Privacy Policy

Last Updated: July 8, 2025

Welcome to Sunflower Family Medicine. We are committed to protecting your privacy and handling your personal data in an open and transparent manner. This Privacy Policy describes our policies and procedures on the collection, use, and disclosure of your information when you use our Website and tells you about your privacy rights and how the law protects you.

By using our Website, you agree to the collection and use of information in accordance with this Privacy Policy. For our patients, please note that this policy is supplemented by our HIPAA Notice of Privacy Practices, which provides more detailed information about how we handle your Protected Health Information (PHI).

1. Interpretation and Definitions

Interpretation

The words of which the initial letter is capitalized have meanings defined under the following conditions. The following definitions shall have the same meaning regardless of whether they appear in singular or in plural.

Definitions

For the purposes of this Privacy Policy:

• Company (referred to as either "the Company", "We", "Us" or "Our" in this Agreement) refers to Sunflower Family Medicine, located in Cutler Bay, Florida.
• Cookies are small files that are placed on Your computer, mobile device or any other device by a website, containing the details of Your browsing history on that website among its many uses.
• Country refers to: United States.
• Device means any device that can access the Website such as a computer, a cellphone or a digital tablet.
• Personal Data is any information that relates to an identified or identifiable individual. This may include, but is not limited to, name, email address, phone number, and Usage Data. For our patients, Personal Data may also include Protected Health Information (PHI).
• Protected Health Information (PHI) has the meaning given to it by the Health Insurance Portability and Accountability Act (HIPAA) and generally includes demographic information, medical history, test results, insurance information, and other data that we collect from patients in the course of providing healthcare services.
• Website refers to the Sunflower Family Medicine website, accessible from https://sunflowerfamilymedicine.com/.
• Service Provider means any natural or legal person who processes data on behalf of the Company. This can include third-party companies or individuals we use to facilitate our Website, provide IT and administrative services, or assist us in analyzing how our Website is used.
• Usage Data refers to data collected automatically, either generated by the use of the Website or from the Website infrastructure itself (for example, the duration of a page visit).
• You means the individual accessing or using the Website, or the company, or other legal entity on behalf of which such individual is accessing or using the Website, as applicable.

2. Information We Collect

Types of Data Collected

We collect information about you in a few different ways when you interact with our Website.

Information You Provide Directly

We collect information that you voluntarily provide to us through our Website's forms. This includes:

• Contact Form: When you submit a general inquiry through our contact page, we collect your name, email address, phone number, and the content of your message.
• New Patient Form: When you submit a New Patient Form to prepare for an appointment, we collect more detailed information, which constitutes PHI. This includes your name, date of birth, gender, physical address, phone number, email address, and insurance information. This information is transmitted securely and directly to our office for the purpose of establishing you as a patient and is not stored on the Website's servers.

Usage Data (Collected Automatically)

Usage Data is collected automatically when using the Website. This may include your Device's IP address, browser type, browser version, the pages of our Website that you visit, the time and date of your visit, the time spent on those pages, unique device identifiers, and other diagnostic data.

Tracking Technologies and Cookies

We use Cookies and similar tracking technologies to track activity on our Website and store certain information to improve and analyze our service. You can instruct your browser to refuse all Cookies, but some parts of our Website may not function correctly. For more details on the cookies we use, please see our Cookie Policy if available, or this section.

3. How We Use and Share Your Information

Use of Your Personal Data

The Company uses your Personal Data for the following purposes:

• To Provide Our Services: To manage your registration as a new patient, schedule appointments, and provide you with medical and aesthetic care.
• To Contact You: To respond to your inquiries submitted via our contact form, and to contact you by email, telephone, or SMS regarding appointments, follow-ups, or other information related to our services.
• To Manage Our Operations: For internal administrative purposes, such as verifying your identity or insurance information prior to an appointment.
• To Provide and Maintain our Website: Including monitoring the usage and performance of our Website.
• For Legal and Safety Reasons: We may use your information to comply with our legal obligations, resolve disputes, and enforce our agreements.
• For Other Purposes with Your Consent: We may use your information for other purposes, such as data analysis to improve our services, but we will ask for your explicit consent when required.

Sharing and Disclosure of Your Personal Data

We take your privacy very seriously. We do not sell or rent your Personal Data to any third parties for marketing or solicitation purposes. We may share your personal information only in the following situations:

• Within the Company: Information may be shared with our staff as necessary to provide care and manage your appointments.
• With Service Providers: We may share your information with trusted third-party Service Providers who perform functions on our behalf, such as website hosting or our electronic health record (EHR) system. We have agreements in place (such as Business Associate Agreements under HIPAA) to ensure these providers protect your information.
• For Business Transfers: We may share or transfer your information in connection with any merger, sale of Company assets, or acquisition of our business. We will provide notice before your Personal Data is transferred and becomes subject to a different Privacy Policy.
• To Comply with Law: We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., a court or government agency).
• With Your Consent: We may disclose your personal information for any other purpose with your explicit consent.

4. Your Protected Health Information (PHI) and HIPAA

As a healthcare provider, we are a "Covered Entity" under the Health Insurance Portability and Accountability Act (HIPAA). Information we collect from you in the course of providing medical care, such as through our New Patient Form, is considered Protected Health Information (PHI).

Our policies and procedures for handling your PHI are governed by HIPAA and are described in detail in our **Notice of Privacy Practices (NPP)**. The NPP explains your rights regarding your PHI and our legal duties to protect it. All of our patients receive a copy of our NPP.

You can view our Notice of Privacy Practices here: [Insert Link to Your HIPAA NPP Document]

While this Privacy Policy describes our general data practices on our Website, the NPP provides the legally required details about your health information rights.

5. Your Privacy Rights

You have certain rights regarding the Personal Data we hold about you. Depending on your location, these rights may include:

• The right to access, update, or delete the information we have on you. Please note that our legal and professional obligations (e.g., state medical record retention laws and HIPAA) may prevent us from immediately deleting certain information, particularly PHI.
• The right of rectification. You have the right to have your information corrected if it is inaccurate or incomplete.
• The right to object to or restrict processing of your Personal Data.

Residents of California (CCPA/CPRA)

If you are a California resident, you have specific rights, including the right to know what personal information we collect, the right to request deletion of your information, and the right to opt-out of the "sale" or "sharing" of your personal information. We do not sell or share your Personal Data as defined by the CCPA/CPRA.

Residents of the European Economic Area (EEA) and United Kingdom (UK)

If you are in the EEA or UK, you have rights under the General Data Protection Regulation (GDPR), including the right to data portability and the right to lodge a complaint with a supervisory authority.

To exercise any of these rights, please contact us using the information below. We will respond to your request in accordance with applicable laws.

6. Data Security, Retention, and Transfer

Security of Your Personal Data

The security of your Personal Data is important to us. We use reasonable administrative, technical, and physical safeguards to protect the information we collect. Information submitted via our website forms is transmitted securely. However, no method of transmission over the Internet or method of electronic storage is 100% secure, and we cannot guarantee its absolute security.

Retention of Your Personal Data

We will retain your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy and to comply with our legal obligations. Specifically:

• Information from contact forms will be retained as long as needed to manage the inquiry.
• Protected Health Information (PHI) will be retained in accordance with Florida and federal medical record retention laws.
• Usage Data is generally retained for a shorter period for internal analysis.

Transfer of Your Personal Data

Your information, including Personal Data, is processed at our operating offices in Florida, United States. If you are accessing our Website from outside the United States, please be aware that your information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your jurisdiction. By using our Website, you consent to this transfer.

7. Children's Privacy

Our Website is not directed to children under the age of 13, and we do not knowingly collect personally identifiable information from anyone under 13 through the Website. As a family medicine practice, we treat minors, but we only collect a minor's Personal Data and PHI from their parent or legal guardian with verifiable consent in the context of providing patient care, not through general use of this website.

If you are a parent or guardian and you are aware that your child has provided us with Personal Data through our website without your consent, please contact us.

8. Links to Other Websites

Our Website may contain links to other websites that are not operated by us. If you click on a third-party link, you will be directed to that third party's site. We strongly advise you to review the Privacy Policy of every site you visit. We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services.

9. Changes to this Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date at the top. You are advised to review this Privacy Policy periodically for any changes.

10. Contact Us

If you have any questions about this Privacy Policy, you can contact us:

• By email: [email protected]
• By phone: (305) 217-1736
• By mail: 20351 Old Cutler Rd, Cutler Bay, FL 33189