Security and HIPAA stance
In short: our marketing sites and ads are designed not to collect protected health information (PHI). We are not a HIPAA-covered entity, and we don't sign BAAs for marketing pages because PHI should never reach them.
What we do
- Forms ask only for name and contact details, with a "please don't include health information" note.
- No PHI is sent to Google Analytics, Google Ads or Meta. We avoid tracking on sensitive pages, following HHS guidance on tracking technologies.
- Online intake and booking link to a HIPAA-ready tool your practice already uses.
- HTTPS on every page, security headers, automatic updates and offsite backups.
- Least-privilege access: we use manager access to your accounts, with 2-factor login.
Healthcare ads
We follow Google's healthcare and medicines policies and personalized-ads restrictions. We don't target ads based on health conditions.
Your responsibilities
Your practice chooses and contracts its intake, EHR and scheduling tools, and its HIPAA compliance program.
This page is general information, not legal advice.