Website privacy policy

Status

This document has not been drafted, has not been reviewed by counsel, and is not in effect. Nothing on this page is an operative policy or a statement of current practice.

What this document must cover

This is the website-specific policy. It must not be conflated with the Notice of Privacy Practices, which is the HIPAA document governing protected health information.

The drafted policy must state, accurately and specifically:

• What the site collects automatically. Server logs, IP handling, and what the hosting provider retains, with retention periods.
• Analytics. The specific tool in use, that it is cookieless and does not track individuals across sites, what it measures, where the data is processed, and how long it is held. If the implementation ever stops being cookieless, this section and the consent position both change.
• Cookies, or their absence. A plain statement of what is set in the browser, including anything stored for the text-size control in the top bar. If nothing tracking is set, say so and explain why no consent banner appears.
• Forms. Which forms exist, which fields are required, where submissions are sent, who can read them, and how long they are retained before deletion.
• The processor. That form submissions pass through a third-party processor operating under a Business Associate Agreement, with the categories of data covered. Confirm the executed BAA before publishing this sentence.
• The instruction not to send health information. Stated plainly and early: the website is not the route for diagnoses, medications, Medicaid numbers or clinical detail, and anything outside the secure route should not carry them.
• Deletion and access. How a person asks for their submitted information to be deleted or provided to them, who handles the request, and the timescale.
• Third parties. Embedded content, fonts, maps or scripts loaded from other domains, or a statement that there are none.
• Changes, an effective date, and a contact route consistent with site config rather than hard-coded into the page.