PRIVACY POLICY

Allergy Breakup | Littleton, Colorado
Effective Date: January 1, 2026

Last Updated: May 12, 2026

 

1. INTRODUCTION & SCOPE

 

Welcome to Allergy Breakup ("Company," "we," "us," or "our"), located in Littleton, Colorado. We provide allergy testing, immunotherapy, and related healthcare services (collectively, the "Services"). This Privacy Policy explains how we collect, use, disclose, retain, and protect information about you when you use our website, mobile platforms, scheduling systems, patient portal, and SMS/text message communications.

 

This Policy applies to all individuals who interact with us, including patients, prospective patients, website visitors, and SMS subscribers. By using our Services or providing us with your personal information, you agree to the terms of this Privacy Policy. If you do not agree, please do not use our Services.

 

Allergy Breakup is committed to compliance with: the Health Insurance Portability and Accountability Act (HIPAA), the Colorado Privacy Act (CPA), the Telephone Consumer Protection Act (TCPA), the 10DLC A2P SMS messaging standards, CTIA Messaging Principles and Best Practices, and all applicable federal and Colorado state laws.

 

2. INFORMATION WE COLLECT

 

2.1 Personal & Contact Information. We collect information you provide directly, including your full name, date of birth, and gender; mailing address, email address, and phone number(s); emergency contact information; insurance information and billing details; payment card information (processed through PCI-compliant processors); and government-issued ID when required for identity verification.

 

2.2 Protected Health Information (PHI). As a healthcare provider, we collect and maintain Protected Health Information (PHI) as defined under HIPAA, including medical history, allergy test results, diagnoses, and treatment plans; prescription and medication records; clinical notes and provider communications; lab results and immunotherapy dosage records; and insurance claims and explanations of benefits (EOBs). PHI is collected only with your knowledge and is used exclusively to provide and coordinate your healthcare. All PHI handling is governed by our separate HIPAA Notice of Privacy Practices, provided to you at your first visit.

 

2.3 SMS & Communication Preferences. When you opt in to receive text messages from Allergy Breakup, we collect your mobile phone number used for SMS enrollment, opt-in date, time, and method of consent, message delivery and response data, and opt-out requests and timestamps. Standard message and data rates may apply. Message frequency varies based on your care schedule and preferences.

 

2.4 Automatically Collected Information. When you visit our website or patient portal, we may automatically collect your IP address and device identifiers, browser type, operating system, and language settings, pages visited, referral URLs, and time on site, and data from cookies, pixel tags, and similar tracking technologies.

​

3. HOW WE USE YOUR INFORMATION

 

3.1 Healthcare Operations. We use your personal information and PHI to schedule, confirm, and manage appointments; provide allergy testing, immunotherapy, and related medical services; communicate test results and treatment recommendations; process insurance claims and collect payments; coordinate care with referring physicians and specialists; and maintain accurate and complete medical records.

 

3.2 SMS & Text Message Communications. By opting in to our SMS program, you consent to receive text messages for the following purposes: appointment reminders and confirmations; prescription and immunotherapy shot schedule alerts; test result notifications (non-PHI summary only; detailed results via secure portal); billing reminders and payment confirmations; post-visit care instructions and follow-up prompts; health education content relevant to your treatment plan; and practice updates, closures, or urgent operational notices. We will never share your mobile number with third parties for their own marketing purposes. All SMS communications are sent in compliance with TCPA, CTIA guidelines, and 10DLC A2P campaign requirements.

 

3.3 Business & Legal Operations. We also use your information to improve our services and patient experience, prevent fraud and monitor security, comply with legal obligations and court orders, enforce our Terms & Conditions, and respond to regulatory inquiries.

 

4. SMS CONSENT, OPT-IN & OPT-OUT

 

4.1 How to Opt In. You may opt in to Allergy Breakup SMS communications by completing the SMS consent section on patient intake forms (paper or digital), texting START, YES, or ENROLL to our designated SMS number, checking the consent box on our website appointment request form, or verbally consenting with confirmation via text during a verified phone call. By opting in, you expressly consent to receive recurring automated text messages from Allergy Breakup at the mobile number provided. Consent is not a condition of receiving medical care.

 

4.2 How to Opt Out. You may opt out of SMS communications at any time by replying STOP, QUIT, CANCEL, END, or UNSUBSCRIBE to any message we send; contacting our front desk at (your phone number here); submitting a written opt-out request to Allergy Breakup, Littleton, CO 80120; or updating your communication preferences in the patient portal. After a valid opt-out request, we will send one final confirmation message and cease all SMS communications promptly. Opting out of marketing SMS does not affect appointment reminder texts required for patient safety, which you may separately manage with our staff.

 

4.3 Help & Support. Reply HELP to any message to receive instructions on how to manage your SMS preferences, or contact us at the information in Section 11. Message and data rates may apply.

 

4.4 10DLC Compliance. Allergy Breakup sends SMS messages through a registered 10-Digit Long Code (10DLC) carrier-approved campaign. Our messaging complies with all mobile carrier requirements, including message content standards, opt-in/opt-out handling, and message frequency limits.

 

5. SHARING & DISCLOSURE OF INFORMATION

 

5.1 HIPAA-Permitted Disclosures. We may share your PHI as permitted or required by HIPAA, including for treatment (with other healthcare providers involved in your care), payment (with insurers, billing companies, and payment processors), healthcare operations (with auditors, quality assurance teams, and accreditation bodies), as required by law (law enforcement, court orders, public health authorities), and with business associates (vendors who sign a HIPAA Business Associate Agreement).

 

5.2 Service Providers & Business Associates. We work with carefully vetted third-party vendors to operate our practice, including electronic health record (EHR) platform providers, SMS/messaging platform providers (HIPAA-compliant, BAA executed), scheduling and patient portal software providers, billing and payment processing companies, and IT security and cloud hosting providers. All vendors with access to PHI are required to sign a HIPAA Business Associate Agreement and maintain appropriate safeguards.

 

5.3 We Do Not Sell Your Information. Allergy Breakup does not sell, rent, lease, or trade your personal information or PHI to any third party for commercial or marketing purposes. This includes your mobile phone number.

 

6. COLORADO PRIVACY ACT (CPA) RIGHTS

Colorado residents have specific rights under the Colorado Privacy Act (C.R.S. § 6-1-1301 et seq.), effective July 1, 2023. To the extent applicable (excluding PHI governed exclusively by HIPAA), you have the right to access personal data we hold about you; request correction of inaccurate personal data; request deletion of personal data we no longer need; receive your data in a portable, machine-readable format; opt out of the sale of your personal data (we do not sell data); opt out of profiling that produces legal or significant effects; and appeal our decision if we deny a rights request.

 

To exercise these rights, submit a verified request to allergybreakup@gmail.com or the address in Section 11. We will respond within 45 days, with a possible 45-day extension for complex requests.

 

7. DATA RETENTION

 

We retain personal information and PHI in accordance with applicable law. Medical records are retained for a minimum of 6 years from creation or last effective date under HIPAA, and at least 10 years for adult patients under Colorado law, and 2 years beyond a minor patient's 18th birthday. SMS opt-in and opt-out records are retained for a minimum of 4 years for TCPA compliance. Billing and payment records are retained for 7 years. Records are securely destroyed after retention periods expire using HIPAA-compliant methods, including shredding for paper records and NIST-compliant digital erasure for electronic records.

 

8. SECURITY

 

We implement administrative, physical, and technical safeguards to protect your information, including 256-bit SSL/TLS encryption for all data in transit, AES-256 encryption for PHI stored at rest, role-based access controls and minimum-necessary access protocols, annual HIPAA security risk assessments, staff training on HIPAA and security practices, Business Associate Agreements with all applicable vendors, and incident response and breach notification procedures compliant with the HIPAA Breach Notification Rule. In the event of a breach of unsecured PHI, we will notify affected individuals, HHS, and, where required, the media, in accordance with HIPAA timelines.

 

9. CHILDREN'S PRIVACY

 

Allergy Breakup treats pediatric patients with parental or guardian consent. We do not knowingly collect personal information from children under 13 without verifiable parental consent in compliance with COPPA. For patients under 18, a parent or legal guardian must provide consent for treatment and data collection. Parents or guardians may request access to, or deletion of, their minor child's non-PHI personal data by contacting us directly.

 

10. COOKIES & TRACKING TECHNOLOGIES

 

Our website uses cookies and similar technologies for essential functionality (such as keeping you logged in to the patient portal), analytics (to understand website usage and improve patient experience), and preferences (to remember your language and display settings). You may control cookies through your browser settings, though disabling them may affect portal functionality. We do not use cookies to track your health or treatment data.

 

11. CONTACT INFORMATION

 

For privacy inquiries, rights requests, or questions about this Policy, contact: Allergy Breakup, Privacy Officer, Littleton, Colorado 80120, allergybreakup@gmail.com.

 

12. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. When we do, we will post the updated Policy on our website with a new effective date and, for material changes, notify patients via email or portal message. Continued use of our Services after the effective date constitutes acceptance of the updated Policy.

 

© 2026 Allergy Breakup. All Rights Reserved. Littleton, Colorado. This document does not constitute legal advice. Consult a licensed attorney to ensure compliance with all applicable laws and regulations.