victim of a crime under limited conditions; about a death we believe may have resulted from criminal conduct; about criminal conduct on our premises; and in an emergency to report a crime.
  7. Decedents. To coroners, medical examiners, and funeral directors as necessary for them to carry out their duties.
  8. Organ, eye, and tissue donation. To organ procurement organizations and entities engaged in the procurement, banking, or transplantation of organs, eyes, or tissue.
  9. Research. For research when an Institutional Review Board or privacy board has approved the research and a waiver of authorization, or as otherwise permitted for reviews preparatory to research or research on decedents' information. Otherwise we will obtain your written authorization.
  10. To avert a serious threat to health or safety. When necessary to prevent or lessen a serious and imminent threat to the health or safety of you or another person, to someone able to help prevent the threat.
  11. Workers' compensation. As authorized by and necessary to comply with workers' compensation and similar programs that provide benefits for work-related injuries or illness.
  12. Specialized government functions. For military and veterans activities, national security and intelligence activities, protective services for the President and others, medical suitability determinations, correctional institutions and law enforcement custodial situations, and certain government benefit programs.
  13. Fundraising. We do not currently conduct fundraising using your health information. If we ever do, you will have the right to opt out of receiving fundraising communications, and we will tell you how in the communication itself.

4. Uses and Disclosures That Require Your Written Authorization

We will obtain your written authorization before we use or disclose your health information for any purpose not described in this Notice, and in particular for:

  1. Marketing. Most uses or disclosures of your health information for marketing purposes require your written authorization. If we would receive payment from a third party in connection with a marketing communication, the authorization will say so.
  2. Sale of your health information. Any disclosure that constitutes a sale of your health information requires your written authorization, and the authorization will state that we would receive payment.
  3. Psychotherapy notes. Most uses and disclosures of psychotherapy notes, if any exist, require your written authorization.

Testimonials, photographs, and video. Using your name, image, photograph, "before and after" pictures, video, written or recorded testimonial, or review in our marketing — including on our websites, in social media, in advertising, or in patient education materials — requires a separate signed written authorization from you. That authorization is voluntary. Your care, your access to the LeanDreams Program, and the quality of your treatment do not depend in any way on whether you sign it.

Revoking an authorization. You may revoke any authorization at any time by giving us written notice at the address in Section 8. Revocation stops future uses and disclosures under that authorization. It cannot undo a use or disclosure we already made in reliance on it, and it does not apply where we have already taken action in reliance on the authorization. Material we have already printed, posted, or distributed, and material already published by a third party, may not be retrievable, though we will make reasonable efforts to remove it from platforms we control.

5. Your Rights Regarding Your Health Information

Unless a section below says otherwise, submit requests in writing to the Privacy Officer at the address in Section 8. Use our request forms where we have them; we will provide a form on request.

5.1 Right to Inspect and Get Copies

You have the right to inspect and receive a copy of the health information we maintain about you in our designated record set, including your medical and billing records. If we maintain your information electronically, you have the right to receive an electronic copy in the form and format you request if we can readily produce it, or in another readable electronic form we agree on. You may also direct us in a signed, written request to transmit a copy directly to another person or entity you designate.

We will act on your request within 30 days and may extend once by 30 days with written notice explaining the reason. We may charge a reasonable, cost-based fee for copying, mailing, and preparing an explanation or summary if you agree to one in advance. We may deny access in limited circumstances the law permits; if we do, we will tell you in writing why and explain your right to have the denial reviewed where review is available.

Psychotherapy notes, information compiled for use in a legal proceeding, and certain other categories are excluded from the right of access.

5.2 Right to Request an Amendment

If you believe health information in your record is incorrect or incomplete, you may ask us to amend it. Your request must be in writing and must state the reason for the amendment. We will respond within 60 days, with one possible 30-day extension.

We may deny your request if the information was not created by us (unless the creator is no longer available to act on it), is not part of the designated record set, is not information you would be permitted to inspect, or is accurate and complete. If we deny your request, we will explain why in writing, and you may submit a written statement of disagreement that we will include with the information in question.

5.3 Right to an Accounting of Disclosures

You have the right to request a list of certain disclosures we made of your health information in the six years before your request. The accounting does not include disclosures for treatment, payment, or health care operations, disclosures made to you or under an authorization you signed, incidental disclosures, disclosures to people involved in your care, or certain other categories the law excludes.

Your first accounting in any 12-month period is free; we may charge a reasonable, cost-based fee for additional requests in the same period and will tell you the cost in advance so you can withdraw or modify your request. We will respond within 60 days, with one possible 30-day extension.

5.4 Right to Request Restrictions

You may ask us to restrict how we use or disclose your health information for treatment, payment, or health care operations, or to restrict disclosures to a person involved in your care. We are not required to agree to these requests, except as described in Section 5.5. If we do agree, we will honor the restriction unless the information is needed to provide you emergency treatment. Either of us may terminate a restriction going forward, and we will notify you if we do.

5.5 Your Absolute Right to Restrict Disclosure to a Health Plan for Services You Pay for Out of Pocket

We must agree to your request to restrict disclosure of your health information to a health plan for payment or health care operations purposes if you pay for the item or service in full, out of pocket, and the disclosure is not otherwise required by law. This right is absolute; we cannot refuse it.

To use this right, tell us at or before the time of service that you are paying in full out of pocket and that you do not want the information disclosed to your health plan, and pay in full. Please note that if you have already used insurance for a related item or service, or if a third party such as a laboratory or pharmacy bills your plan directly, we may not be able to prevent that party's disclosure — so tell us early so we can help you coordinate.

Because the LeanDreams Program is cash-pay and we do not bill health plans for it, program services are generally not disclosed to health plans in the ordinary course.

5.6 Right to Request Confidential Communications

You have the right to ask us to communicate with you about medical matters in a particular way or at a particular location — for example, only at a specific telephone number, only by secure portal message, or at an alternative mailing address. You do not have to explain why. We will accommodate all reasonable requests, and we may ask how payment will be handled and for an alternative address or contact method.

5.7 Right to a Paper Copy of This Notice

You have the right to a paper copy of this Notice at any time, even if you agreed to receive it electronically. Ask at the front desk, call us, or write to the Privacy Officer. This Notice is also posted on savannahriversurgery.com and leandreamsweightloss.com.

5.8 Right to Be Notified of a Breach

You have the right to be notified if we or one of our business associates discovers a breach of your unsecured health information, as required by law.

5.9 Right to Choose Someone to Act for You

If you have given someone a valid medical power of attorney, or if someone is your legal guardian or your personal representative under applicable law, that person can exercise your rights and make choices about your health information. We will verify the person's authority before acting.

6. Changes to This Notice

We reserve the right to change this Notice at any time, and to make the revised Notice effective for all health information we already maintain as well as information we create or receive in the future. When we make a material change, we will post the revised Notice in our office and on savannahriversurgery.com and leandreamsweightloss.com, update the "Last Updated" date, and make paper copies available on request. The version in effect will always show its effective date.

7. Complaints

If you believe your privacy rights have been violated, you may file a complaint with us or with the federal government. You will not be retaliated against, penalized, or denied care in any way for filing a complaint.

With the practice:

Michael Whitmer, Privacy Officer Savannah River Advanced Surgery PC 1109 Medical Center Dr., Building 3 Augusta, GA 30909 Phone: 803-220-1716 Fax: (706) 739-4728 Email: ops@leandreamsweightloss.com

Please submit complaints in writing where possible, and describe what happened and when. We will look into every complaint we receive.

With the U.S. Department of Health and Human Services:

Office for Civil Rights U.S. Department of Health and Human Services 200 Independence Avenue, S.W. Washington, D.C. 20201 Phone: 1-877-696-6775

Complaints may also be filed electronically at hhs.gov/ocr/privacy/hipaa/complaints. A complaint to the Office for Civil Rights must generally be filed within 180 days of when you knew or should have known that the act complained of occurred.

8. Who to Contact With Questions or Requests

For questions about this Notice, to exercise any of the rights described in Section 5, to revoke an authorization, or to request a paper copy:

Michael Whitmer, Privacy Officer Savannah River Advanced Surgery PC 1109 Medical Center Dr., Building 3 Augusta, GA 30909 Phone: 803-220-1716 Fax: (706) 739-4728 Email: ops@leandreamsweightloss.com

For questions about the LeanDreams Program specifically, you may also call 202-430-5326.

9. Acknowledgment of Receipt

We are required to make a good-faith effort to obtain your written acknowledgment that you received this Notice. Signing an acknowledgment confirms only that you received the Notice. It is not a consent to treatment, and it does not waive any of your rights. If you decline to sign, we will document that and you will still receive care.