Demo document — not legal advice. Drafted for a fictional practice. Before real use, the clinic's attorney should confirm whether the practice is a HIPAA "covered entity" (this depends on whether it bills insurance electronically or otherwise meets the definition) and adjust the language accordingly — a practice that is not a covered entity may still choose to voluntarily follow HIPAA-equivalent practices, which is what this template assumes.
Notice of Privacy Practices
Demo build. Linden Aesthetic Medicine is a fictional practice, not affiliated with any real clinic. Prices and reviews are illustrative.
This notice describes how health information about you may be used and disclosed, and how you can access it. Please review it carefully.
Where your health information actually lives
This is the most important thing to understand about how we handle your information: your medical intake form, health history, consultation notes, and treatment records are collected and stored on our booking and practice-management platform — not on this website. This website (lindenaesthetic.example) never receives, stores, or processes your health information. When you click "Book Now," you leave this site and enter our booking platform's secure environment, where the intake process happens.
That separation is deliberate. It means a security issue with this marketing website could never expose your medical records, because they were never here.
What counts as protected health information (PHI)
If you become a patient, PHI collected on the booking platform may include: your name, contact information, medical and cosmetic history relevant to treatment, photographs taken for clinical documentation (separate from any before/after photos used in marketing, which require their own signed consent — see below), treatment notes, and billing information if applicable.
How we use and share your health information
- For your treatment — so your provider can plan and deliver care safely
- For payment — to process payment for services, including through third-party payment processors
- For healthcare operations — quality review, scheduling, and practice administration
- As required by law — for example, in response to a valid subpoena or public health reporting obligation
We do not sell PHI. We do not use PHI for marketing without your separate, explicit authorization (see our Photo Consent template for the specific case of before/after photography).
Your rights regarding your health information
You have the right to:
- Request a copy of your records
- Request that we correct information you believe is inaccurate
- Request a list of certain disclosures we've made
- Request restrictions on certain uses or disclosures (we're not always required to agree)
- Request confidential communications (e.g., contact you at a specific number only)
- Receive a paper copy of this notice on request
- File a complaint if you believe your privacy rights have been violated, without fear of retaliation
To exercise any of these rights, contact our privacy officer using the details below, or ask your provider directly at your next visit.
How your information is protected
Health records are held on our booking platform's HIPAA-eligible infrastructure, access is limited to staff involved in your care or the business operations that support it, and photography used for clinical documentation is kept separate from any marketing use unless you've signed a separate photo release.
Questions or complaints
Linden Aesthetic Medicine — Privacy Officer Suite 240, 3100 Travis Street, Dallas, TX 75204 (214) 555-0148 privacy@lindenaesthetic.example
You may also have the right to file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights. We will not retaliate against you for filing a complaint.
Changes to this notice
We reserve the right to change this notice and to make the revised notice apply to health information we already have as well as any we receive in the future. The current notice is always available on this page and at our office.