Privacy & cybersecurity notice

What we collect

We anticipate collecting scheduling contact information, consent records, payment confirmation, and separately, exercise history and screening records where necessary to provide requested services. We should collect only what is needed and avoid asking clients to put medical details in free-text scheduling fields.

Third-party tools

Wix may host the website, Calendly may provide scheduling, Stripe or a connected processor may handle payments, and TrueCoach may support coaching. Each service has separate terms and privacy practices. Specific integration and applicable Business Associate Agreements must be verified before handling protected health information.

Security practices

We intend to use HTTPS, restricted staff access, multifactor authentication, appropriate data retention and secure deletion, vendor review, and secure mechanisms for medical document collection. These are planned measures; do not describe them as implemented until verified.

Use and sharing

Information is intended to be used for inquiries, scheduling, consent documentation, service delivery, payment administration, and communication requested by clients. We will not sell clients' medical information. Disclosures to referring providers require appropriate authorization or another applicable legal basis.

Client questions and requests

Clients can request information about records or corrections through the designated business privacy contact. [BUSINESS CONTACT / ADDRESS / EFFECTIVE DATE TO ADD]. Applicable rights depend on the type of information and governing law.

Disclaimer

This notice is a website draft, not an assertion of HIPAA compliance or a legally complete privacy policy. Finalize it after determining the business's legal obligations, configured vendors, retention schedule, breach response process, and secure submission channels.