Draft privacy notice
Privacy and data minimization
This draft describes current project decisions. It is not a final attorney-approved privacy notice.
Current appointment-request handling
When enabled, the platform collects only the minimum data needed for routing and contact: supported location, optional practice selection, broad service intent, name, contact details, contact preference, preferred time window, consent record, and non-public abuse controls.
It is not designed to collect birth date, Social Security numbers, insurance identifiers, payment data, detailed diagnoses, medication details, medical uploads, or other clinical records.
Practice participation applications
When online applications are enabled, we collect your Practice name, authorized contact name, business email, and selected Iowa city. A business phone, public website, and brief business message are optional. We record your consent to participation contact and the submission time.
We use these details to review your application and contact you about participation. They are stored privately for authorized platform personnel and are not published as a directory listing, used for advertising, or included in analytics. Applying does not create an account or approve or publish a Practice.
The form shows the configured retention period. Each application is scheduled for complete deletion after that period through the platform’s retention process. Short-lived abuse controls use keyed hashes instead of storing raw IP addresses; repeated applications are checked for duplicates.
Do not submit patient information, medical history, Social Security numbers, payment information, passwords, or medical records. Use the privacy contact instructions below for a question, correction, or deletion request.
Clinic Accounts
When Clinic Account registration is enabled, we collect the representative’s first and last name, business email, a securely hashed password, required Terms and Privacy acknowledgment with policy versions and time, and an optional newsletter preference. The newsletter choice starts unchecked and can be changed in Account Settings. We do not store a readable account password.
We use this information for private account access, account recovery, email verification when delivery is available, and applications submitted through that account. Verification and recovery codes expire and can be used only once; the account database stores only secure hashes of these codes. Account security records and short-lived abuse controls avoid passwords, patient information, raw IP addresses, and security codes.
The registration form shows the configured account retention period. Account records are scheduled for deletion after that period without a successful sign-in or account update; security audit records have their own limited retention period. Applications keep their separate submission-based deletion deadlines. Deleting an account does not publish, transfer, or delete a public Practice.
An account or verified email does not establish authority over an existing Practice, grant administrator access, or approve a public listing. New applications remain private for administrator review, and existing applications are not claimed merely by matching a name or email. Clinic Accounts do not collect payment or start an active membership subscription.
When the multi-step application is available, we also collect your membership preference, physical Iowa Practice address and ZIP, and any selected approved Services or additional Iowa service areas for private application review. These details follow the application's original submission-based deletion deadline. A plan choice does not start billing, and the submitted location or coverage is not published automatically.
Back and Next save bounded business progress in your private Clinic Account session for up to 30 minutes, subject to account-session expiry. Passwords are not included in that progress. Expiry or sign-out clears access to the progress, and successful submission removes the temporary business draft. Private session files and backup copies require the platform's limited session-retention and cleanup process.
Provide business contact information only. Do not include patient details, medical records, or payment information in account information or support requests. Use the privacy contact instructions below for a question, correction, or deletion request. Production collection remains subject to the approvals described in this draft notice.
Handling, retention, and safety
Appointment-request information is sensitive and is not put in analytics, public URLs, routine logs, or unrelated messaging paths. Access, retention, deletion, vendor review, and security controls must be approved before production collection.
Technical records are limited to operational security needs and avoid storing credentials, request bodies, contact details, and other sensitive fields.
Regulatory status
ChiropractorIowa.com does not state or imply healthcare-regulatory equivalence claims. Any future compliance program requires separate legal and operational review.
Questions and corrections
Use the platform contact page for privacy questions or correction requests. Do not include medical details in a general support message.