Privacy and patient information
How I handle what you send through this website, and how I handle patient information when I work with your practice. The short version: by default, no patient information is in my hands or my systems.
This website
- What the forms ask for
- Your name, your practice, your role, a phone number and an email address. The free website check also asks for your practice’s website, how many locations you have, and whether a test call, text and form after hours is OK.
- Where it goes
- The forms are sent through Formspree, a form service, to my business email. I use what you send to reply and to do the check you asked for.
- Patient information
- Please don’t include any. If some arrives anyway, I delete it and ask you to use a reference instead, like “the call at 3:42.”
- Tracking
- This site has no advertising pixels and no analytics. Its fonts load from Google Fonts.
Patient information: the rules
- By default, no patient data is in my hands or my systems.
- When a task needs it, I work inside your systems, under a Business Associate Agreement, on my own login. Patient data stays in your own computers, accounts and vendors, never on my devices or in my accounts.
- Software that touches patient data runs in your accounts or on your computers, never mine.
- If counts can do the job instead of records, I use counts.
The order I work in:
- Counts only, from your software’s summary reports.
- Inside your systems, under the Business Associate Agreement. The data shows on my screen and stays on your computer.
- A matching tool in your own account. It matches inquiries to bookings and sends me only a summary of counts, with no names.
Patient data is never printed, and I never keep a file of patient data on my own devices. My notes never contain patient names. I use references like “row 14” or “Tues 10:20 call.”
Access to your systems
- I use my own login at your practice, created by you and removable at any time. Never a shared login, and never a password sent by email.
- Two-step login on everything, a password manager, encrypted devices and a screen lock. Client work happens in a separate browser profile, with no downloads, exports or screenshots that show patient information.
- Remote sessions, only when they’re worth setting up, go into a computer your practice controls, using a tool your practice controls. Nothing is downloaded to my device.
- When we stop working together, my access is removed that same week, and I confirm it in writing.
What I can see, by service
| Service | What I can see | Business Associate Agreement |
|---|---|---|
| Free first look and quarterly re-run | Public information only | Not needed |
| Recheck | Public information and three test inquiries | Not needed |
| Audit | Public information, summary counts, and your screens while I’m at your office | Signed before the audit. Your screens may show patient information. |
| Fixes | My own login, only where a fix needs it. Your staff drive whenever the screen shows patient information. | Signed if the tool holds patient messages, recordings or appointments |
| Monthly service | My own login and summary reports | Signed |
Day to day, I rarely see patient information. The agreement still covers the audit and monthly service, because I may see it even though I never keep it. I never talk to your patients myself.
What I keep, and deleting it
- Patient data
- None, and nothing is ever printed.
- What I keep
- Counts, findings, statuses, reports and my evidence log. None of it has patient identifiers.
- When we stop
- Everything else is deleted or handed over to you, and the deletion is logged: what, when, how, and who confirmed it.
- Your accounts
- Everything I set up stays in your accounts, and stays yours.
AI
- No patient data goes into any AI tool, ever. Not for drafting, summaries or analysis.
- AI helps me draft notes and reports. I review every word before you see it, and every number comes from the data, not the AI.
- I don’t build, set up or run AI that talks to your patients.
Texting your patients
When a fix involves texts to your patients, sent from your own texting service:
- Marketing texts, like reactivation or referral thank-yous, go only to patients with signed consent on file.
- You approve every message and how often it goes out.
- Replying STOP works, and it’s tested before anything goes out.
- No treatment details in any text.
- Nothing written by AI is sent to patients. Automatic texts use templates you’ve approved.
On your practice’s website, I don’t put advertising pixels on forms, booking pages or any page that shows someone is a patient.
If something goes wrong
If patient data is ever involved in a problem, like someone getting access they shouldn’t or a message going to the wrong person, I follow the breach timeline in our Business Associate Agreement. If my change caused it, I tell you and fix it free within 12 months of the change going live.
Questions
Email [email protected] or call (602) 502-2086. Last updated October 2026.