Privacy notice and notice of privacy practices

Who is responsible for your information

The Health Initiative runs this telehealth service, and Dr. Diana Nieves Castro, MD, provides the medical care. Together they are responsible for the information you give us. For any question about this notice or your information, write to our privacy contact: [email protected]. Our mailing address is on the contact page. If the Spanish and English versions of this notice differ, the Spanish version controls.

What happens on these pages: no trackers

The pages of this telehealth service do not load Google Analytics, advertising pixels, LinkedIn, Mautic or session-recording tools. We use no tracking or advertising cookies on them.

Like any website, our servers and our network provider (Cloudflare) process technical data such as your IP address to deliver the pages and protect them from abuse. We do not use it to identify you or for advertising.

The eligibility checkboxes on the booking page are not sent or saved. If you arrive from another part of casrai.org, the page reloads fully so that no analytics tool from that site follows you.

Payment: Stripe

You pay on Stripe's secure page. Stripe receives your name, email, phone, card details, billing address if it asks for one, and your answer that you will be in Puerto Rico during the visit. We send Stripe no health information: no symptoms, no reason for the visit, and not the condition page you came from.

After you pay, we receive an internal email notice with your email, phone and payment reference, so we can contact you and give you a time. Stripe handles payment data under its own privacy policy.

Your medical record: SimplePractice

Your record, forms, consent, appointment messages and video visit are in SimplePractice, a health-records platform that acts as our business associate under an agreement that requires it to protect your information (a BAA). Visits are not recorded. See also SimplePractice's privacy policy.

How we use and share your health information

We can use and share your health information without asking for your written authorization to:

• Treat you: for example, getting a prescription to the pharmacy you choose or an order to a lab, or coordinating with another doctor who cares for you.
• Get paid: to charge for the visit and issue refunds. Because we do not bill insurance, we do not send your information to your plan; if you ask for an itemized receipt (superbill), we give it to you.
• Run the service: to manage the service, review the quality of care and meet our obligations.
• When the law requires or allows it: for example, to report suspected child abuse, report notifiable diseases to the Puerto Rico Department of Health, respond to a court order, cooperate with health oversight agencies, or prevent a serious and imminent threat to someone's health or safety.

What we never do

We do not sell your information. We do not use it for advertising or marketing, and we do not share it with advertising platforms. Any other use not described in this notice needs your written authorization, which you can revoke at any time, also in writing.

Your rights over your health information

To use any of these rights, write to [email protected]. You have the right to:

• See and get a copy of your record, on paper or electronically.
• Ask us to correct information you think is wrong or incomplete.
• Ask for a list of the times we shared your information for reasons other than treatment, payment and operations.
• Ask us to limit how we use or share your information. If you paid for the visit in full out of pocket, which is always the case with us, you can ask us not to share that information with your health plan.
• Ask us to contact you in a specific way or place, for example only by email.
• Get a copy of this notice.
• Be notified if a breach affects your health information.

Patients under 21

In Puerto Rico the age of majority is 21. A parent with patria potestad (parental authority) or a legal guardian signs the consent for a minor and, as their representative, can see the record and use these rights for them, except where the law lets the minor decide for themselves.

With teenagers, the doctor may talk with the patient alone for part of the visit if the parent or guardian agrees. That confidentiality has limits: the doctor must act if there is a risk that the patient will harm themselves or others.

Mandatory reporting of child abuse

Health professionals in Puerto Rico are required by law to report any suspected abuse or neglect of a child under 18 to the authorities (Ley 57-2023). If the doctor has such a suspicion during a visit, she will report it, and that duty overrides confidentiality.

Security and breaches

We protect your information with reasonable administrative, technical and physical safeguards, and we work with providers that commit to do the same. If a breach affects your health information, we will notify you as federal law requires.

Changes to this notice

We may change this notice. Changes will apply to all the information we hold. The current version and its date will always be on this page.

Complaints

If you think we have not protected your privacy, you can complain to us at [email protected] or to the U.S. Department of Health and Human Services Office for Civil Rights (OCR). We will not retaliate against you for filing a complaint.

Related pages

• Informed consent
• Terms of service
• Contact
• About us
• FAQ