Website Privacy Policy

Scope

This policy describes how this website ("the Site"), operated by [Practice Legal Name] ("we," "us"), handles information collected through the Site itself. It does not govern clinical records: protected health information created in the course of treatment is governed by our HIPAA Notice of Privacy Practices, which controls if the two documents conflict with respect to protected health information.

Information we collect through the Site

• Contact form submissions. Name, phone number, email address, and the message you write. This information is transmitted over an encrypted connection and delivered by email to the address this practice uses for inquiries. [Name the third-party services a submission actually passes through, and say plainly whether each is covered by a Business Associate Agreement. As this site ships, the form is handled by a Cloudflare Pages Function and sent through the Resend email API to whichever mailbox you set as CONTACT_TO_EMAIL — so a message transits at least two outside vendors before it reaches you, and the receiving mailbox provider is a third. Disclose that, or route the form through a BAA-covered path and describe that instead. Do not describe an office, a front desk, or staff receiving these messages unless the practice has them.] Please do not include detailed clinical information in the form.
• Technical data. Our hosting provider [Name the company that will actually host the finished site, and confirm it before launch rather than assuming. This template is built for Cloudflare Pages, but if you deploy to Netlify, Vercel, a practice-website vendor, or a managed host, name that one. Whoever it is receives every visitor's IP address, which is why the visitor is told who they are.] processes IP addresses and request logs as necessary to serve and secure the Site.
• Analytics. [State what you actually run. If you enable Cloudflare Web Analytics: "We use Cloudflare Web Analytics, a privacy-focused tool that does not use cookies or track users across sites." If you run nothing, say "This Site does not use analytics." Do NOT add Google Analytics, Meta Pixel, or similar ad-tech to a healthcare site without specific legal advice — federal regulators have treated tracking technologies on provider websites as a HIPAA issue.]

Cookies

[If the finished site sets no cookies — true of this template as shipped — say so: "This Site does not set cookies." Update if you add tools that do.]

How we use information

We use contact form information solely to respond to your inquiry and, if you become a patient, to begin the intake process. We do not sell personal information, share it with advertisers, or use it for marketing without your consent.

How long we keep it

[e.g. "Contact form messages from people who do not become patients are deleted within X months. Messages from patients become part of the clinical record and follow medical-record retention law."]

Your choices and rights

You may contact us at [Practice contact email — use a practice address you control, not a university address, since institutional email is subject to that institution's own policies and records rules] to ask what information we hold from your use of the Site, or to request correction or deletion, subject to legal record-keeping obligations. [Add state-specific privacy rights language if required — e.g. CCPA/CPRA notice for California practices above the threshold, though most solo practices are below it. Counsel will advise.]

Children

The Site is not directed to children under 13, and we do not knowingly collect their information through it.

Changes

We may update this policy; the effective date above reflects the current version. Material changes will be noted on this page.

Contact

[Practice Legal Name — the entity that operates the practice, e.g. a professional corporation; usually not simply your personal name]
[Mailing address for the entity — the same address used in the HIPAA Notice and Terms, so the three documents agree]
[Practice phone number a visitor can actually reach — a dedicated practice line or answering service, not a personal mobile] · [Practice contact email — the same practice-controlled address named above, not a university address]