Privacy Policy

1. Information We Collect

1.1 Personal Information You Provide

We collect personal information that you voluntarily provide when you:

• Schedule an appointment or consultation
• Complete contact forms on our website
• Sign up for our newsletter or promotions
• Participate in surveys or provide feedback
• Communicate with us via email, phone, or in person

This information may include:

• Contact information (name, email, phone, address)
• Demographic information (age, gender)
• Medical history and health information
• Payment information
• Insurance information

1.2 Automatically Collected Information

When you visit our website, we automatically collect certain information, including:

• IP address and device information
• Browser type and operating system
• Pages visited and time spent on pages
• Referring website or search terms
• Clickstream data

1.3 Protected Health Information (PHI)

As a healthcare provider, we collect and maintain Protected Health Information as defined by HIPAA, including:

• Medical records and treatment history
• Laboratory and test results
• Treatment plans and progress notes
• Billing and insurance information

2. How We Use Your Information

2.1 Primary Uses

We use your information for the following purposes:

2.2 Communication

We may use your contact information to:

• Send appointment reminders and confirmations
• Provide treatment follow-up information
• Respond to your inquiries and requests
• Send practice updates and newsletters (with consent)
• Inform you about new services or promotions

2.3 Legal Basis for Processing

We process your personal information based on:

• Consent: When you have given clear consent
• Contract: To fulfill our obligations to you
• Legal Obligation: To comply with laws and regulations
• Legitimate Interests: For our legitimate business interests
• Vital Interests: To protect your vital interests

3. Information Sharing and Disclosure

3.1 When We Share Information

We may share your information in the following circumstances:

3.2 Third-Party Service Providers

We work with third-party service providers who help us operate our practice, including:

• Electronic medical records systems
• Billing and payment processors
• Website hosting and analytics providers
• Marketing and communication services
• Appointment scheduling software

These providers are contractually obligated to protect your information and use it only for the purposes we specify.

3.3 What We Do NOT Do

4. Data Security

4.1 Security Measures

We employ the following security measures:

• Encryption of sensitive data in transit and at rest
• Secure servers with firewalls and intrusion detection
• Regular security assessments and audits
• Employee training on privacy and security
• Access controls and authentication protocols
• Physical security measures at our facilities

4.2 HIPAA Compliance

As a covered entity under HIPAA, we:

• Implement administrative, physical, and technical safeguards
• Conduct regular risk assessments
• Maintain Business Associate Agreements with third parties
• Provide HIPAA training to all employees
• Maintain Notice of Privacy Practices

4.3 Incident Response

In the event of a data breach, we will:

1. Immediately investigate and contain the breach
2. Notify affected individuals as required by law
3. Report to appropriate regulatory authorities
4. Take steps to prevent future breaches

5. Your Rights and Choices

5.1 Your Privacy Rights

Depending on your location and applicable laws, you may have the following rights regarding your personal information:

5.2 HIPAA Rights

Under HIPAA, you have specific rights regarding your Protected Health Information:

• Right to receive our Notice of Privacy Practices
• Right to access and obtain copies of your medical records
• Right to request amendments to your medical records
• Right to an accounting of disclosures
• Right to request restrictions on certain uses and disclosures
• Right to request confidential communications
• Right to file a complaint about privacy practices

5.3 Exercising Your Rights

To exercise any of these rights, please contact us using the information in Section 10. We may require verification of your identity before processing your request.

6. Cookies and Tracking Technologies

6.1 What Are Cookies?

Cookies are small text files placed on your device when you visit our website. They help us provide a better user experience and understand how visitors use our site.

6.2 Types of Cookies We Use

6.3 Cookie Management

You can control cookies through your browser settings. Most browsers allow you to:

• View what cookies are stored on your device
• Delete cookies individually or all at once
• Block cookies from specific sites or all sites
• Set preferences for different types of cookies

Please note that disabling certain cookies may affect the functionality of our website.

6.4 Do Not Track Signals

Some browsers have a "Do Not Track" feature that lets you tell websites that you do not want to have your online activities tracked. We currently do not respond to "Do Not Track" signals.

7. Children's Privacy

7.1 Minors and Medical Treatment

For medical treatment of minors, we:

• Require parental or guardian consent for treatment
• Collect information from parents or guardians
• Provide treatment information to parents or guardians
• Comply with state laws regarding minor consent

7.2 Parental Rights

Parents or guardians of minors have the right to:

• Access their child's medical records
• Request corrections to their child's records
• Make treatment decisions for their child
• Request restrictions on information sharing

If you believe we may have collected information from a child under 13, please contact us immediately.

8. Data Retention

8.1 Retention Periods

We retain your information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

8.2 Data Disposal

When information is no longer needed, we securely dispose of it using methods such as:

• Secure shredding of paper records
• Digital wiping of electronic media
• Professional destruction services
• Secure deletion from databases

9. International Data Transfers

9.1 Data Location

Grace Glow is based in the United States, and we process and store information in the United States. If you are located outside the United States, please be aware that information we collect will be transferred to and processed in the United States.

9.2 Cross-Border Transfers

We may transfer your information to service providers or partners in other countries. When we do so, we ensure appropriate safeguards are in place, such as:

• Standard contractual clauses
• Privacy Shield certification (where applicable)
• Adequacy decisions
• Binding corporate rules

9.3 Your Consent

By using our website or services, you consent to the transfer, processing, and storage of your information in the United States and other countries where our service providers operate.

10. Policy Updates and Contact Information

10.1 Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by:

• Posting the updated policy on our website with a new "Last Updated" date
• Notifying current patients via email or other appropriate means
• Providing notice in our office

10.2 Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

10.3 Filing a Complaint

If you believe your privacy rights have been violated, you may file a complaint with:

• Our Privacy Officer at the contact information above
• The U.S. Department of Health and Human Services Office for Civil Rights
• Your state's medical board or privacy enforcement agency