Privacy Policy

1. Scope of This Policy

This Policy covers personal information collected through the Site and through the calls and text messages described below. It does not replace or modify our HIPAA Notice of Privacy Practices (“NPP”), which describes how we use, disclose, and protect protected health information (“PHI”) created or received in the course of your care at our practice. If anything in this Policy conflicts with the NPP as it relates to PHI, the NPP controls. You may request a copy of our NPP at our office or by contacting us using the information in Section 14.

2. Information We Collect

Information you provide directly. When you submit our contact form, request an appointment, call or text us, or otherwise communicate with us, we collect the information you choose to share. This may include your name, phone number, email address, and the content of your message. Please avoid including detailed medical information in the contact form — our secure Patient Portal is the appropriate place for that.

Information collected automatically. Like most websites, we automatically collect certain technical data when you visit, including your IP address, browser and device type, operating system, the pages you view, the site that referred you, dates and times of access, and approximate general location derived from your IP address. We collect this through server logs, our website security services, and the cookies described in Section 5.

3. How We Use Your Information

We use the information we collect to:

• Respond to your inquiries and appointment requests;
• Schedule, confirm, and send reminders about appointments and follow-up care;
• Route billing and insurance questions to the right team;
• Send communications you have opted into, including text messages (see Section 4);
• Operate, secure, maintain, and improve the Site;
• Comply with legal obligations and protect the rights, safety, and security of our patients, staff, and Site; and
• Fulfill any other purpose we describe to you at the time of collection, or with your consent.

4. Text Messaging (SMS) Program

By providing your mobile number through our website forms, in person, or by opting in through any other channel, you consent to receive calls and text messages from Mercy Grace Private Practice about your appointments, account, and care — including appointment confirmations, reminders, follow-ups, and billing communications. Consent to receive text messages is not a condition of receiving care or services.

• Message frequency varies based on your interactions with us.
• Message and data rates may apply. Contact your wireless provider for details about your plan.
• Opt out at any time by replying STOP or UNSUBSCRIBE to any message from us. You will receive one final message confirming you have been unsubscribed, and you will no longer receive texts from us.
• Need help? Reply HELP to any message or call (480) 745-3702.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties. The information-sharing practices described elsewhere in this Policy exclude your SMS opt-in data and consent.

5. Cookies, Analytics, and Online Tracking

We use cookies and similar technologies for the following purposes:

• Essential and security cookies that make the Site work and protect it, including those set by our website security provider to tell people from automated traffic — for example, when you submit our contact form.
• Analytics. We may use analytics services (such as Google Analytics) to understand, in aggregate, how visitors use the Site so we can improve it.
• Click-fraud protection. Our advertising uses a click-fraud protection service (ClickCease) that reads visits to the Site — IP address, device and browser details, and click behavior — to keep automated and repeat clicks on our advertisements from being charged to us. It sets a cookie for that purpose, and it does not run on our contact form.

We do not use third-party advertising or marketing trackers on pages of the Site where you can enter health-related information, such as our contact form, and we do not permit analytics providers to use Site data to identify you for their own purposes.

Your choices. Most browsers let you block or delete cookies through their settings, and Google offers a browser opt-out for Google Analytics at tools.google.com/dlpage/gaoptout. Because there is no uniform industry standard for “Do Not Track” signals, the Site does not currently respond to them, but the controls above remain available to you.

6. How We Share Information

We do not sell your personal information. We share it only in the following circumstances:

• Service providers. With vendors that perform services on our behalf — such as website hosting and security, our electronic health record and Patient Portal platform, phone and messaging systems, and billing support — under agreements that limit their use of your information to providing those services.
• Our healthcare family. Within the Instinctive Healthcare Solutions family of facilities and brands where needed for operations or continuity of your care, consistent with applicable law. Instinctive HealthPass is a separate company, not part of this family, and is not covered by this clause.
• Legal compliance. When required by law, regulation, subpoena, or other lawful request, or to respond to government or regulatory authorities.
• Safety and security. To protect the rights, property, or safety of our patients, staff, visitors, or others, and to detect and prevent fraud or security threats.
• Business transfers. In connection with a merger, acquisition, financing, or sale of assets, subject to appropriate confidentiality protections.

As noted in Section 4, your SMS opt-in data and consent are excluded from all of the sharing described above.

7. Patient Portal, Appointment Requests, and Instinctive HealthPass

Our secure Patient Portal (MyHealthSpot) and the appointment request tools it offers are provided by a third-party healthcare technology vendor acting on our behalf. When you follow a Patient Portal or “Request an appointment” link from the Site, you leave the Site. Information you submit through those tools — including health information — is protected health information governed by HIPAA, our Notice of Privacy Practices, and the safeguards required by our agreements with that vendor.

Instinctive HealthPass is an affiliated Instinctive Healthcare Solutions company with its own website and privacy policy. The Site links to it but does not enroll you in it. Membership information you present at a visit is handled under our Notice of Privacy Practices and our Financial Policy.

8. Data Security

We maintain administrative, technical, and physical safeguards designed to protect your information, including encryption of data in transit and limits on who can access it. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security. If you have reason to believe your interaction with us is no longer secure, please contact us immediately using the information in Section 14.

9. Data Retention

We keep personal information collected through the Site only as long as needed for the purposes described in this Policy, to comply with legal and regulatory obligations, to resolve disputes, and to enforce our agreements. Medical records are retained in accordance with Arizona law and our records retention policies, as described in our Notice of Privacy Practices.

10. Your Choices and Rights

You may contact us at any time to ask what information we hold about you from your use of the Site, or to request that we correct or delete it, subject to legal and recordkeeping requirements. You can stop text messages by replying STOP and manage cookies through your browser. Rights relating to your medical records — including access, amendment, and an accounting of disclosures — are described in our Notice of Privacy Practices. Where applicable law provides you additional privacy rights, we will honor valid requests as required.

11. Children’s Privacy

We proudly care for patients of all ages, including children. Our Site, however, is intended for use by adults and by parents or guardians acting on a child’s behalf. We do not knowingly collect personal information online from children under 13 without verifiable parental consent. If you believe a child has provided us personal information through the Site, please contact us and we will delete it.

12. Links to Other Websites

The Site links to websites we do not operate, including our Patient Portal provider and social media platforms. We are not responsible for their content or privacy practices, and we encourage you to review the privacy policy of any site you visit.

13. Changes to This Policy

We may update this Policy from time to time. When we do, we will post the revised version here with a new effective date, and for material changes we will provide a more prominent notice on the Site.

14. Contact Us

Phone: (480) 745-3702
Fax: (480) 745-3709