Orange County Foot & Ankle Group (“we,” “us,” “our,” or the “Practice”) respects the privacy of people who visit our website and communicate with us online.
This Website Privacy Policy explains how we collect, use, disclose, retain, and protect personal information through ocfeet.com and the website features and communications to which this policy applies. It also explains your privacy choices and how to contact us about information we collect.
“Personal information” means information that identifies, relates to, describes, or can reasonably be associated with an individual, directly or indirectly. The information we collect depends on how you interact with the website and which services you use.
This policy describes our information practices. Visiting the website, submitting a form, or acknowledging this policy does not by itself provide consent or authorization for a use or disclosure that requires separate permission under applicable law.
This Website Privacy Policy is separate from a HIPAA Notice of Privacy Practices.
When the Practice is subject to the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (“HIPAA”), our Notice of Privacy Practices explains how we may use and disclose protected health information (“PHI”), our responsibilities concerning that information, and your HIPAA rights.
Please consult the Practice’s Notice of Privacy Practices, available through the website or from our office, for information about medical records and other PHI. You may also contact privacy@toppractices.com to request assistance obtaining the notice.
Information submitted through an appointment request, patient intake form, patient portal, or other website feature may be PHI depending on the information, its context, and the Practice’s role. Information is not automatically outside HIPAA merely because it was submitted before you became a patient or through a publicly accessible page.
This policy does not expand the Practice’s authority to use or disclose PHI. Applicable law and our Notice of Privacy Practices govern our handling of PHI. Other health information may be protected by state medical-confidentiality laws, consumer-health-data laws, or other privacy requirements even when HIPAA does not apply.
Depending on the features you use, we may collect the following information directly from you.
Contact and identification information. Your name, email address, telephone number, mailing address, date of birth when requested, and information needed to identify you or respond to your inquiry.
Appointment and service requests. Your requested appointment date, preferred provider or location, availability, reason for contacting the Practice, and information needed to arrange the service you request.
Health and patient information. Information you provide through an appropriate patient form or clinical service, such as symptoms, health history, medications, insurance information, or documents relevant to your care.
Account information. Login credentials, account preferences, authentication information, and information associated with an account, if the website offers account access.
Communications. Messages, questions, feedback, survey responses, and attachments you send through forms, email, chat, or other available channels.
Payment and transaction information. Information associated with a payment or transaction, such as billing details, payment status, and transaction references. Where an external payment service collects payment credentials, its own notice may also apply.
Preferences and permissions. Your communication preferences, consent choices, privacy requests, and records necessary to document and honor those choices.
Please provide information about another person only when you have authority or another lawful basis to do so. A parent’s, guardian’s, caregiver’s, or representative’s access to another person’s information is subject to applicable law and verification of authority.
When you visit the website, our systems and service providers may collect technical and usage information, including:
Some website tools may process information when a feature loads or while you interact with it, rather than only after you submit a form.
Technical information can be personal information when it identifies or can reasonably be linked to you. We do not assume that information is anonymous simply because it does not include your name.
We do not intentionally use ordinary website tracking to collect the contents of patient forms, clinical messages, medical records, passwords, or payment-card fields.
We may receive information from providers that support our website, scheduling, communications, payments, or patient services. For example, a scheduling service may send us your appointment request, or a payment provider may confirm that a payment was completed.
When you authorize an integration or ask another person or organization to communicate with us, we may receive the information necessary to carry out that request.
Information received from a referring provider, insurer, or another participant in your care is handled under the privacy requirements applicable to that information. This website policy does not independently authorize those exchanges.
We use personal information for purposes appropriate to the information and the context in which it was collected, including to:
These purposes do not authorize unrestricted use of health information. Uses involving PHI, sensitive information, or another legally protected category remain subject to the additional requirements that apply.
Where consent is required, we obtain it through an appropriate process. We do not treat a general contact request as permission to enroll you in unrelated marketing.
The website may use cookies, local storage, pixels, and similar technologies. Cookies are small files stored on your browser or device. Similar technologies may recognize a device, remember a preference, or record an interaction.
Technologies used on the website may support:
Essential functions. Security, authentication, load balancing, form operation, and remembering privacy choices.
Preferences. Features such as language settings or choices you make while using the website.
Performance and analytics. Understanding how the website works, measuring visits, and identifying errors or usability problems.
An outside provider may receive information when its embedded content or service loads. The fact that a technology is described as an analytics, security, or convenience tool does not determine whether its processing is permitted.
Where required, we provide notice and obtain consent before enabling optional technologies. Where website privacy controls are available, you may use them to review or change your choices.
You can also manage cookies through your browser. Blocking certain cookies may affect website features. Deleting cookies may remove saved preferences, so you may need to make your choices again.
We do not sell personal information.
We do not disclose personal information to third parties for cross-context behavioral advertising or use identifiable patient information to create targeted advertising audiences. We do not provide patient lists, appointment details, treatment information, or clinical form responses to advertising platforms for their own advertising purposes.
These commitments do not prevent us from purchasing general advertising that does not depend on disclosing your personal information, or from using appropriately limited service providers to understand website performance.
A cookie selection, this privacy policy, or continued use of the website does not authorize a disclosure of PHI that would otherwise be prohibited. Where HIPAA requires an authorization, that authorization must satisfy HIPAA’s requirements.
Where applicable law requires us to recognize an opt-out preference signal, including Global Privacy Control (“GPC”), we process that signal as a request to opt out of the covered sale, sharing, or targeted-advertising activity.
A signal generally applies to the browser or device sending it. Where required and where we can associate the signal with you, we also apply it to the associated account or information.
A GPC signal is different from a browser’s older “Do Not Track” setting. We do not treat every Do Not Track setting as a standardized instruction to disable all website processing. This does not affect our obligations to honor legally recognized preference signals.
Privacy signals do not ordinarily disable essential security functions or stop information processing necessary to fulfill a service you request.
Please use the communication channel appropriate to your request.
General website forms are intended for inquiries and administrative requests unless the form expressly identifies another purpose. Avoid sending detailed medical information, government identification numbers, payment-card details, or other sensitive information through a general contact form.
Use the Practice’s designated patient portal or other approved clinical channel for medical records, clinical questions, and sensitive patient communications when available.
A warning on a form does not remove our responsibility to protect information we actually receive. If you submit sensitive information through an unintended channel, we will handle it according to the requirements that apply.
Submitting a form or appointment request does not confirm an appointment or, by itself, establish a physician-patient relationship. Our website, privacy email, and general messaging features are not emergency services. For a medical emergency, call 911 or your local emergency number.
We may contact you about your inquiry, appointment, account, transaction, or requested services using the contact information you provide, subject to applicable law and your communication preferences.
Marketing email. You may unsubscribe using the instructions in a promotional email or by contacting privacy@toppractices.com. We honor requests within the period required by law. Unsubscribing from marketing email does not necessarily stop separate administrative or care-related communications that we are permitted to send.
Text messaging. If we offer a text-message program, the enrollment process identifies its purpose and provides any required consent disclosures. Providing a telephone number alone is not treated as blanket consent to every type of automated or promotional message. Consent to marketing texts is not a condition of receiving treatment or purchasing services.
Message frequency depends on the program and your interaction with us. Message and data rates may apply. Where supported, reply STOP to stop texts or HELP for assistance. You may also contact privacy@toppractices.com. We honor other reasonable methods of revoking consent where required by law.
Mobile information. We do not disclose mobile numbers, text-message opt-in records, or consent information to third parties for their own marketing. Service providers may process that information to operate the program on our behalf.
Privacy of communications. Ordinary email and text messages may be accessible to others who use your device, account, or communications service. Let the Practice know if you need an alternative or confidential communication arrangement.
A request to stop messages will be handled according to its scope and applicable law. We will not use the administrative nature of a message to disregard a legally effective revocation of consent.
We disclose personal information only for appropriate purposes and subject to the legal requirements that apply.
Service providers. We may use providers for website hosting, infrastructure, security, customer relationship management, forms, scheduling, patient portals, communications, payments, technical support, and permitted analytics. They receive information relevant to the services they provide.
Where a provider acts on our behalf, we require appropriate contractual restrictions and safeguards. Where a provider is a HIPAA business associate, we enter into a business associate agreement when required. Such an agreement does not, by itself, permit every proposed use or disclosure.
Care and practice administration. Information used or disclosed in connection with your care, insurance, billing, or other clinical operations is governed by the applicable health privacy requirements and our Notice of Privacy Practices.
At your direction. We may disclose information when you direct us to do so or provide a legally sufficient consent or authorization.
Professional advisers. We may disclose information to legal, accounting, insurance, or other advisers when necessary for their work and permitted by law.
Legal requirements and protection of rights. We may disclose information in response to a valid legal requirement or when otherwise permitted to protect safety, investigate misconduct, or establish or defend legal rights. We assess requests for medical and other protected information under the specific confidentiality rules that apply.
Business changes. Information may be involved in a merger, acquisition, restructuring, sale of the Practice, or similar transaction. Any disclosure or transfer remains subject to applicable law, appropriate protections, and continuing obligations concerning medical records and other protected information.
The website may link to or incorporate services provided by other organizations, including patient portals, scheduling tools, payment services, maps, videos, or social media features.
An outside service may receive technical information when you load its content, even before you actively use it. Review the notices and choices associated with services you use.
We remain responsible for our own disclosures and for obligations that apply to vendors acting on our behalf. A link to a third party’s privacy policy does not replace those obligations.
Information you choose to publish on public review sites or social media may be visible to others. Please avoid posting sensitive medical information in public areas. A public review does not give the Practice unrestricted permission to disclose or confirm your patient information.
If the website offers an automated assistant or another AI-supported feature, it may process the information you enter to answer general questions, assist with navigation, route an inquiry, or support an administrative task.
Automated responses may be inaccurate or incomplete. A website assistant is not a substitute for medical advice from a qualified professional, and you should not rely on it for an emergency or treatment decision.
We do not use patient submissions or PHI to train general-purpose AI models or allow providers acting on our behalf to use that information for their independent model training.
We do not use general website interactions to make solely automated decisions about your diagnosis, treatment, or eligibility for care. If a separate service involves a legally significant automated decision or another use requiring additional notice or rights, we provide those protections before the relevant processing occurs.
Do not enter sensitive information into an automated tool unless the Practice identifies that tool as an approved channel for that information.
We retain personal information for the period reasonably necessary for its stated purpose and for applicable legal, professional, security, and recordkeeping obligations.
The period varies by the type of information:
We consider the purpose, sensitivity, continuing need, legal requirements, and applicable limitation periods when setting retention periods.
When information is no longer needed, we delete it, securely dispose of it, or de-identify it as appropriate. Backup deletion follows controlled processes and any deadlines required by law. Legal holds or other obligations may require longer retention of particular records.
We maintain administrative, technical, and physical safeguards appropriate to the information we handle and the services we provide.
Our safeguards are intended to limit unauthorized access, use, disclosure, alteration, and destruction. Security responsibilities also apply to service providers according to their role, agreements, and applicable law.
No website, transmission, or storage system can guarantee absolute security. This does not limit our legal duties.
If a suspected incident occurs, we assess the information involved, investigate as appropriate, take responsive measures, and provide notifications required by applicable law. Different requirements may apply to PHI, other health information, and other personal information.
To report a privacy concern, contact privacy@toppractices.com. Please initially describe the concern without including unnecessary medical records, passwords, or other sensitive material.
Depending on where you live, the information involved, and the laws that apply to the Practice, you may have rights to:
These rights are not identical in every jurisdiction. Exceptions may apply to medical records, legally required records, information about other people, and other protected interests.
Medical-record requests and HIPAA rights follow the procedures in our Notice of Privacy Practices. A general consumer deletion right does not necessarily require deletion of a medical record that the Practice must retain.
We do not unlawfully discriminate or retaliate against you for exercising a privacy right or making a privacy complaint.
Send privacy questions and requests concerning information collected through the website to privacy@toppractices.com.
Describe the request and provide enough information for us to locate the relevant records or interaction. Do not send identification documents, medical records, or other sensitive verification materials unless we arrange an appropriate method.
We may need to verify your identity or authority before providing, correcting, or deleting information. Verification is proportionate to the request and the information involved. We do not require identity verification for an opt-out where the law prohibits that requirement.
An authorized agent, parent, guardian, or other representative may submit a request where permitted. We may ask for evidence of authority and any verification required by law.
You do not need to create a new account solely to submit a privacy request. We respond within applicable deadlines and explain any permitted extension. If we cannot fulfill a request, we explain the reason to the extent required and permitted by law.
Where you have a right to appeal, email privacy@toppractices.com with “Privacy Appeal” in the subject line and explain the decision you want reviewed. We respond within the applicable appeal period and provide information about contacting the appropriate regulator when required.
If you need this policy or assistance with a request in an accessible format, contact the same email address.
Residents of certain states may have additional protections under consumer privacy, medical confidentiality, and consumer-health-data laws.
For example, California law may provide rights to know, access, correct, delete, and opt out of covered sale or sharing, and to limit certain sensitive-information uses. Other state laws may provide rights concerning targeted advertising, profiling, recipients of information, and appeals.
Our statements that we do not sell personal information or disclose it for cross-context behavioral advertising apply regardless of whether a particular state law gives you an opt-out right.
Health-related information outside HIPAA may also be subject to specific restrictions on collection, consent, sharing, sale, and deletion. An exemption under one law does not establish an exemption under every other law.
Where applicable law requires a separate consumer-health-data policy, notice at collection, additional contact method, or supplemental disclosure, we provide it separately. You may contact privacy@toppractices.com for assistance locating the notice applicable to your interaction.
Our general website is intended for a general audience seeking information about the Practice and its services. It is not intended to independently solicit personal information from children under 13.
This does not mean that the Practice refuses pediatric care or does not maintain information about children. Parents, guardians, authorized representatives, and adolescent patients may provide information through approved channels as permitted by applicable law.
Where an online service is subject to the Children’s Online Privacy Protection Act, we provide required notices and obtain verifiable parental consent or rely on an applicable legal exception before the covered collection occurs.
If you believe a child submitted information through a general website feature without appropriate permission, contact privacy@toppractices.com so we can assess the situation and take appropriate action.
Parental access to adolescent medical information is subject to applicable confidentiality laws. We do not assume that a parent or guardian is entitled to every communication or record in all circumstances.
The website is operated for a U.S. medical practice. Information may be processed in the United States and in other locations where approved service providers operate.
Privacy protections and government-access rules may differ between countries. Where applicable law requires a legal basis for processing, additional disclosures, or safeguards for international transfers, we address those requirements for the relevant service.
Visiting the website does not, by itself, constitute legally sufficient consent to every international transfer. If you have questions about where your information is processed, contact privacy@toppractices.com.
We may create and use de-identified or aggregated information for purposes such as measuring service performance, understanding general usage patterns, or improving operations, subject to applicable law.
We treat information as de-identified only when the applicable requirements are satisfied. Removing a name, replacing it with a code, or hashing an identifier does not necessarily make information de-identified.
Where required, we maintain information in de-identified form, do not attempt to re-identify it except for a legally permitted purpose such as evaluating the de-identification process, and require recipients to observe appropriate restrictions.
De-identification of PHI must satisfy HIPAA when HIPAA applies. A plan to de-identify information after receiving it does not independently authorize an otherwise impermissible disclosure.
We may update this policy when website features, information practices, or legal requirements change. We identify the effective or revision date with the published policy.
If a change requires additional notice, consent, or authorization, we provide the notice or obtain the permission required before implementing that change.
Continued website use does not replace consent or authorization required by law, and an updated policy does not retroactively authorize an unlawful use or disclosure.
For questions about this Website Privacy Policy, information collected through the website, privacy choices, or privacy requests, contact:
Orange County Foot & Ankle Group
Website: ocfeet.com
Email: privacy@toppractices.com
Please use the Practice’s designated clinical channels for medical questions. The privacy email is not an emergency or treatment service.
This policy was prepared with reference to the following public guidance and legal resources. Credit is given to the organizations that published these materials. These references do not imply that any agency drafted, reviewed, approved, or endorsed this policy. The policy also contains practice commitments that are not statements of universally applicable legal requirements.
Research reference date: September 17, 2026.