Effective date: October 17, 2026
This policy explains what information LightWeight MD collects through lightweightmd.com and our patient portal, how we use it, and the choices you have. We do not sell your information, and we do not use your health information for advertising.
When you become a patient, we will give you our Notice of Privacy Practices, which explains your HIPAA rights in detail. You can read it anytime here: lightweightmd.com/notice-of-privacy-practices.html.
LightWeight MD, PLLC is a medical practice owned and operated by Henry Igdal, M.D., a physician licensed in South Carolina. Our clinicians evaluate you, prescribe when appropriate, and manage your care through lightweightmd.com and our patient portal.
Prescriptions are filled by Pharmcore, Inc. d/b/a Hallandale Pharmacy Compounding (“the pharmacy”), a Florida-licensed compounding pharmacy that holds an active South Carolina Non-Resident Pharmacy Permit (No. 18443).
LightWeight MD is a “covered entity” under HIPAA. All health information you give us is protected health information (PHI), including eligibility questionnaire answers submitted before your first visit. We use and share PHI only as HIPAA and our Notice of Privacy Practices allow. If this policy and that Notice conflict, the Notice controls.
The pharmacy is a separate covered entity with its own HIPAA obligations.
We use information to:
We do not use your health information to build advertising profiles. We will not use your PHI for marketing without your written authorization.
We do not use advertising pixels, social-media tracking tools, third-party analytics, or session-recording tools on any page of our site.
In the patient portal, we use only strictly necessary cookies to keep you signed in and secure.
Some pages display content hosted by other services, such as our LegitScript certification seal. Loading that content gives the service standard connection information, such as your IP address and browser type. It does not give the service anything you type into our forms.
If we ever add analytics or advertising tools, we will update this policy before they go live. We will never place them on pages where you enter or view health information.
You can block or delete cookies in your browser settings.
With your consent, we text you about appointments, prescriptions, shipments, and your account. Message frequency varies. Message and data rates may apply. Reply STOP to opt out or HELP for help.
Opting out of texts does not cancel your subscription. We will reach you by email instead.
No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text-messaging opt-in data and consent will not be shared with any third parties.
Our texts do not include detailed health information.
Email about your care and account, such as receipts, shipping updates, and policy changes, is part of the service. Every marketing email includes an unsubscribe link.
We share information only to deliver your care and run the service.
| Recipient | What they receive | Why |
|---|---|---|
| Pharmcore, Inc. d/b/a Hallandale Pharmacy Compounding | Prescription, name, date of birth, contact details, shipping address, and relevant medical details such as allergies | To compound, dispense, and ship your medication |
| Shipping carriers | Name, shipping address, and tracking details | To deliver your medication |
| Payment processor (Stripe, Inc.) | Card details, billing name and address, and charge amounts; no health information | To process payments and refunds |
| Amazon Web Services | Information stored on our platform, and the content of emails and texts we send | Hosting, email delivery, and text messaging, under a business associate agreement |
| Zoom | Your name, contact details, and the audio and video of your visits | Telehealth visits, under a business associate agreement |
| Google Workspace | Email you send us and our replies | Patient email, under a business associate agreement |
| Government agencies, courts, and law enforcement | Only what the law requires | To comply with legal duties, such as pharmacy board inspections and valid subpoenas |
Every vendor that handles PHI signs a business associate agreement with us.
We do not sell your personal or health information. We do not share health information with advertising platforms or data brokers.
If LightWeight MD is involved in a merger or sale, information may transfer to the successor. The successor must keep honoring this policy and HIPAA.
Our payment processor, Stripe, Inc., collects card details directly through its secure payment form. Your card data never touches our servers.
We do not send health information to our payment processor. Charges appear on your statement as “LIGHTWEIGHTMD” and do not name your medication.
The processor’s own privacy policy governs how it handles payment data: stripe.com/privacy.
You can ask us to:
Our Notice of Privacy Practices describes your full HIPAA rights for your medical records. These include access, amendment, an accounting of disclosures, restrictions, and confidential communications.
How to make a request. Email privacy@lightweightmd.com or call 864-668-6120. We verify your identity before releasing or changing information, usually by confirming details on your account.
We respond within 30 days. If we need more time, we will tell you why within that period. We do not charge for requests, including copies of your records.
Limits on deletion. We cannot delete medical, prescription, or billing records that the law requires us or our partners to keep. We will delete or de-identify the rest and tell you what we kept and why.
You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights. We will not retaliate against you for filing a complaint.
| Record | How long we keep it | Why |
|---|---|---|
| Medical records | At least 10 years after your last treatment | South Carolina Physicians’ Patients Records Act, S.C. Code § 44-115-120 |
| Billing and payment records | 7 years | Tax and audit requirements |
| Questionnaires never reviewed by a clinician | 7 years, then deleted | So you can return without starting over |
| General server and site logs | 12 months | Security monitoring and troubleshooting |
| Audit logs of access to patient records | 6 years | HIPAA Security Rule audit and documentation requirements |
The prescriptions we write are part of your medical record. The pharmacy keeps its own dispensing records under the pharmacy laws that apply to it.
Questionnaires a clinician has reviewed, including those where treatment was declined, are kept as medical records.
We protect information with encryption in transit and at rest, role-based access controls, multi-factor authentication for everyone with access to patient records, and activity logging.
No system is perfectly secure. Protect your account with a strong, unique password, and keep your login private.
If a breach affects your information, we will notify you as federal and South Carolina law require. We also notify regulators where the law requires. These may include the U.S. Department of Health and Human Services and the South Carolina Department of Consumer Affairs.
Our services are for adults ages 18 to 64 who are located in South Carolina. We do not knowingly collect information from anyone under 18.
If we learn we have collected a minor’s information, we will delete it unless the law requires us to keep it. Contact us if you believe a minor has used our site.
We serve patients located in South Carolina. Our pharmacy is located in Florida.
Before we serve patients in another state, we will update this policy to reflect any additional rights under that state’s laws.
We may update this policy. For material changes, we will post the new version with a new effective date and email active patients at least 30 days before the change takes effect.
We will not use information we already hold in a materially different way than this policy described when we collected it, unless you consent.
Privacy Official: Henry Igdal, M.D.
Email: privacy@lightweightmd.com
Phone: 864-668-6120