Privacy Policy

Scope of this notice

This notice explains how the public website for Dr. Hector Roldan MD handles information. It is separate from the practice's policies and notices governing clinical records and patient care.

This website is an educational and administrative resource, not a patient portal. Its forms are intended only for general inquiries and employment expressions of interest. Do not submit symptoms, diagnoses, test results, medications, photographs, health card numbers, or other sensitive health information.

In this notice, personal health information (PHI) means identifying information about a person's health or health care. In the United States HIPAA context, PHI refers to protected health information. The applicable definition and legal duties depend on the jurisdiction and circumstances.

Information handled by the website

Technical information

Like most websites, the hosting infrastructure may process limited technical information needed to deliver and protect the site, such as:

• IP address, browser type, and device information
• Date and time of a request and the page requested
• Security and diagnostic information needed to prevent abuse and maintain availability

Website inquiry form

If you use the inquiry form, the website collects your name, email address, optional telephone number, inquiry category, optional general question, and acknowledgement of this notice. Please provide only the minimum information needed for the office to route and answer your inquiry.

The public inquiry form is not a patient portal and is not approved for personal health information. If the office needs clinical information, ask the office which approved communication channel to use.

The form is delivered by Web3Forms to the practice's email inbox. Web3Forms therefore processes the form contents and technical information associated with the submission. Its current privacy policy states that submission data may be processed using providers in multiple regions and may be retained for up to three years. Review that policy before submitting. You can call the office instead.

Employment form

If you send an expression of interest through the team page, the form collects your name, email address, optional telephone number, professional area and experience, optional professional-profile link, and acknowledgement of this notice. Do not submit a social insurance number, health information, references, identification documents, date of birth, or other unnecessary sensitive information.

Patient assistant

The patient assistant is a rule-based feature that runs on the page. What you type is not sent to the practice, an artificial intelligence service, or a website server, and message text is not saved in browser storage. You can erase the visible conversation with the assistant's Clear control; reloading or leaving the page also removes it.

Please do not enter personal health information. The assistant provides general navigation and practice information only; it does not diagnose symptoms or provide medical advice.

Direct communications

If you choose a telephone or email link, your communication is handled by the telephone or email providers used by you and the practice. Email and the website inquiry form are for general administrative questions only and may not be appropriate for confidential information. The office will provide an appropriate channel if sensitive information is needed.

Analytics, cookies, and local storage

Google Analytics is optional and does not load unless you select “Allow analytics.” If allowed, it may process information such as pages visited, approximate location, browser and device details, and online identifiers to help the practice understand general website use. The site does not intentionally send form contents, assistant messages, names, email addresses, telephone numbers, health card numbers, or other directly identifying form values to Google Analytics.

The website configures the Google tag with advertising storage, advertising user data, advertising personalization, and Google Signals disabled. It does not use session replay. Google Analytics may place first-party analytics cookies after permission is granted and Google may process analytics information outside Canada under its terms. You can decline without losing site functionality or reopen “Analytics choices” in the footer at any time. Declining disables analytics and removes accessible first-party Google Analytics cookies.

The site stores your analytics choice in local storage. The patient assistant uses session storage only to remember whether its welcome prompt has appeared and whether it should reopen after you follow one of its internal links. It does not place message text in that storage. These interface preferences stay in your browser and are not used for advertising or profiling.

Fonts and visual assets are served from the same website rather than from Google Fonts.

Service providers and processing locations

The public website is hosted using Vercel infrastructure. Website forms are processed by Web3Forms and delivered to the practice's email service. If you allow optional analytics, Google processes analytics information. These providers may process technical, form, communications, or analytics data outside Ontario or Canada, subject to their contractual terms and applicable law. The practice remains responsible for selecting providers and configuring services appropriate to the information involved.

Links to external websites are governed by those websites' own privacy practices. Opening a social-media, map, government, publication, telephone, or email link may disclose information to that external service.

Purpose, retention, and safeguards

Limited technical information is processed to deliver the site, maintain security, diagnose failures, and prevent abuse. Inquiry information is used to route the message, respond to the sender, and administer the practice. Employment information is used to assess a possible professional fit and communicate with the applicant. Optional analytics information is used to understand aggregate website use. Form information is not used for advertising or profiling.

Hosting, analytics, and form providers may retain information according to their service configuration, contracts, privacy policies, and legal obligations. Web3Forms states a maximum submission-data retention period of three years in its current privacy policy. Copies delivered to the practice's email system are retained according to the practice's operational, professional, and legal requirements. Google Analytics retention is controlled through the practice's Analytics property settings.

Website safeguards include:

• Encrypted HTTPS connections
• Browser security and anti-framing headers
• A restrictive content security policy
• No file-upload feature and prominent instructions not to submit personal health information
• Required privacy acknowledgement, field-length limits, and anti-spam honeypots
• No Google Analytics request before an affirmative analytics choice
• No form fields or patient-assistant messages intentionally sent to Google Analytics
• No remotely hosted fonts

No internet transmission or storage system can be guaranteed completely secure. Please use the office's approved communication channels for confidential information.

Clinical records and health privacy

The practice handles patient records under Ontario's Personal Health Information Protection Act (PHIPA), applicable professional requirements, and its clinical privacy procedures. This public website is not the system used to collect or manage those records.

HIPAA is a United States law whose application depends on the organization, transaction, and use case. Google states that it does not offer a HIPAA Business Associate Agreement for Google Analytics, and this site is not intended to disclose protected health information to Analytics. A website analytics consent banner is not a HIPAA authorization. This website notice is not a HIPAA Notice of Privacy Practices and does not represent that the practice or every service it uses is HIPAA compliant. Any service intended to process U.S. protected health information requires a separate legal, contractual, privacy, and security assessment before use.

Your choices and rights

You can:

• Use the website without entering information into the patient assistant
• Call the office instead of submitting a website form
• Decline optional analytics or change your selection using “Analytics choices” in the footer
• Clear the assistant conversation using its Clear control
• Block or clear browser storage through your browser settings
• Contact the Privacy Officer about website privacy
• Ask the practice about access or correction rights for clinical records
• Make a complaint to the Information and Privacy Commissioner of Ontario

Changes to this notice

We may update this notice when the website, its providers, or legal requirements change. The date above identifies the current version. A material change to online collection or tracking should be reflected here before the feature is enabled.

Contact the Privacy Officer

For questions about this notice, website privacy, or the practice's handling of personal information, contact:

Do not include personal health information in an ordinary email. You may also contact the Information and Privacy Commissioner of Ontario.