Privacy policy

This policy describes how the MyOrthoSpineMD website handles information. It does not describe how the practice handles your medical records once you are a patient — that is covered by the practice’s Notice of Privacy Practices →, a separate document provided under federal health privacy law. Ask the office for a copy.

It also describes the practice’s text messages →.

A simple record of how the site is used, and nothing that identifies you. There is no analytics company on this site — no Google Analytics, no tag manager, no advertising or tracking pixels, and no social media trackers. The site sets no cookies of its own and stores nothing in your browser’s local storage.

When you open a page, or use some of its buttons and links, your browser sends a short note to the practice’s own cloud account. It records what happened and when: the page, the button or link, whether you are on a phone, a tablet or a computer, the general kind of place you came from — a search engine, for example — and, if you came through one of the practice’s advertisements, which one. It never includes the address of the page you came from or what you searched for.

There is no cookie, no identifier and nothing that links one visit to another, and your network address is not kept. Nothing you type is ever recorded. On the page with the request form, only its opening is recorded, and once you send a request, nothing more is recorded while that tab stays open. These records are kept for 25 months and then deleted automatically. They are not shared or sold. The practice uses them to understand which pages and advertisements help people reach it, and may compare their times with when requests and calls arrive.

If your browser sends a Global Privacy Control signal, nothing is recorded at all.

Every page is a static file. The website itself has no database and never receives what you type: the request form sends it from your browser straight to the practice, as described below.

The request form asks who is contacting us, your first and last name, your phone number, your email address, and anything you choose to write in the message box. You decide what to put in that box; it may include health information. Please keep payment details out of it — card numbers have no reason to be there and we will never ask for one this way.

When you send it, your browser sends it directly to the practice’s own environment with a cloud provider. It does not pass through this website, this website never sees it, and the company that hosts these pages never receives it. Nothing you type is written to a log here, sent to any analytics service, or kept in your browser.

Stored with it are four things you did not type: the time it arrived, which language the page was in, so that whoever calls you back knows which language to speak, which of the practice’s websites you sent it from, and — if you reached us from an advertisement we placed — which one, so the practice knows whether it was worth placing. That last one says nothing about you: it is a marker in the address of the page, the same for everybody who arrives that way, and it is never sent back to the advertiser. Nothing else about you or your visit — not your IP address, not your browser, not the page you were reading when you opened the form. Later, when someone at the practice has dealt with your request, a note is added to the same record saying so and who did it.

The practice has a Business Associate Agreement with that provider — the contract federal health privacy law requires of a company that stores protected health information on a practice’s behalf. Your request is stored encrypted in that environment, only the practice can open it, and each time it is opened is recorded. It is not sent anywhere that is not covered by such an agreement.

We normally send a short confirmation to the email address you give, so that you know the request arrived. If one does not reach you, the request still arrived — nothing about it depends on that message. It travels by ordinary email, which is not protected the way the rest of this is — so it carries nothing from your request. Not your name, not your phone number, and nothing about your symptoms. It says only that a request was received, when to expect a call, and what to do if your symptoms get worse before then.

What you send this way reaches the practice and is handled as part of your care, under the Notice of Privacy Practices →.

If you would rather not use the form, call 404-238-7981.

The principle is that the fewer places your information goes, the fewer places it can go wrong. In practice that means five things.

• Encrypted both ways. It travels over an encrypted connection and is stored encrypted. It is not written to a log on the way, and no copy is kept in your browser.
• Held behind a sign-in. Your request is kept in a system that takes a password and then a second step — a one-time code, separate from the password — to open. Every opening there is recorded: who, and when.
• Your message stays there. When a request arrives the practice is told, so that somebody knows to look. That notice can include your name and phone number, so the practice can call you back, and it goes only to the practice’s own email, which is covered by a business associate agreement. Your message is never in it. The description of what happened to you is read inside the system above and nowhere else.

None of this makes a system impossible to break into, and we would rather say so than imply otherwise. What it does is close the ordinary ways information leaks: a third-party script on the page, an analytics trail, a list left open on a screen where anyone can read it.

It stays in that environment until someone at the practice removes it. Nothing deletes it on a timer, because when a request has served its purpose is a judgment for the practice to make rather than a date to set in advance.

If you would rather yours were not kept — you sent it and then chose another practice, for example — call the office and say so. If you go on to become a patient, what you sent becomes part of your medical record, and how long records are kept, and what you can ask about them, is governed by law and described in the Notice of Privacy Practices →.

We text you only if you have agreed to receive texts from us — on a phone call, in person at one of our offices or on a video visit, on the practice’s patient forms, by email or letter, or by texting our number first. A parent, guardian or someone you have named to help with your care can agree to texts about it at their own number. Agreeing is not a condition of being seen, and you can stop at any time.

The texts are for your care: appointments, confirmations and reminders, links to a visit or to forms, instructions for a visit, imaging, prescriptions, records and paperwork, office and billing notices, one-time sign-in codes, a request for your feedback after your care, and answers to your questions. How often you hear from us depends on your care. We do not send marketing texts.

An ordinary text message is not encrypted on its way to your phone, and anyone who picks up your phone can read it. So we keep medical details — a diagnosis, a result, what happened to you — out of our texts. If you would rather have them by text anyway, tell us; we will explain the risk first and note your choice.

To arrange your care we also text imaging centers, surgery centers, pharmacies, equipment suppliers and other healthcare offices involved in it. With your permission — in writing where the law requires it — we may also text the law office representing you, or a claims representative handling your claim, about scheduling, records and paperwork. Those texts carry no medical details either; orders and records themselves go the usual way.

Texts are sent and received through the practice’s own environment with the cloud provider described above, under the same Business Associate Agreement. Your replies are kept there, where only the practice can read them. On its way to your phone a text also passes through your mobile carrier, as every text does.

Your mobile number and your agreement to receive texts are not sold, rented or shared with anyone for marketing or promotional purposes — ours or anyone else’s. The only companies that handle them are that cloud provider and the mobile carriers that deliver the messages.

How to stop the texts, and the rest of their terms, are in our terms of use →.

There are four, and that is the complete list.

• Our cloud provider. It receives the request form and stores it for the practice, under the Business Associate Agreement described above, and it receives the page records described above, in a separate part of the practice’s account. Like any service on the internet it sees the network address each one comes from; that address is not stored, with your request or with the totals, and the practice never sees it.
• Our hosting provider. Like any web host, it processes standard server request records — your IP address, the page requested, your browser type — to serve the site and keep it secure. We do not use these to build any profile of you. It never receives anything you type into the request form.
• Our email provider. When a request arrives, the notice that tells the practice — your name and phone number, so someone can call you back — goes to the practice’s own email. That provider is under a business associate agreement too. It never receives your message.
• Google Maps and review sites. Only as outbound links. The “Directions” links open Google Maps, and the review page links to Google, Healthgrades and WebMD, each in a new tab. Nothing from any of them is embedded in these pages, so nothing loads from them unless you click.

Typefaces are served from this site’s own domain, so no request for fonts reaches any third party.

A review you write on our review page is not sent to us and is not saved. It stays in your browser until you leave the page, and is copied to your device only when you press the copy button. Where you post it, if anywhere, is up to you.

Some pages here name a symptom in their address. When your browser follows a link or opens the request form, this site instructs it to send only the site’s address and never the specific page you were reading. In practice that means opening the form does not tell anyone which symptom page you came from.

We do not sell, rent, or trade information, and we do not share it for advertising. This site collects nothing to sell.

Browsers can send a Do Not Track or Global Privacy Control signal asking a site not to follow you. This site acts on Global Privacy Control: if your browser sends it, nothing is recorded. Do Not Track, an older signal now deprecated, is not checked; the records identify no one either way.

This site is intended for adults. It is not directed at children and does not knowingly collect information from anyone under 13. Where a parent or guardian is arranging care for a minor, that is handled through the practice in the usual way.

If the site changes in a way that affects this policy — recording something new, for example, or handling forms directly — this page will be updated and the date at the top will change.

Questions about this policy, or about the information the practice holds about you:

MyOrthoSpineMD, P.C.
3280 Pointe Pkwy NW, Suite 2550
Norcross, GA 30092
404-238-7981
info@myorthospinemd.com

Please don’t send medical details by email. Ordinary email isn’t secure, and that address is for questions about this policy rather than about your care. For anything clinical, call the office or use the request form.

See also our terms of use → and contact details.