DRAFT REQUIRING WEBSITE AND DATA PRACTICE CONFIRMATION | Do not publish yet
A Day @ The Oasis respects your privacy. This notice describes how we propose to handle information provided through our website, booking process, and services. [Before publication, replace this opening with an accurate description of the implemented practices and insert the effective date.]
Information and purpose
We collect information needed to answer inquiries, arrange appointments, provide services, and maintain business records. This may include contact details, the service address, appointment preferences, relevant health screening and consent information, session notes, and transaction records. [Confirm the actual fields collected and how each is used.]
Bookings payments and website technology
[Insert booking provider, payment processor, website host, contact-form tools, and relevant privacy-policy links. Explain what each receives, whether card information is received or stored by the business, and any overseas processing.] Do not send card details or detailed health information through public comments or social media. Ask us for the appropriate intake method.
[List the cookies, analytics, advertising tools, embedded maps, social widgets, and spam/security tools actually enabled. Explain the information collected, purpose, and available controls. Do not state that the website has no cookies or that data is never sold or shared until verified.]
Confidentiality and disclosures
[Proposed commitment: restrict client-record access to authorized people who need it for their work. Disclose information with appropriate authorization, to necessary service providers under suitable safeguards, or when required or permitted by law. Specify the actual providers, purposes, and any other recipients.]
Marketing photos and reviews
[Proposed commitment: marketing enrollment is optional and separate from treatment consent. Explain how to withdraw consent. Obtain separate permission before using an identifiable client photo, testimonial, or health-related story. Confirm the actual email/text marketing practices and opt-out process.]
Security retention and requests
[Describe the safeguards actually used for paper and electronic records, retention periods or criteria, and secure disposal. Explain how clients can request access or corrections and how deletion requests are handled when records must be retained. Do not promise absolute security or immediate deletion of all records.]
Contact children and changes
Privacy contact: [verified public business email or contact method]. [Confirm whether minors are served and how guardian consent and children’s information are handled.] Date any policy revisions. HIPAA status must be assessed separately; this draft does not claim HIPAA coverage or compliance.