Privacy Policy

This Privacy Policy covers information collected through our Website, such as browsing data, contact form submissions, and analytics.

If you become a patient, your Protected Health Information (PHI) — including medical records, lab results, prescriptions, and clinical communications — is collected and managed through our HIPAA-compliant electronic health record system (CharmHealth). It is governed by our Notice of Privacy Practices, which is also provided to you during patient intake. That notice, not this policy, describes how your health information is used and your rights under HIPAA.

Optimal State Health complies with the Health Insurance Portability and Accountability Act (HIPAA), including the Privacy Rule, Security Rule, and Breach Notification Rule. We have Business Associate Agreements (BAAs) in place with all third-party service providers that handle PHI on our behalf, including our EHR provider (CharmHealth) and payment processor (Stripe, via CharmHealth).

Information you provide directly

• Contact and booking requests: your name, email address, phone number, and any message you include when you reach out or request a consultation.
• Email correspondence: information you share when you email us at support@optimalstatehealth.com or dr@optimalstatehealth.com.

Please don't send detailed medical information through website forms or regular email. Clinical details are best shared during your visit or through the secure patient portal.

Information collected automatically

• Device and browser information: browser type, operating system, screen size, and device type.
• Usage data: pages visited, time on page, and the website that referred you.
• Approximate location: general region derived from your IP address.

We use the information we collect to:

• Respond to your questions and consultation requests
• Improve our Website’s content, functionality, and experience
• Understand Website traffic and usage patterns
• Measure how well our advertising reaches people interested in our services
• Communicate with you about our services, only if you contacted us first
• Comply with legal obligations

We do not use Website data to make clinical decisions, and we do not sell your personal information. Clinical care is handled entirely through our HIPAA-compliant patient portal.

Our Website uses cookies and similar technologies to make the site work properly, understand how visitors use it, and measure our advertising.

• Google Analytics: collects information such as pages visited, time on site, device and browser type, and approximate location. We use it in aggregate to improve the Website. You can opt out with the Google Analytics opt-out browser add-on.
• Meta Pixel: we may use the Meta Pixel to measure the results of ads on Facebook and Instagram and to show our ads to people who have visited the Website. Meta may combine this data with information it already has about you under its own privacy policy.
• Vercel Analytics: privacy-friendly, aggregated traffic statistics from our hosting provider.

We do not place analytics or advertising tracking on our patient portal, intake forms, or any page where you enter health information. Those tools are limited to the public, informational pages of this Website, and we configure them so that health information is not sent to Google or Meta.

You can control or delete cookies in your browser settings, and you can adjust ad preferences in your Google and Meta account settings. Blocking cookies may affect how parts of the Website work.

We work with the following providers in connection with our Website and practice:

Payments are processed by Stripe through our patient portal, not directly on this Website. We never store your card details on our servers.

We use reasonable administrative, technical, and physical safeguards to protect the information we collect. The Website is served exclusively over encrypted HTTPS connections. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Patient health information is stored in CharmHealth's HIPAA-compliant, encrypted environment — not on this Website.

Website data, such as contact requests and analytics, is kept only as long as needed for the purposes described here. Contact requests are kept for up to 24 months unless you ask us to delete them sooner.

Patient medical records are retained according to California requirements — at least 7 years from the last date of service, or longer where required by law — within our EHR system.

If a breach of unsecured Protected Health Information occurs, we will notify affected individuals as required by HIPAA's Breach Notification Rule and applicable California law (Cal. Civ. Code § 1798.82), without unreasonable delay and no later than 60 days after discovery.

All visitors

You can ask us to:

• Access the personal information we hold about you
• Correct inaccurate information
• Delete your personal information

California residents (CCPA/CPRA)

• Right to know: the categories and specific pieces of personal information we have collected about you.
• Right to delete: deletion of your personal information, subject to certain legal exceptions.
• Right to correct: correction of inaccurate personal information.
• Right to opt out of sharing: we do not sell your personal information for money. Using advertising tools such as the Meta Pixel may count as “sharing” for cross-context behavioral advertising under California law. You can opt out by emailing us, and we honor Global Privacy Control (GPC) browser signals as an opt-out request.
• Non-discrimination: we will not treat you differently for exercising your rights.

We will verify your identity before processing a request and respond within 45 days.

Patients (HIPAA)

Your rights regarding your health information are described in our Notice of Privacy Practices. They include the right to access and request amendment of your records, receive an accounting of disclosures, request restrictions, receive confidential communications, and be notified of a breach of your unsecured PHI.

To make any privacy request, email support@optimalstatehealth.com.

Our Website and services are intended for adults 18 and older. We do not knowingly collect personal information from children. If you believe a minor has shared information with us, contact support@optimalstatehealth.com and we will delete it promptly.

Our Website may link to third-party sites, such as our patient portal, labs, or pharmacies. We are not responsible for their privacy practices and encourage you to review their policies.

We may update this policy from time to time. Changes will be posted on this page with a new “last updated” date. Continuing to use the Website after an update means you accept the revised policy.