Patient data

The sites we build are designed so patient health information never reaches us, structurally, not as a policy.

Contact forms collect contact details only

Appointment forms on the sites we build collect a name, a phone number, an email, and a preferred time. Nothing asks why the patient is coming. There is no field where a patient could describe a symptom, and the form says so where the patient can see it.

No tracking on contact pages

Contact pages on the sites we build carry no analytics or tracking scripts. Nothing watches a patient reach out.

Patient messages stay on the practice's own platforms

Services that touch patient messages, such as missed-call text-back, run on HIPAA-compliant platforms the practice owns, under the practice's own business associate agreement. The messages are the practice's, on the practice's accounts, never on ours.

Enforced by the build, not by a promise

A build check runs on every client site and fails it if any form asks for free text or health details. A page that breaks the rule cannot ship by accident, because the build itself refuses.

Not legal advice

We are careful about this by design, but we are not your lawyer. Practices should confirm their own obligations with their own compliance advisor.