🍃 Spring Specials! 🍃 Get $40 OFF DEXA Scan – Click here & get the most precise health insights. All services are HSA/FSA eligible.
DEXA Lab Philly
261 Old York Road, Suite 524, Jenkintown, PA 19046
Effective Date: June 10, 2026
IMPORTANT NOTICE REGARDING YOUR HEALTH DATA: DEXA Lab Philly is NOT a “covered entity” under HIPAA and is not legally required to provide a HIPAA Notice of Privacy Practices. We are regulated by the Federal Trade Commission and are subject to the FTC Health Breach Notification Rule (16 C.F.R. Part 318), as updated in 2024. As a voluntary commitment to our clients, we apply privacy and security standards equivalent to those required of HIPAA-covered entities. This Privacy Policy explains both our legal obligations and our voluntary commitments in detail. Please read it carefully.
DEXA Lab Philly (“DEXA Lab Philly,” “we,” “us,” or “our”) is a trade name of Spartan Kismet LLC, a New Jersey limited liability company. We operate a body composition scanning and wellness diagnostics facility located at 261 Old York Road, Suite 524, Jenkintown, PA 19046.
We are not a “covered entity” under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). A covered entity must be a healthcare provider that transmits health information electronically in connection with standard HIPAA transactions (such as insurance billing), a health plan, or a healthcare clearinghouse. Because we do not bill health insurance, do not operate a health plan, and do not function as a clearinghouse, HIPAA’s mandatory requirements do not apply to us as a matter of law.
This means that clients cannot file a HIPAA complaint with the U.S. Department of Health and Human Services Office for Civil Rights (“OCR”) regarding our data practices. Our primary regulatory authority is the Federal Trade Commission (“FTC”), and we are subject to the FTC Act and the FTC Health Breach Notification Rule, 16 C.F.R. Part 318, as updated in 2024.
Although we are not legally required to comply with HIPAA, we voluntarily apply equivalent privacy and security standards as a matter of professional responsibility and our commitment to protecting your sensitive health information. Those voluntary commitments are detailed in Section 6.
This Privacy Policy describes how we collect, use, store, share, and protect your personal information and sensitive health data when you:
By using our services, visiting our facility, booking an appointment, or providing us with your information, you acknowledge that you have read and understand this Privacy Policy.
We collect the following personal information directly from you:
As a health and wellness diagnostics provider, we collect sensitive health-related information, including but not limited to:
DEXA Lab Philly does not use photographs, biometric measurements, or scan data for the purpose of unique automated facial recognition, identity verification, or biometric identification under state biometric privacy statutes. We do not apply software or services that extract facial geometry, skeletal vectors, anatomical landmarks, or other biometric identifiers from your photographs or scans for the purpose of identifying or verifying an individual, and we do not provide such data to any third party for those purposes.
When you visit our website, use our booking platform, or access our mobile application or web portal, we may automatically collect:
We retain records of:
We use the information we collect for the following purposes:
We do not sell your personal information or sensitive health data. We may share your information in the following limited circumstances:
We use third-party vendors to operate our business. These vendors may have access to your personal information solely to perform services on our behalf and are contractually prohibited from using it for any other purpose. Our key service providers include:
We may disclose your information if required by law, regulation, court order, or governmental request, including but not limited to:
In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or substantially all of our assets, your personal information and health data may be transferred to the acquiring entity, subject to the same privacy protections described in this Policy and applicable law. We will notify you of any such transfer before your data is subject to a materially different privacy policy.
We may share your information with other parties when you provide explicit, written consent (e.g., releasing scan results to your physician, personal trainer, or nutritionist at your request).
We do not currently use, sell, license, or share de-identified or aggregated versions of your health or body composition data for research, benchmarking, publication, or commercial purposes. If this practice changes in the future, we will update this Privacy Policy and seek your affirmative written consent before your data is used in any such manner.
As described in Section 1.1, DEXA Lab Philly is not a HIPAA-covered entity and is not legally required to issue a HIPAA Notice of Privacy Practices. We are regulated by the Federal Trade Commission under Section 5 of the FTC Act (15 U.S.C. § 45) and the FTC Health Breach Notification Rule, 16 C.F.R. Part 318, as amended.
We believe transparency about our regulatory status is essential. Some body composition and wellness facilities invoke HIPAA protections without establishing that they are legally subject to the law. We will not do that. Instead, we describe below (a) the laws that actually apply to us, and (b) the voluntary standards we have adopted that go beyond what is legally required.
The FTC Health Breach Notification Rule (16 C.F.R. Part 318), as significantly updated and expanded by the FTC in 2024, applies to us as a vendor of “personal health records” — electronic records of identifiable health information that can be drawn from multiple sources and that are managed, shared, or controlled by or primarily for the individual. We believe our client records, including DEXA scan results, biometric data, and health history, meet this definition.
Consistent with current FTC guidance, we do not apply a “harm threshold” to determine whether a breach has occurred or whether you must be notified. We do not self-assess whether an incident poses a significant risk of financial, reputational, or other harm to you as a precondition to treating it as a breach or to providing notification. Any unauthorized acquisition of, access to, or disclosure of your identifiable health information is treated as a breach of security under the Rule, and an unauthorized disclosure of identifiable health information to a third-party advertising network, analytics provider, data broker, or similar platform — including through cookies, tracking pixels, software development kits (SDKs), or comparable technologies — is a breach of security regardless of our assessment of the resulting risk of harm. We treat a “breach of security” under the Rule as including, without limitation:
To file a complaint about our data practices, you may contact the Federal Trade Commission at www.ftc.gov/complaint or call 1-877-FTC-HELP (1-877-382-4357).
Although HIPAA does not legally bind us, we voluntarily commit to the following standards, which are equivalent to or more protective than HIPAA’s Privacy and Security Rules:
We use and disclose your health data for the following purposes without requiring your separate written consent:
We will obtain your written consent before using or disclosing your health data for purposes other than those described above, including:
You may revoke any written consent at any time by contacting our Privacy Officer. Revocation is not retroactive and does not affect actions we have already taken in reliance on your consent.
As a voluntary commitment, we extend to our clients the following rights, modeled on those required by HIPAA for covered entities. These are voluntary commitments, not legally mandated rights under HIPAA. To exercise any of these rights, contact our Privacy Officer (Section 6.7).
To exercise any of these rights, or for questions about our privacy practices, contact our Privacy Officer:
Privacy Officer
DEXA Lab Philly (Spartan Kismet LLC)
261 Old York Road, Suite 524
Jenkintown, PA 19046
Email: privacy@dexalabphilly.com
Phone: +1 213-447-6112
Your personal information and health data are stored across the following systems:
We implement administrative, technical, and physical safeguards to protect your information, including:
We deliver your scan results by email as PDF attachments. Because standard email is not inherently secure, we apply the following specific controls for result delivery:
We retain your information for the following periods:
We take your communication preferences seriously and comply with all applicable laws governing marketing communications.
We may send you text messages for two purposes:
Your consent to receive marketing text messages is not a condition of purchasing any services from us. You may opt out of marketing text messages at any time by replying STOP to any message. Standard message and data rates may apply. Message frequency varies.
We may send you promotional emails if you have opted in to receive them. All marketing emails comply with the CAN-SPAM Act (15 U.S.C. § 7701 et seq.) and include:
Transactional emails (appointment confirmations, scan results, account notifications) are not marketing communications and will continue to be sent regardless of your marketing email preferences.
Our marketing communications are managed through GoHighLevel, a cloud-based CRM and marketing automation platform. GoHighLevel stores your contact information, communication preferences, opt-in/opt-out status, and communication history. We maintain a data processing agreement with GoHighLevel requiring it to protect your data in accordance with applicable law.
GoHighLevel’s own privacy policy governs its internal data handling practices; however, we remain responsible for the data we entrust to them and require them to safeguard it accordingly.
Our website uses cookies and similar tracking technologies to:
You can control cookies through your browser settings. Disabling cookies may affect website functionality, including the ability to book appointments online.
We are aware that the FTC has explicitly identified the sharing of health data with advertising platforms via tracking pixels — without affirmative user authorization — as a breach of security under the Health Breach Notification Rule (see Section 6.2). Consistent with that position, we take the following steps to prevent your health data from reaching advertising or analytics platforms:
We periodically review our use of tracking technologies to assess whether they create risks to your privacy. If we determine that a particular tool cannot be configured in a manner consistent with our privacy commitments, we will discontinue its use on sensitive pages.
Your rights regarding personal data vary depending on your state of residence. This section describes your rights under Pennsylvania law and addresses the rights of residents of states with comprehensive consumer privacy laws — including New Jersey and Delaware — whose data may be subject to their home-state privacy statutes. Where a comprehensive state privacy law applies to our processing of your personal data, the rights described below are statutory mandates that we honor in strict accordance with that state’s legal framework, and not merely voluntary commitments. We separately extend certain voluntary protections to all clients, regardless of residence, as described in Section 10.5; those voluntary commitments supplement, and do not limit, any statutory rights you hold under the law of your state of residence.
Under 73 Pa. Stat. § 2303, if we discover a breach of your unencrypted, computerized personal information (defined as your name in combination with your Social Security number, driver’s license number, or financial account number), we will notify you without unreasonable delay. We will also notify the Pennsylvania Attorney General if the breach affects more than 500 Pennsylvania residents.
Pennsylvania is a two-party consent state for recording of oral, wire, and electronic communications (18 Pa.C.S. § 5704). We do not record telephone calls without your knowledge and consent. If we implement call recording in the future, we will obtain your consent before recording.
The New Jersey Data Protection Act (P.L. 2023, c. 266) (the “NJDPA,” also referred to as the New Jersey Privacy Act), effective January 15, 2025, grants residents of New Jersey specific statutory rights with respect to their personal data. Our connection to New Jersey is substantial: DEXA Lab Philly is a trade name of Spartan Kismet LLC, a limited liability company organized under the laws of the State of New Jersey, and our facility in Jenkintown, Pennsylvania sits immediately across the state line and is routinely used by New Jersey residents, including daily commuters. For these reasons, we recognize that our processing of personal data may fall within the scope of the NJDPA, and that New Jersey residents who are our clients hold statutory rights under the NJDPA regardless of where the service is performed. Where the NJDPA applies, we honor these rights as legal obligations, in strict accordance with the statute and its implementing regulations, and not as discretionary or voluntary perks.
Where the NJDPA applies to our processing, the following are statutory rights that we honor as legal mandates, in strict accordance with the NJDPA — not voluntary perks. In addition, and as a matter of caution and respect for our clients’ privacy, we extend the same rights to all New Jersey residents who are our clients even where a statutory threshold may not be met in a particular case:
To exercise these rights, New Jersey residents may contact our Privacy Officer (Section 6.7). We will respond to verified requests within 45 days of receipt. Where reasonably necessary, we may extend our response period by an additional 45 days and will notify you of any such extension. If we decline a request, we will provide a written explanation. You may appeal a denial by resubmitting your request in writing marked “Appeal” to our Privacy Officer, and unresolved appeals may be directed to the New Jersey Division of Consumer Affairs.
The Delaware Personal Data Privacy Act (Del. Code tit. 6, Ch. 35C) (“DPDPA”), effective January 1, 2025, grants Delaware residents rights substantially similar to those described in Section 10.3 for New Jersey residents, including rights of access, correction, deletion, data portability, and opt-out from targeted advertising and data sales. We voluntarily commit to honoring these rights for Delaware residents who are our clients.
As comprehensive consumer privacy laws continue to be enacted and updated across the United States, we will update this Policy and our internal practices to honor the statutory rights of residents of additional states. Residents of any state with a comprehensive consumer privacy law who wish to exercise rights under that law may contact our Privacy Officer; we will make reasonable efforts to respond in a manner consistent with applicable requirements.
Pennsylvania does not currently have a comprehensive consumer privacy statute granting a general right to deletion of personal data. Accordingly, no statutory deletion right applies under Pennsylvania law at this time.
However, as a voluntary commitment to all of our clients regardless of state of residence, you may contact our Privacy Officer to request deletion of personal information we hold about you. We will honor such requests within 30 days where legally permissible, subject to the following limitations:
Our services are generally intended for individuals aged 18 and older. We do not knowingly collect personal information from children under the age of 13 without verified parental consent. If a minor between the ages of 13 and 17 wishes to use our services, a parent or legal guardian must provide consent, be present during the appointment, and sign all required intake and consent forms.
If we learn that we have collected personal information from a child under 13 without proper parental consent, we will promptly delete that information. If you believe we have inadvertently collected information from a child, please contact us immediately.
Our website and communications may contain links to third-party websites, applications, or services that are not operated by us. This Privacy Policy does not apply to those third-party services. We encourage you to review the privacy policies of any third-party service you access through our website or communications. We are not responsible for the data practices of third parties.
Some browsers offer a “Do Not Track” (DNT) feature. There is currently no uniform standard for responding to DNT signals. We do not currently respond to DNT signals, but we will update this policy if a standard is adopted.
We reserve the right to modify this Privacy Policy at any time. If we make material changes, we will notify you by posting the updated policy on our website with a revised effective date, and, where required by law or where the changes affect how we use your health data, we will provide you with direct notice via email or in-person notice at our facility.
Your continued use of our services after such changes constitutes acceptance of the updated policy. If you do not agree to the updated policy, you should discontinue use of our services and contact our Privacy Officer to exercise any applicable rights regarding your existing data.
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
261 Old York Road, Suite 524
Jenkintown, PA 19046
Email: privacy@dexalabphilly.com
Phone: +1 213-447-6112
Website: www.dexalabphilly.com
