top of page

PRIVACY POLICY

Belmar Cardiopulmonary Diagnostics PLLC

520 112th Ave NE #110, Bellevue, WA 98004 · (253) 256-2809 · hello@belmarcardio.org

Effective date: November 4, 2026

This policy explains what information Belmar Cardiopulmonary Diagnostics PLLC ("Belmar", "we") collects, how we use it, who we share it with, and the choices you have. It covers our website (www.bcdctesting.com), our booking and results app (dashboard.bcdctesting.com) and our iOS and Android app "Belmar Health and Wellness".

 

1. Who we are and HIPAA

Belmar is a healthcare provider covered by the federal Health Insurance Portability and Accountability Act (HIPAA). Your test results, appointment records, insurance details and other health information we hold as your provider are protected health information. How we use and share that information, and your rights over it, are set out in our Notice of Privacy Practices (www.bcdctesting.com/notice-of-privacy-practices). If anything in this policy seems to conflict with that Notice for your health information, the Notice applies.

 

2. What we collect

Information you give us

  • Name, email address, phone number, date of birth and gender.

  • Account login details. Passwords are stored encrypted; we cannot see them.

  • Appointment details: which test you book, the date and time, and cancellations.

  • Insurance details, if you use insurance for a test.

  • Anything you write to us through a form, email or phone call.

Test results

  • Results from your DEXA body composition scan, VO2 max test and metabolism (RMR) test, including the report files from the testing equipment, and your height and weight.

  • Answers to our pre-test questions, such as whether you might be pregnant.

Payments

  • Card payments are handled by Stripe. We receive a payment confirmation, not your full card number.

Information collected automatically

  • When you use our website and app, our servers record basic technical information needed to run and secure them, such as your IP address and browser type.

  • If you arrive from one of our ads, the link carries a label saying which ad it was. We save that label with your booking so we know which ads work. It stays with us.

  • In the mobile app: a push-notification token if you allow notifications.

 

3. How we use it

  • To book, run and bill for your tests, including billing your insurance if you use it, and to send you your results.

  • To prepare a written summary of your results (section 4).

  • To send appointment confirmations, reminders and account messages by email, text or push notification.

  • To answer your questions and requests.

  • To see which of our ads bring people to book, using only the ad labels described above.

  • To keep our systems secure and meet our legal obligations.

We do not sell your personal information or your health information, and we do not use your health information for advertising.

 

4. Results summaries made with AI

After your tests, our app can produce a written summary of your results using an AI service.

The AI service is provided by OpenAI. We send it your test report files only to produce your summary, we have set it not to save those requests, and OpenAI does not use them to train its models.

These summaries are for general wellness information. They are not a diagnosis and are not medical advice; please discuss your results with your own doctor.

 

5. Who we share information with

We share information only with:

  • Our staff, who need it to run your test and give you your results.

  • Service providers who run parts of our service for us, only for that purpose:

    • athenahealth, our medical records and billing system;

    • Amazon Web Services, which hosts our booking and results app and its database, stores your report files and sends our emails and text messages, under a HIPAA agreement with Amazon;

    • OpenAI, which prepares results summaries (section 4);

    • Google Workspace, which runs our email inbox;

    • Stripe, which processes card payments;

    • Google Firebase, which sends app notifications (they never include test names or results);

    • Wix, which hosts our website and its contact forms, and AudioEye, which provides its accessibility tools.

    We require providers that handle health information to protect it, and we are putting HIPAA business associate agreements in place with each of them.

  • Your health insurer, if you use insurance, to bill for your test.

  • Others you ask us to share with, such as your doctor or trainer.

  • Authorities, when the law requires it.

  • A buyer, if our business is sold or merged; we would tell you first.

We do not share your information with advertising companies such as Meta (Facebook, Instagram) or Google.

 

6. Cookies and tracking

Our website and app do not use advertising or analytics trackers. We use only the cookies needed for the site and app to work, such as keeping you signed in. Our website host, Wix, sets its own essential cookies to run the site.

We do not use geofencing: we never track your location around a health facility to show you ads or send you messages.

 

7. Text messages (SMS)

When you give us a mobile number to sign up or to change your number, we text you a one-time verification code from our toll-free number. We send a code only when you ask for one. Message frequency varies. Message and data rates may apply. Reply STOP to stop texts or HELP for help, or contact us at hello@belmarcardio.org or (253) 256-2809. Full terms: www.bcdctesting.com/sms-terms.

We do not sell, rent or share your mobile number with third parties or affiliates for their marketing or promotional purposes. Your consent to receive texts, and the information about when you gave it, are not shared with anyone except the provider that delivers the texts for us (Amazon Web Services).

 

8. Washington residents

Washington's My Health My Data Act protects health data that is not covered by HIPAA, such as information from website visits or questions sent before you become a patient. Our Consumer Health Data Privacy Policy (www.bcdctesting.com/consumer-health-data) explains how we handle it and your rights.

 

9. Your choices and rights

You can ask us, at any time, to:

  • give you a copy of your information and results;

  • correct information that is wrong;

  • delete your account and information, except records the law requires us to keep;

  • stop marketing emails (use the unsubscribe link), push notifications (in your phone settings) or text messages (reply STOP).

Your rights over your health information under HIPAA are in our Notice of Privacy Practices (www.bcdctesting.com/notice-of-privacy-practices). Email hello@belmarcardio.org or call (253) 256-2809. We may need to confirm who you are first.

 

10. How long we keep information

We keep test results and appointment records for as long as Washington law requires us to keep health records, and other information only as long as we need it for the purposes above.

 

11. Security

We use encrypted connections (HTTPS), store passwords encrypted, limit access to the staff who need it and sign staff out automatically after 15 minutes of inactivity. No system is perfectly secure. If something goes wrong that affects your information, we will tell you as the law requires. If you think your account has been misused, contact us straight away.

 

12. Children

Our services are for adults 18 and over. We do not knowingly collect information from children. If you believe a child has given us information, contact us and we will delete it.

 

13. Links to other sites

Our website links to other sites, such as app stores and our referral partners. Their own privacy policies apply there.

 

14. Changes

We may update this policy. We will change the effective date above and, for important changes, tell you by email or in the app.

 

15. Contact

Belmar Cardiopulmonary Diagnostics PLLC, 520 112th Ave NE #110, Bellevue, WA 98004

hello@belmarcardio.org · (253) 256-2809

Privacy Officer: George Earley

bottom of page