Website Privacy Policy

Aevum Integrated Health ("we," "us," or "our") is committed to protecting the privacy of visitors to our website and patients who use our online services. This Website Privacy Policy explains how we collect, use, disclose, and safeguard information when you visit our website, use our contact form, click scheduling links, or communicate with us through digital channels.

This Policy applies to the Aevum Integrated Health website. It is separate from, but should be read together with, our HIPAA Notice of Privacy Practices, which governs the privacy of protected health information (PHI) we maintain as part of patient care.

By using our website, you agree to the terms of this Privacy Policy. If you do not agree, please discontinue use of our website.

1. Information We Collect

A. Information You Provide to Us

We collect information you voluntarily provide through our website, including:

• Contact form information, such as your name, email address, phone number, and message;
• Email communications you send to us;
• Phone calls or other communications initiated from website links or website phone numbers.

Our website contact form is for general inquiries only and instructs visitors not to include protected health information. If you choose to provide health-related information through the website or another digital channel for the purpose of receiving care from us, that information may be PHI and may also be subject to our HIPAA Notice of Privacy Practices.

B. Automatically Collected Information

When you visit our website, we and our service providers may automatically collect certain technical and usage information, including:

• IP address and approximate geographic location;
• Browser type and version;
• Operating system;
• Pages visited, time spent on pages, and navigation path;
• Referring website address;
• Date and time of access;
• Device type and screen resolution;
• Interactions with website features, such as page views, form events, outbound link clicks, scheduling link clicks, phone link clicks, and call attribution events.

This information may be collected through cookies, local storage, embedded services, and similar technologies, as described in Section 4 below.

C. Information from Services

Our website uses internal AevumBH software, including Synapse for contact form message delivery, and uses or links to third-party services, including Zocdoc for online scheduling, Google Maps for location maps, Google Analytics for consent-based analytics, Fraud Blocker for consent-based ad click fraud monitoring, CallTrackingMetrics for call attribution, and Cloudflare Turnstile for spam and abuse prevention. Third-party services may collect information under their own privacy policies. Where required by law or contract, we use appropriate safeguards for vendors that handle PHI on our behalf.

2. How We Use Your Information

We use the information we collect for the following purposes:

• To respond to your inquiries;
• To help you schedule appointments through available scheduling options;
• To provide, manage, and improve our healthcare services;
• To send appointment-related or health-related communications when applicable;
• To maintain the security and integrity of our website and systems;
• To prevent spam, abuse, fraud, security threats, or technical issues;
• To analyze website traffic, usage patterns, and ad click quality when you consent to analytics cookies;
• To understand which website pages, links, or campaigns lead visitors to call us;
• To comply with applicable legal and regulatory requirements, including HIPAA when applicable.

We do not sell your personal information. We do not use PHI for marketing without your written authorization.

3. How We Share Your Information

A. Aevum Integrated Health Workforce

Information you provide may be shared with Aevum Integrated Health clinical or administrative staff as needed to respond to your inquiry, manage appointments, provide care, or support billing and practice operations.

B. Service Providers and Business Associates

We may share information with vendors and service providers who perform functions on our behalf, such as website hosting, spam prevention, analytics, call attribution, scheduling, electronic health record, billing, telehealth, IT, and other operational services. Vendors that handle PHI on our behalf are required to safeguard that PHI as required by HIPAA, including through Business Associate Agreements where applicable.

C. Legal Requirements

We may disclose your information when required by law, court order, subpoena, or government regulation, or when we believe disclosure is necessary to protect our rights, protect safety, or comply with legal process.

D. Health Information Exchanges

For patient care, we may participate in regional or statewide health information exchanges (HIEs) to facilitate coordinated care. HIE participation is subject to applicable law and your HIPAA rights.

E. With Your Consent

We may share your information with third parties for any other purpose with your express written consent or authorization where required.

F. We Do Not Sell Your Data

Aevum Integrated Health does not sell, rent, or trade personal information or protected health information to third parties for commercial purposes.

4. Cookies and Tracking Technologies

Our website may use cookies, local storage, embedded services, call attribution scripts, and similar technologies to operate the website, protect forms, remember your cookie preference, understand website usage, and understand which pages or campaigns lead visitors to contact us by phone.

Types of technologies we use

• Essential Technologies: Required for core website functions, security, contact form submission, spam prevention, and remembering your cookie consent choice. These may include Cloudflare Turnstile and browser local storage.
• Analytics and Click Fraud Monitoring: Google Analytics and Fraud Blocker may be loaded only after you accept analytics cookies. These tools may process technical signals such as IP address, device and browser information, page URL, referrer, ad click details, and similar usage or fraud-prevention signals. We configure Google Analytics with IP anonymization, disabled Google signals, disabled ad personalization signals, and manual page view tracking.
• Call Attribution Technologies: CallTrackingMetrics may load for all visitors and may collect technical and usage information, such as pages visited, referring source, call interactions, and related attribution data, to help us understand how website visitors contact us by phone. Tracking phone numbers are intended to display only for visitors who come from paid ads.
• Embedded Third-Party Services: Google Maps embeds and Zocdoc scheduling links may collect information when you interact with them or leave our website.

We do not use advertising cookies for targeted advertising on our website. You may control or disable cookies through your browser settings. You may also decline non-essential analytics cookies through our cookie banner.

5. Online Scheduling, Telehealth, and Patient Portal Services

Our website includes links to third-party scheduling services, including Zocdoc. When you click a scheduling link, you leave our website and interact with that third party under its own privacy policy and terms.

If we offer telehealth, patient portal, electronic intake, billing, or other digital patient services, those services may be operated through separate platforms and may collect PHI. Those patient-care services are governed by our HIPAA Notice of Privacy Practices and any applicable platform privacy terms.

6. Data Security

We implement reasonable and appropriate administrative, technical, and physical safeguards to protect personal information and PHI from unauthorized access, use, disclosure, alteration, and destruction. These measures include encrypted website transmission (SSL/TLS), access controls, spam and abuse prevention tools, secure service providers, and HIPAA-required safeguards for PHI.

While we strive to protect your information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security. In the event of a breach affecting your PHI, we will notify you in accordance with HIPAA's breach notification requirements.

7. Children's Privacy

Our website is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13 through our website without verifiable parental consent. If we become aware that we have inadvertently collected such information, we will take steps to delete it.

For patients under 18, parents or legal guardians may have rights to access and manage their child's health information, subject to applicable Virginia law and our practice's minor patient policies.

8. Links to Third-Party Websites

Our website may contain links to third-party websites, including scheduling platforms, map providers, insurance resources, health resources, telehealth platforms, or patient portal services. We are not responsible for the privacy practices or content of those websites. We encourage you to review the privacy policies of any third-party site you visit.

9. Your Privacy Rights

HIPAA Rights (Patients)

If you are a patient of Aevum Integrated Health, you have specific rights regarding your PHI as described in our HIPAA Notice of Privacy Practices, including the right to access, amend, and request restrictions on your PHI.

Virginia Consumer Data Protection Act (VCDPA)

Virginia residents may have certain rights under the Virginia Consumer Data Protection Act, including:

• The right to know what personal data we collect about you;
• The right to correct inaccurate personal data;
• The right to delete personal data, subject to applicable exceptions;
• The right to opt out of certain uses of personal data;
• The right not to be discriminated against for exercising your rights.

To exercise your VCDPA rights, please contact our Privacy Officer using the information below. Information that is subject to HIPAA is generally exempt from VCDPA requirements.

10. Retention of Information

We retain website contact submissions and related business records only as long as needed for the purposes described in this Policy, unless a longer retention period is required or permitted by law. Medical records and PHI are retained in accordance with applicable law, including Virginia medical records retention requirements and HIPAA.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will update the "Last Updated" date at the top of this Policy and post the revised Policy on our website. We encourage you to periodically review this page for the latest information.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your privacy rights, please contact us:

You may also contact us through our website contact form or by requesting our Privacy Officer's direct contact information from our front desk.

For HIPAA-specific complaints, please refer to our HIPAA Notice of Privacy Practices for instructions on filing a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights.

Note to Patients: This Website Privacy Policy governs the collection and use of information through our website. For complete information about how we handle your protected health information as a patient, please refer to our HIPAA Notice of Privacy Practices, available on our website and at our office.