WEBSITE PRIVACY POLICY

A. Information You Provide Directly

We may collect information you voluntarily provide, including:

• your name;
• email address;
• phone number;
• mailing address;
• preferred appointment date or location;
• information you enter into contact forms, scheduling requests, intake forms, support forms, or chatbot messages;
• communications you send to us;
• insurance-related or service-interest information you choose to provide; and
• any other information you submit through the Site.

Please do not send highly sensitive medical details through general contact forms unless the Site specifically indicates that the form is intended for such use and protected accordingly.

B. Health-Related or Patient Inquiry Information

Depending on the Site feature you use, we may collect health-related information or other information you provide in connection with scheduling, service inquiries, treatment inquiries, care coordination, or chatbot interactions. Where required, we treat such information in accordance with applicable law, including HIPAA where applicable.

C. Automatically Collected Information

When you use the Site, we and our service providers may automatically collect certain technical and usage information, such as:

• IP address;
• browser type and version;
• device type and operating system;
• date and time of access;
• pages viewed and navigation path;
• referring URLs;
• approximate geolocation derived from IP address;
• interactions with Site features; and
• similar diagnostic, analytics, and security information.

D. Cookies and Similar Technologies

We may use cookies, pixels, local storage, tags, scripts, and similar technologies to operate, secure, remember preferences, measure performance, and improve the Site. For healthcare-related pages, forms, authenticated areas, chatbot flows, scheduling pages, or other pages that may involve health-related information, we may limit or disable tracking technologies where needed to avoid impermissible collection, disclosure, or use of sensitive information.

E. Information from Third Parties

We may receive information from third parties such as:

• appointment or scheduling providers;
• website hosting providers;
• analytics providers;
• customer support vendors;
• email or communication platforms;
• referral sources; and
• advertising, social media, or directory platforms,
• subject to applicable law and the settings and permissions of those platforms.

We may use information collected through the Site to:

• operate, maintain, secure, and improve the Site;
• respond to your inquiries and requests;
• schedule or coordinate appointments;
• provide requested information about our practice and services;
• communicate with you regarding your inquiry, appointment request, or requested service;
• personalize content in a general, non-patient-specific way;
• analyze usage trends and improve Site performance, service descriptions, and educational content;
• detect, investigate, and prevent fraud, abuse, security incidents, and unlawful activity;
• comply with legal, regulatory, and professional obligations;
• maintain records related to communications and Site operations; and
• send newsletters, updates, or marketing messages where permitted by law and according to your choices.

We do not use individually identifiable health information collected through the Site for ad targeting, remarketing, lookalike audiences, or similar advertising uses where prohibited by law.

If applicable law requires us to identify a legal basis for processing personal information, we may process information on one or more of the following grounds:

• your consent;
• performance of requested services or steps taken at your request;
• our legitimate interests in operating and improving the Site, provided those interests are not overridden by applicable privacy rights;
• compliance with legal obligations; and
• protection of vital interests or public health, where applicable.

We may disclose information as follows:

A. Service Providers and Contractors

We may disclose information to vendors, contractors, consultants, and service providers who perform services for us, including website hosting, cloud storage, chatbot support, scheduling support, analytics, security, communications, maintenance, and professional advisory services. When required, we require such parties to protect information appropriately and, where applicable, to enter into a business associate agreement or other appropriate contractual arrangement.

B. Within Our Practice and Affiliated Operations

We may share information with our workforce, affiliated entities, or professional advisors as reasonably necessary to operate the practice, provide requested services, manage communications, or comply with law.

C. Business Transfers

We may disclose information in connection with an actual or proposed merger, acquisition, financing, reorganization, sale of assets, bankruptcy, or similar corporate transaction, subject to applicable confidentiality and legal requirements.

D. Legal and Safety Disclosures

We may disclose information when we believe in good faith that disclosure is necessary to:

• comply with law, regulation, court order, subpoena, or legal process;
• enforce our rights or agreements;
• protect the rights, safety, or property of the Practice, our patients, users, or others; or
• investigate fraud, security, or technical issues.

E. With Your Direction or Consent

We may disclose information with your consent, at your direction, or as otherwise permitted or required by law.

Our HIPAA Notice of Privacy Practices explains:

• how we may use and disclose your protected health information;
• your rights regarding your protected health information; and
• our duties under HIPAA.

Our Notice of Privacy Practices is separate from this Privacy Policy and is available at: https://dr.nyc/hipaa-notice-of-privacy-practices/.

If the Site includes a chatbot, scheduling assistant, appointment request form, intake form, or similar feature:

• information you submit may be stored and reviewed by us or our authorized service providers;
• such tools may be used to respond to questions, route inquiries, support scheduling, improve service information, and prepare internal operational reports;
• where applicable, health-related information submitted through such tools may be handled under HIPAA and related contractual safeguards;
• we may use aggregated or de-identified insights from inquiries to improve website content, FAQs, service descriptions, and operational planning; and
• we do not intentionally use identifiable health-related submissions for individualized public ad targeting or impermissible third-party tracking.

We may use essential cookies and similar technologies necessary to operate and secure the Site. We may also use analytics or performance tools to understand general site usage, improve content, and maintain functionality.

For healthcare-related webpages or workflows that may involve health-related information, we may restrict, disable, or carefully configure analytics, advertising, session replay, or similar tracking technologies to avoid impermissible disclosure of sensitive information. We do not permit third-party tracking technologies on sensitive flows in a manner inconsistent with applicable law.

You can adjust cookie settings through your browser controls. Some Site features may not function properly if certain cookies are disabled.

Optional Cookie Notice Language: If required by applicable law, we will provide cookie notices or consent tools for non-essential cookies.

We may send you newsletters, updates, educational content, event announcements, or service-related communications if you sign up or otherwise permit us to do so. You may opt out of marketing emails by using the unsubscribe link in the message or contacting us using the information below. We may still send transactional or service-related communications where appropriate.

We retain information for as long as reasonably necessary for the purposes described in this Privacy Policy, including to:

• respond to inquiries;
• provide services;
• maintain records;
• comply with legal, regulatory, tax, accounting, security, and reporting obligations;
• resolve disputes; and
• enforce agreements.

Where required, we will retain and dispose of protected health information in accordance with HIPAA and other applicable legal obligations.

We use reasonable administrative, technical, and physical safeguards designed to protect personal information and, where applicable, protected health information. These may include role-based access controls, secure hosting environments, encryption or secure transmission where appropriate, backup procedures, vendor controls, logging, and incident response procedures.

However, no website, database, transmission, or storage system can be guaranteed 100% secure. You use the Site at your own risk.

Depending on your location and applicable law, you may have rights regarding your personal information, such as the right to:

• know what categories of personal information we collect;
• request access to certain personal information;
• request correction of inaccurate information;
• request deletion of certain information;
• opt out of certain marketing communications;
• limit certain uses of sensitive information where required by law; and
• appeal certain privacy-rights decisions, where required.

If you are a patient of a HIPAA-covered provider, your rights regarding protected health information are described in our Notice of Privacy Practices and applicable law.

To exercise applicable privacy rights, contact us using the information in Section 17.

Residents of certain states may have additional rights under applicable state privacy laws. If required, we may provide a separate state privacy addendum describing state-specific rights, categories of information collected, categories of disclosures, and methods for exercising those rights.

The Site is not directed to children under 13 unless expressly stated. We do not knowingly collect personal information directly from children under 13 through the Site without appropriate legal basis. If you believe a child has submitted personal information through the Site, please contact us so we can review and address the issue.

The Site is intended for users in the United States unless otherwise stated. If you access the Site from outside the United States, your information may be transferred to, stored in, and processed in the United States or other jurisdictions where our service providers operate, subject to applicable law.

The Site may contain links to third-party websites, maps, social media pages, scheduling tools, patient portals, payment processors, or other services that are not governed by this Privacy Policy. We are not responsible for the privacy, security, or content practices of third-party services, and you should review their terms and privacy notices.

If you have questions about this Privacy Policy or wish to make a privacy-related request, contact us at:

Questions about our HIPAA Notice of Privacy Practices may also be directed to our privacy officer at: innovations@dr.nyc.

We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last Updated" date and take any additional steps required by law. Your continued use of the Site after changes become effective constitutes acceptance of the updated Privacy Policy, to the extent permitted by law.