Privacy policy.

Updated as of February 2024

I. Introduction

Castro Direct Primary Care, PC (“Practice,” or “we,” “us” and “our”) values your privacy and is committed to maintaining your trust.  We provide this Privacy Policy and the Notice of Patient Privacy Practices attached hereto as Addendum 1 to inform you of our policies and procedures regarding the collection, use, and disclosure of personally identifiable information and protected health information received from visitors to and/or users of the Practice’s website located at http://www.castrodpc.com (the "Website"). Specifically, the Practice provides general primary care, running on a monthly payment model (the "Services”) and allows Website visitors to inquire about the Services through its Website.  

If you are an existing client of the Practice, the terms and conditions applicable to your use of our Services are contained in your Patient Care Membership Contract and Medicare Beneficiary Private Contract and Notice of Non-Covered Services (collectively, the “Patient Agreements”).  To the extent that there is a difference in terms between the terms in this Privacy Policy and the terms in your Patient Agreements, the terms in your Patient Agreements shall govern.

For purposes of this Privacy Policy, the below definition of Personal Information does not include any protected health information (“PHI”) you share with the Practice.  For more information regarding your PHI, please review our disclosure regarding the same in our Terms of Service and the Notice of Patient Privacy Practices attached hereto as Addendum 1, incorporated fully by reference herein.  

II. Use, Processing, and Sharing of Personal Information  

• To respond to your inquiries and your requests regarding our Website or Services.

• To send you information regarding our services and changes to our terms, conditions, and policies. 

• To complete your account registration, process your payments, and communicate with you regarding your purchase of our Services.

• To send you marketing communication and newsletters about our Services.

• To personalize your experience on our Website.

• To inform you and allow you to participate in our Practice’s promotions.  

• To facilitate social sharing functionality.

• To collaborate with business affiliates, partners, vendors, or service providers to provide you with our Services.

• In connection with our business purposes, as described above, including but not limited to data analysis, audits, fraud monitoring and prevention, developing or enhancing new and existing products and/or services, expanding our business activities, etc. 

We will not use and/or share your Personal Information:

• With anyone except for our Practice’s authorized service providers, business affiliates, and business partners, including Hint Health Inc., Akute Health, Inc., and Spruce Health, Inc., and strictly for business purposes; or unless we specifically inform you, and give you an opportunity to opt out of sharing your Personal Information.  You herein agree that you have visited the websites of the aforementioned entities, and agreed to their Privacy Policies and Terms of Service.

• To run interest-based advertising campaigns that collect Personal Information such as email addresses, telephone numbers, and credit card numbers.

• To use or associate Personal Information with remarketing lists, cookies, data feeds, or other anonymous identifiers.

• To use or associate targeting information, such as demographics or location, with any Personal Information collected from the ad or its landing page.

• To share any Personal Information with Google or third party companies through our remarketing tag or any product data feeds which might be associated with our ads.

• To send Google or third party companies precise location information without obtaining your consent. 

However, we reserve the right to disclose Personal Information that we believe, in our sole discretion, to be necessary or appropriate in the following circumstances:

• As required by law, such as to comply with a subpoena, or similar legal process.

• When we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request.

• To enforce our Terms of Service.

• To allow us to pursue available remedies or limit the damages that we may sustain.

III. Collection of Other Information

Protected Health Information (“PHI”) and HIPAA

The Federal Health Insurance Portability and Accountability Act (“HIPAA”) provides specific protections for the privacy and security of Protected Health Information (“PHI”) and restricts how PHI is used and disclosed by Covered Entities and its Business Associates.

We have partnered with Akute Health Inc. to manage your PHI, and we request that you only share PHI with us through Akute Health Inc.’s platform.  You herein agree that you have read and agreed to the Privacy Policies and Terms of Service of Akute Health Inc. linked below: 

• Privacy Policy: https://www.iubenda.com/privacy-policy/19467817/full-legal 

• Terms of Service: https://app.termly.io/document/terms-of-use-for-website/91362c87-1773-4a3a-9c3e-5cc5f7b26863 

We have partnered with Spruce Health, Inc. to facilitate HIPAA-compliant communications regarding your PHI, and we request that you only share PHI with us through Spruce Health’s services.  You herein acknowledge that you have read and agreed to the Privacy Policies and Terms or Service of Spruce Health, Inc. linked below: 

• Privacy Policy: https://d10gugzveyt6ly.cloudfront.net/www-sprucehealth-com/privacy.html 

• Terms of Service: https://d10gugzveyt6ly.cloudfront.net/www-sprucehealth-com/terms-organizations.html 

We have partnered with Hint Health Inc. to manage your account, fees, and billing information.  You herein acknowledge that you have read and agreed to the Privacy Policies and Terms or Service of Hint Health Inc. linked below: 

• Privacy Policy: https://www.hint.com/privacy

• Terms of Service: https://www.hint.com/terms

This Website is not intended to be used to communicate protected health information in accordance with our Terms of Service. Should you decide to share information regarding your past, present, or future physical or mental health conditions, we cannot guarantee that your PHI sent through this Website or transmitted to us via any other platforms we use to offer you Services, including but not limited to Google.com, Zoom.com, Akutehealth.com, Sprucehealth.com, and/or Hint.com, will be kept secure and protected.  If you share any such PHI through the Website or any other avenue we use to provide you with Services, you herein agree that you do so at your own risk.  

Specifically with regard to the sharing of any Personal Information, including PHI, with the Practice over Google.com, including Gmail.com, you herein agree to Google’s Privacy Statement (https://policies.google.com/privacy?hl=en-US) and Terms of Service (https://policies.google.com/terms?hl=en-US).  Specifically with regard to the sharing of any Personal Information, including PHI, with the Practice over Zoom.com, you herein agree to

Zoom.com’s Privacy Statement (https://explore.zoom.us/en/privacy/) and Terms of Service (https://explore.zoom.us/en/terms/).  Specifically with regard to the sharing of any Personal Information, including PHI, with the Practice over Akutehealth.com, Sprucehealth.com, and/or Hint.com you herein agree to Akute Health Inc., Spruce Health, Inc., and Hint Health Inc.’s Privacy Statements and Terms of Services, as mentioned above. 

For more information regarding how we use, disclose, or share your PHI as well as your rights to your PHI, please review our Notice of Patient Privacy Practices attached hereto as Addendum 1, incorporated fully by reference herein. 

Passively Collected Information:   Your visit to our Website may allow us to obtain certain additional, personally non-identifiable information that is collected passively using various technologies.  This information includes but is not limited to, for example, IP addresses, browser types, date and time of page views, location information associated with your IP address, domain names, your interactions to an ad delivered by us or our ad technology partners and other anonymous statistical data involving your use of the Website and/or our services.  This information cannot presently be used to specifically identify you.  

Aggregated Personal Data:   The Practice may analyze your Personal Information provided through the Website or in connection with rendering the Services, in aggregate form.   This aggregate information does not identify you personally.   We may share this aggregate data with our partners, affiliates, agents, or service providers for business purposes.   We may also disclose aggregated statistics to explain our Services to current and prospective business partners, and to other third parties for other lawful, business-related purposes. 

Customer Credit Card Information.   The Practice uses a Third-Party Payment Processor, as that term is defined in the Privacy Policy which is incorporated by reference herein, to keep a protected copy of your credit card number.  The Third-Party Payment Processor is Hint Health Inc. This billing data belongs to you, and by utilizing the Service, you grant the Practice a license to use this data to bill you for services rendered.  By purchasing the Services of the Practice, you herein agree to the Terms of Service and Privacy Policy of Hint Health Inc., located at https://www.hint.com/privacy and https://www.hint.com/terms.

IV. Website Tracking  

We may, either directly or through third party companies and individuals we engage to provide services to us, also:

• Track your use of our Website and the Services for purposes of our own customer support, analytics, research, product development, fraud prevention, risk assessment, regulatory compliance, investigation, etc.

• Track your use of the Website and the Services to enable you to use and access the Services and pay for your use of the Services.  

• Track your behavior on our own Website and use of the Services to market and advertise our services to you on our Website platform and third party websites.  You may opt out of receiving advertisements by visiting the Network Advertising Initiative (http://www.networkadvertising.org/choices/) and/or the Digital Advertising Alliance (http://www.aboutads.info/choices/).  Please note that even if you choose to opt-out of receiving targeted advertising, you may still receive advertising on the Services, generally.  The advertising will simply not be targeted or specific to your interests.

V. Tracking Technologies on our Website

The Practice may use the foregoing technologies to track your activity on our Website:

Cookies.   When you visit our Website or otherwise interact with the Service, we may send one or more “cookies” to your computer or other devices.  Cookies are alphanumeric identifiers stored on your computer through your web browser and are used by most websites to help personalize your web experience.  Some cookies may facilitate additional site features for enhanced performance and functionality such as remembering preferences, allowing social interactions, analyzing usage for site optimization, providing custom content, allowing third parties to provide social sharing tools, and serving images or videos from third party websites.  Some features on this site will not function if you do not allow cookies.  We may link the information we store in cookies to any Personal Information that you submit while visiting our Website.  

We may use both session ID cookies and persistent cookies.  A session ID cookie expires when you close your browser.  A persistent cookie remains on your hard drive for an extended period of time.  Persistent cookies enable us to track and target the interests of our users to enhance the experience on our site. 

Functional cookies, persistent and session type, store information to enable core site functionality, such as Live Chat and Client ID remembrance.

Analytics cookies allow us to count page visits and traffic sources so we can measure and improve the performance of our site and our marketing campaigns.

Advertising cookies may be set through our Website by our advertising partners. Data may be collected by these companies that enable the companies to serve up advertisements on other sites that are relevant to your interests. 

If you do not want information collected through the use of cookies, there is a simple procedure in most browsers that allows you to automatically decline cookies, or be given the choice of declining or accepting the transfer to your computer of a particular cookie (or cookies) from a particular site.  You may also wish to refer to http://www.allaboutcookies.org/manage-cookies/index.html.  

If you reject cookies, you may still use our site, but some features on the site will not function properly.

Web Beacons.   Web beacons are electronic files that signal when a webpage, advertisement, video, other content, an email or newsletter has been viewed.  They are usually invisible to you.  We may use web beacons alone or in conjunction with cookies to compile information about our Service.  Web beacons may be used within the Service to track email open rates, web page visits or form submissions.  In some cases, we tie the information gathered by web beacons to your Personal Information to gauge the effectiveness of certain communications and our marketing campaigns.

Log Files.   A Log File is a file that records either events that occur in an operating system or other software runs, or messages between different users of a communication software.  Log file information is automatically reported by your browser or mobile application each time you access the Website or our Services.  Along with cookies and web beacons, log files help provide additional functionality to the Website and help us analyze Website usage more accurately.  We and our third party tracking-utility partners may use log files on our Service to automatically gather and store information including, but not limited to, internet protocol (“IP”) addresses, browser type, internet service provider (ISP), referring/exit pages, operating system, date/time stamp, and clickstream data, for business purposes.  We may use Google Analytics, which uses cookies and other similar technologies to collect and analyze information about the use of the Service and report on activities and trends.  This service may also collect information regarding the use of other websites, apps and online resources.  You can learn about Google’s practices by going to www.google.com/policies/privacy/partners/, and opt out of them by downloading the Google Analytics opt-out browser add-on, available at https://tools.google.com/dlpage/gaoptout.

Embedded Scripts.   An embedded script is programming code that is designed to collect information about your interactions with the Service, such as the links you click on. The code is temporarily downloaded onto your Device from our web server or a third party service provider, is active only while you are connected to the Service, and is deactivated or deleted thereafter.

Browser Fingerprinting. Collection and analysis of information from your Device, such as, without limitation, your operating system, plugins, system fonts and other data, for purposes of identification.

ETag, or entity tag. A feature of the cache in browsers. It is an opaque identifier assigned by a web server to a specific version of a resource found at a URL. If the resource content at that URL ever changes, a new and different ETag is assigned. Used in this manner ETags are a form of Device Identifier. ETag tracking may generate unique tracking values even where the consumer blocks HTTP, Flash and/or HTML5 cookies.

VI. Children   

The Children’s Online Privacy Protection Act of 1998 (COPPA) and its accompanying FTC regulation protects the privacy of American children aged 13 and under, who are using the Internet.  The GDPR sets the age at which an EU child can give their own consent in order to process their Personal Data at 16 years of age.  

The Website are not intended for anyone under 16, and we do not knowingly collect information from anyone under the age of 16.  Anyone aged 16 or under should not submit any Personal Information without the permission of their parents or guardians.  Parents or guardians may, on behalf of their children, submit their children’s Personal Information.  By using the Website and our related Services, you are representing that you are at least 16 years old and that you have the relevant legal authority to submit your Personal Information or that of a third-party minor, to the Practice or on the Practice’s Website.

VII. Links to Other Websites   

This Privacy Policy does not address, and we are not responsible for the privacy, information or other practices of any third parties.  This Privacy Policy applies only to this Website and the Practice’s Services.  It does not apply to any third-party sites, and the inclusion of a link does not imply endorsement of the linked site or service by us or by our affiliates.

We are not responsible for the collection, usage and disclosure policies and practices (including the data security practices) of other organizations. 

VIII. Security   

We maintain reasonable and appropriate, although not infallible, security precautions.  However, we cannot guarantee that hackers or unauthorized personnel will not gain access to your Personal Information, despite our reasonable efforts.  You should note that in using the Website, app, and/or our related Services, your information will travel through third-party infrastructures which are not under our control.  Please feel free to raise any questions, concerns or specific directions you may have regarding the privacy and security of your information to admin@castrodpc.com.

IX. Data Retention

We will retain your Personal Information for four (4) years, or as long as needed to provide the applicable Services.  Our data retention period may change in the future if a longer retention period is required or permitted by law.

X. Do Not Track   

Your browser setting may allow you to automatically transmit a "Do Not Track" signal to websites you visit.  The Practice’s Website does not respond to "Do Not Track" signals or other mechanisms from a visitor's browser.  If, in the future, we create a program or protocol to respond to such web browser "Do Not Track" signals, we will inform you of the details of that protocol in this Privacy Policy.  To find out more about "Do Not Track," please visit https://www.allaboutdnt.com. 

XI. Third Party Analytics Services

Our analytics partners help us with our online services, such as Google Analytics and Facebook Analytics.  These analytics providers use technologies such as cookies, web beacons, and log files to help us analyze how you use our online services.  We may disclose site-use information (including IP address, browser type, ISP, referring/exit pages, operating system, date/time stamp, and clickstream data) to these analytics partners to help us determine how you and others use our online services. 

• Google Ads.  To learn how Google uses your data for Google Advertising and the applicable data protection provisions, please visit https://www.google.com/intl/en/policies/privacy/. 

• Google Analytics.  For more information on Google Analytics and the applicable data protection provisions of Google, please visit https://www.google.com/intl/en/policies/privacy/ and under http://www.google.com/analytics/terms/us.html. Google Analytics is further explained under the following Link https://www.google.com/analytics/.  To opt out, please visit https://support.google.com/analytics/answer/181881?hl=e.

•  Facebook Analytics. For more information on how Facebook uses your data, please visit https://www.facebook.com/help/325807937506242/ or log on to your Facebook account and access your settings. To understand more about Facebook advertising please see here https://www.facebook.com/about/ads.

XII. Disclosures Regarding U.S. State Data Privacy and Protection Acts   

Several United States jurisdictions, including California and others, provide users with certain rights regarding their personal information, including the right to access, delete, correct and/or opt-out of the “sale” or "sharing" of their personal information (“State Laws”). Based on the size of the Practice and/or our activities, we are not currently subject to these State Laws but may become subject to them in the future. Nonetheless, the different State Laws, if applicable, would provide certain rights to residents of those states. 

XIII. Testimonials, Ratings and Reviews  

If you submit testimonials, ratings, or reviews of the Services directly on our Website, any Personal Information you include will be displayed on the Website.  We may also partner with third-party service providers to collect and display ratings and review content on our Website.  If you provide our third-party service providers with your Personal Information in the process of submitting your rating and review, the content and Personal Information collected by a third party will be posted on our Website, absent your express instruction not to do so.  If you want your testimonial, rating, or review removed from our Website at any time, please contact us at admin@castrodpc.com. 

XIV. Changes   

This Privacy Policy may be updated from time to time for any reason, at our sole discretion.  We will notify you of any material changes to our Privacy Policy by posting the new Privacy Policy on our Website, and emailing you a copy of the revised Privacy Policy or a link to it.  You are advised to consult our Website regularly for any changes. 

XV. Incorporation into Terms of Service

By using or accessing the Website or the Services, you are accepting the practices described in this Privacy Policy and the Notice of Patient Privacy Practices attached hereto as Addendum 1, and you are consenting to our processing of your information as set forth in this Privacy Policy and the Notice of Patient Privacy Practices, as amended by us. This Privacy Policy and the Notice of Patient Privacy Practices is incorporated into, and considered a part of, the Practice’s Terms of Service and applicable Patient Agreements.

XVI. Opt-Out Policy   

If, at any time after registering, you change your mind about receiving information from us or about the use of information volunteered by you, or if you prefer that we do not share your Personal Information with third parties for marketing purposes, please contact us at admin@castrodpc.com.

XVII. Contact Us   

If you have any questions or concerns relating to our use of your Personal Information, please email admin@castrodpc.com.  Additionally, you may reach us by postal mail at:

Castro Direct Primary Care, PC

584 Castro St. #534

San Francisco, CA 9411

Addendum 1

Notice of Patient Privacy Practices

Updated as of February 2024

Castro Direct Primary Care has developed this Notice of Patient Privacy Practices (“Notice”) to help you understand how medical information about you may be used, disclosed, and how you can get access to this information.  Please review this notice carefully.

A. Our Commitment To Your Privacy

This Notice is provided to you pursuant to the privacy regulations enacted as a result of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”)*. 

Castro Direct Primary Care is committed to maintaining the privacy of your health information. We are required by law** to (i) maintain the privacy of your health information; (ii) provide you with this notice of our legal duties and privacy practices with respect to your health information; (iii) follow the terms of the notice of privacy practices currently in effect; and (iv) notify you if there is a breach of your health information. We must also provide you with the following important information: (a) how we may use and disclose your health information; (b) your privacy rights; and (c) our obligations concerning the use and disclosure of your health information.

This Notice of Privacy Practices is NOT an authorization; rather it describes how we, our Business Associates, and their subcontractors may use and disclose your Protected Health Information to carry out treatment, payment, or healthcare operations, and for other purposes as permitted or required by law. It also describes your rights to access and control your Protected Health Information. 

Protected Health Information (“PHI”) means information that identifies you individually; including demographic information, and information that relates to your past, present, or future physical or mental health condition and/or related healthcare services.

The terms of this notice apply to all your PHI created or maintained by Castro Direct Primary Care. We reserve the right to revise or amend this Notice at any time. Any revision or amendment to this notice will be effective for all of your records that we created or maintained in the past and for any of your records that we may create or maintain in the future. You may request a copy of our most current Notice at any time.

We will not use or share your information other than as described in this Notice, unless you tell us we can in writing. If you tell us we can, you may change your mind at any time. Let us know in writing if you change your mind.

B. Your Privacy Rights Regarding Your PHI

When it comes to your health information, you have certain rights. This section explains those rights.

Get an electronic or paper copy of your medical record.

• Ask to see a copy of your medical record. If you would like to see a copy of your medical records, just let us know. We will grant your written request during business hours within 5 working days of the request. The records can be viewed by you or your personal representative, and either you or the representative may bring one person of your choosing.

• If you would like us to provide you a paper or electronic copy of your health information, usually within 15 days of your request. We may charge a reasonable, cost-based fee to cover the administration of processing this request. .

• If your request for a copy is for the purpose of supporting a claim or appeal for public benefits, then the fee will be waived and one free copy will be provided within 30 days.

• If your medical records include mental health records, we may decline to provide access to these records if we feel there is a substantial risk of significant adverse or detrimental consequences of such access. However, we will release those records to a qualified professional.

Ask us to correct your medical record.

• You can ask us to correct health information about you that you think is incorrect or incomplete. If you wish, you can write an addendum of up to 250 words per incorrect or incomplete item; this addendum will be added to your medical records and will clearly indicate in writing that you request the addendum to be made a part of your records.

Request confidential communications.

• You can ask us to contact you in a specific way (for example, home or office phone), or to send mail to a different address.

• We will agree to reasonable requests. 

Ask us to limit what we use or share.

• You can ask us not to use or share certain health information for treatment, payment, or our operations. We are not required to agree to your request, and we may say “no” if it could affect your care.

• If you pay for a service or health care item out-of-pocket in full, you can ask us not to share that information for the purpose of payment or our operations with your health insurer. We will say “yes” unless a law requires us to share that information.

Get a list of those with whom we’ve shared information.

• You can ask for a list (an accounting) of the times we’ve shared your health information for six years prior to the date you ask, who we shared it with, and why.

• We will include all the disclosures except for those about treatment, payment, and health care operations, and certain other disclosures (such as any you asked us to make). We will provide one accounting a year for free but will charge a reasonable, cost-based fee if you ask for another one within 12 months.

Get a copy of this privacy notice. 

You can ask for a paper copy of this notice at any time, even if you have agreed to receive the notice electronically. We will provide you with a paper copy promptly.

Choose someone to act for you.

• If you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your health information.

• We will make sure the person has this authority and can act for you before we take any action.

File a complaint if you feel your rights are violated.

• Please let us know if you feel we have not upheld our obligations. Contact us via email at admin@castrodpc.com or by calling (415) 943-4806. 

• You can also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1-877-696-6775, or visiting www.hhs.gov/ocr/privacy/hipaa/complaints/.

• We will not retaliate against you for filing a complaint. 

C. Our Use and Disclosure of Your PHI

Treatment, Payment and Healthcare Operations: We can use or share your health information in the following ways:

• We can use your health information to treat you and may share it with other professionals who are treating you as well.

• We can use and share your health information to run our practice, improve
  your care, and contact you when necessary.

• We can use and share your health information to bill and get payment from
  health plans or other entities.

Disclosures to Friends and Family: We may disclose or share your health information with individuals you have authorization or are otherwise authorized to be involved in your care or treatment, or who are responsible for the payment of your care or treatment. 

Public Health Reporting: We can use or share health information for certain public health purposes. For example, a disclosure may be made for the purpose of preventing or controlling disease, injury, or disability.

Health Oversight Activities: We can disclose your health information to a health oversight agency for investigations, inspections, audits, surveys, licensure and disciplinary actions, and in certain civil, administrative, and criminal procedures or actions, or other health oversight activities as authorized by law.

Legal Actions: We can share health information about you in response to a court or administrative order, or in response to a subpoena.

Law Enforcement: We may share your health information if requested by a law enforcement official: (a) regarding a crime victim in certain situations, if we are unable to obtain the person’s agreement; (b) regarding child abuse or neglect; (c) about a death we believe resulted from criminal conduct; (d) regarding criminal conduct on our premises; (e) in response to a warrant, summons, court order, subpoena or similar legal process; (f) to identify/locate a suspect, material witness, fugitive or missing person; or (g) in an emergency, to report a crime (including the location or victim(s) of the crime, or the description, identity or location of the perpetrator).

Legal Compliance: We will share information about you if state or federal laws require it, including with the Department of Health and Human Services if it wants to see that we are complying with federal privacy law.

Medical Examiners & Funeral Directors: We can share health information with a coroner, medical examiner, or funeral director when an individual dies.

Organ and Tissue Donation: We can share health information about you with organ procurement organizations.

Research: We can use or share your information for health research with your written authorization.

* For more information visit: www.hhs.gov/ocr/privacy/hipaa/understanding/consumers/index.html

** For more information see: www.hhs.gov/ocr/privacy/hipaa/understanding/consumers/noticepp.html