Effective date: [EFFECTIVE DATE]
Last updated: [LAST UPDATED DATE]
Summary and important notice
This website is a marketing and information website. It is not a medical record system and is not designed to receive health information. Please do not send us medical history, symptoms, medications, lab results, photos or other health details through this website, its forms, chat, email links or social media.
If you become a patient, your health information is collected only through our separate secure patient portal and electronic medical record system. That information is handled under our Notice of Privacy Practices and, where it applies, the Health Insurance Portability and Accountability Act (HIPAA). This Privacy Policy does not cover the patient portal.
In short:
- What we collect here: basic contact details you choose to give us (such as name, email, phone), payment details processed by our payment provider, and standard technical data (such as device, browser and pages viewed).
- What we do with it: respond to you, help you get started, run memberships and billing, send messages you agree to receive, and improve the website.
- What we never do: sell your personal information, or share your mobile number or text-message consent with third parties for their own marketing.
- Your choices: you can unsubscribe, opt out of texts, adjust cookies, and ask to access or delete your information by contacting us at care@orahealthmd.com.
1. Who we are and what this policy covers
This Privacy Policy explains how Ora Health MD, LLC (the "Company") and Ora Health MD, PLLC doing business as Ora Health MD (the "Practice") (together, "Ora Health MD," "we," "us" or "our") collect, use and share information through orahealthmd.com and any pages, forms, emails or text messages that link to this policy (the "Website").
The Company operates the Website, marketing, memberships and billing support. The Practice is the medical practice. All medical care is provided by licensed clinicians of the Practice, and only after you create a patient account in our patient portal.
By using the Website, you agree to this Privacy Policy and our Terms of Service. If you do not agree, please do not use the Website.
2. How this policy relates to HIPAA
The Website is not part of our medical records system, and information you submit through the Website is not treated as protected health information (PHI) under HIPAA, except where the law requires otherwise.
- Patient portal and medical records. Health information you provide during intake, in visits, in messages with your care team, or for prescriptions is collected inside our secure patient portal and electronic medical record system, operated by a third-party vendor under a business associate agreement where required. That information is governed by our Notice of Privacy Practices, not this policy.
- Information you send through the Website. Our forms are built to collect contact details only. If you choose to include health information anyway (for example, in a free-text box, an email or a social media message), you understand that the Website and those channels are not designed to protect health information to HIPAA standards. We will not use that information for marketing. Where we can, we will delete it from the Website systems or move it into your secure patient record.
- Becoming a patient. Visiting the Website, joining an email list, paying for a membership or booking an introductory call does not by itself create a doctor–patient relationship. That relationship begins only when a Practice clinician accepts you as a patient.
- Not medical advice. Content on the Website is general information, not medical advice. In an emergency, call 911.
If any part of this policy conflicts with our Notice of Privacy Practices about health information in your medical record, the Notice of Privacy Practices controls.
3. Information we collect
Information you give us
| Category | Examples | When |
|---|---|---|
| Contact details | Name, email, phone number, city or ZIP code, state of residence | Contact, waitlist or booking forms; newsletter sign-up |
| Account and membership details | Membership plan, start and renewal dates, billing address | When you join a membership |
| Payment information | Card details | Entered directly with our payment processor (for example, Stripe); we do not store full card numbers |
| Communications | Messages you send us, call notes about scheduling or billing | When you email, call, text or message us |
| Marketing preferences | Email and text-message consent, unsubscribe status | When you opt in or out |
| Reviews and feedback | Testimonials or survey answers you choose to provide | Only with your separate written permission for any public use |
Information collected automatically
- Device and usage data: IP address, browser type, device type, operating system, referring page, pages viewed, time on page, and approximate location (city or state) derived from IP address.
- Cookies and similar technologies: see Section 5.
Information from others
- Scheduling, payment, email and text-message providers that help us run the Website.
- Advertising and social media platforms (for example, that you clicked one of our ads), subject to Section 5.
- Someone who refers you to us, if you were referred.
Information we do not want through the Website: medical conditions, symptoms, medications, treatment goals, lab results, photos of your body, insurance member IDs, Social Security numbers or government ID numbers. These are collected only inside the secure patient portal when needed.
4. How we use information
We use the information described above to:
- Respond to questions and schedule introductory or onboarding calls.
- Invite you to create a patient portal account when you choose to become a patient.
- Process membership payments, renewals, refunds and receipts.
- Send service messages (confirmations, reminders, billing notices, policy updates).
- Send marketing emails and texts, only with any consent the law requires, and honor your opt-outs.
- Operate, secure, debug and improve the Website, including preventing fraud and abuse.
- Measure the performance of our marketing in a way that does not use health information (see Section 5).
- Comply with law, enforce our Terms of Service, and protect the rights and safety of patients, users, us and others.
We may create de-identified or aggregated information (for example, total visitors per month) that does not identify you, and use it for any lawful purpose.
5. Cookies, analytics and advertising
The Website does not currently use analytics, advertising or social media tracking tools, and it does not set cookies for those purposes. Our hosting provider may keep standard server logs (such as IP address, browser type and pages requested) to keep the Website secure and running.
If we add analytics or advertising tools in the future, we will update this policy before we do, explain what they collect, and give you a way to opt out.
Limits we place on tracking:
- We do not place advertising or social media tracking tools on the patient portal, intake forms, checkout confirmation pages that reveal a treatment, or any page where you enter information about your health.
- We configure any analytics and advertising tools not to receive form contents, and we do not knowingly send health information to advertising or social media companies.
- Pages about general wellness topics (such as sleep, energy or strength) are educational. We do not use visits to these pages to infer or record a health condition about you.
Your choices:
- Block or delete cookies in your browser. Some features may stop working.
- Opt out of interest-based ads through the Digital Advertising Alliance or the Network Advertising Initiative.
- Global Privacy Control (GPC): we treat a GPC browser signal as a request to opt out of advertising cookies for that browser.
- Do Not Track: there is no common standard for Do Not Track signals, so we rely on GPC instead.
6. How we share information
We do not sell your personal information, and we do not share it for cross-context behavioral advertising except as described in Section 5 and subject to your opt-out choices.
We share information only:
- Between the Company and the Practice, to schedule you, onboard you to the patient portal and support billing.
- With service providers that work for us under contracts limiting their use of your information, such as website hosting, scheduling, payment processing, email and text-message delivery, customer support and analytics.
- With advertising partners, limited to the cookie and device data described in Section 5, and never health information.
- For legal reasons, when we believe in good faith it is required by law, subpoena or court order, or needed to protect safety, prevent fraud, or enforce our terms.
- In a business transfer, such as a merger, sale of assets, financing or reorganization, in which case the buyer must protect your information in line with this policy. Medical records are transferred only as health-care privacy laws allow.
- With your consent or at your direction.
7. Email and text messages
- Email: every marketing email includes an unsubscribe link. We process requests within 10 business days. We may still send service emails about your account or membership.
- No sharing of mobile information: we will not share your mobile number or text-message opt-in data with third parties or affiliates for their marketing or promotional purposes. This does not include service providers that deliver our messages.
- Keep texts free of health details: we will not ask for, and you should not send, health information by text or regular email.
8. How long we keep information
We keep Website information only as long as needed for the purposes in this policy:
| Information | Typical retention |
|---|---|
| Contact form and lead records that never become patients | Up to 24 months after last contact |
| Membership and billing records | 7 years, for tax and accounting |
| Marketing consent and opt-out records | As long as needed to prove consent and honor opt-outs |
| Analytics data | Up to 14 months in the analytics tool |
Medical records in the patient portal are kept under Florida medical-records retention rules and our Notice of Privacy Practices, not this table.
9. Security
We use reasonable administrative, technical and physical safeguards, including encrypted connections (HTTPS), access controls and vendors with security programs. No website or online transmission is completely secure, so we cannot guarantee security. If we learn of a breach of personal information, we will notify affected people and regulators as required by the Florida Information Protection Act and other applicable laws.
10. Your rights and choices
Wherever you live, you may ask us to:
- Access the personal information we hold about you from the Website.
- Correct information that is inaccurate.
- Delete your information, unless we must keep it for legal, billing, fraud-prevention or medical-records reasons.
- Opt out of marketing emails, marketing texts, and advertising cookies.
To make a request, email care@orahealthmd.com with the subject line "Privacy Request." We will verify your identity by matching information we already have, and respond within 45 days. You may use an authorized agent if you give them signed permission. We will not discriminate against you for using these rights.
To access or amend your medical record, use the patient portal or the process in our Notice of Privacy Practices.
Residents of other states. Our services are intended for people located in Florida. If you live in a state that gives you additional privacy rights (such as California, Washington, Nevada, Colorado, Connecticut or Virginia), you may contact us using the details below and we will honor rights that apply to us under that state's law. If you disagree with our response, you may appeal by replying to our decision with the subject line "Privacy Appeal."
11. Children
The Website and our services are for adults 18 and older. We do not knowingly collect personal information from anyone under 18. If you believe a minor has given us information, contact us and we will delete it.
12. Third-party links and services
The Website may link to other sites and services, including the patient portal vendor, payment processor, scheduling tool and social media. Their privacy practices are governed by their own policies, which we encourage you to read. We are not responsible for content or practices of sites we do not control.
13. Location of processing
We and our service providers store and process information in the United States. The Website is not directed to people outside the United States.
14. Changes to this policy
We may update this policy. We will post the new version with a new "Last updated" date. If a change is material, we will give notice on the Website or by email before it takes effect. Continued use of the Website after the effective date means you accept the updated policy.
15. Contact us
Ora Health MD
Email: care@orahealthmd.com
For questions about health information in your medical record, contact our Privacy Officer at care@orahealthmd.com, or see our Notice of Privacy Practices.