Effective September 22, 2026
What this policy covers
This policy covers the Plain Spoken Health public information website and general inquiries sent to its contact email. It does not authorize collection of medical records or describe a live patient portal. Separate information and any required notices will be provided before a records-based service begins.
Information involved
You may choose to send an email inquiry. That email can contain your address, name, message, and anything you attach. Please do not include health details, records, financial information, or another person’s identifying details. For second-opinion connection requests, we ask only for the patient’s city, state or province, and country to help find a suitable practice.
Hosting and email providers may process technical information such as IP addresses, request times, requested pages, browser information, and delivery or security logs to operate and protect their services.
How information is used
We use inquiry information to respond, explain availability and eligibility, arrange next steps, and handle administrative or privacy requests. Technical information supports website delivery, troubleshooting, and security. Please provide only the information needed for your inquiry.
Public website activity
We use Amazon Web Services (AWS) to count views of approved public information pages, clicks on Request a review and sample-case links, FAQ openings, and when the end of a plain-language guide comes into view. Review clicks include a general placement category: header, page content, footer, or mobile button. Your browser sends these limited event categories, the public page name, and a broad referral category such as Google, a social website, another website, or direct or unknown. The collector adds these to daily totals. We use the totals to improve information and understand interest in our services.
These counters do not store IP addresses, full referral URLs, search terms, arbitrary URL query strings, precise visit times, names, email addresses, device fingerprints, visitor identifiers, or individual browsing histories. They are separate from patient records. We do not measure activity in the patient or physician portal, intake, record uploads, payment screens, scheduling, or reports. The portal-entry, review-entry, and records-delivery instruction pages do not load the analytics script.
For advertising and referral links we create, we may read a pre-registered campaign code from the link. It identifies the campaign, not the visitor. The same code is reused for everyone who follows that campaign link. It may be carried to other public pages through their links, with a general marker to distinguish the original arrival from later public-page views. Neither value is carried into the portal, attached to an account or medical record, or sent to advertising platforms. We ignore unregistered campaign codes, advertising click identifiers such as gclid and fbclid, and free-text tracking parameters. We do not use these counts for retargeting or share patient conversions with advertising platforms.
We show up to 90 days of daily totals and manually entered daily advertising costs. Campaign names, sources, landing pages, and their reusable codes are business configuration and remain available while the campaign is kept in our system. Daily totals and daily cost entries are scheduled to expire after 90 days; AWS normally removes expired items within a few additional days. AWS explains automatic expiration. Access to the totals is restricted to the physician workspace and authorized administrators.
No tracking cookies or browser storage are used for these counters. We skip collection when your browser sends Global Privacy Control or Do Not Track through its browser setting. Known crawler and link-preview signatures are filtered using technical request information that is not retained in these counters. A public preview option disables counting and carries that choice across public-page links. Counts remain approximate: repeat views, unrecognized automated traffic, blocked scripts, and missing referral information can affect them. Hosting services still process network information, including IP addresses, to deliver requests; this is distinct from the aggregate counters described here.
Advertising and other page features
The public site does not use advertising pixels, session replay, embedded social widgets, or third-party advertising analytics. It does not collect form entries or file names for analytics. The records checklist uses only page-local checkboxes; we do not receive or store your selections. The downloadable blank release form does not send entries or signatures to this website. Completed releases must be returned only through the secure method provided for the accepted service. Links to outside websites do not load those sites until you choose to visit them.
Service providers and disclosures
Amazon Web Services hosts our website and aggregate activity counters. Our hosting and email providers process information needed to deliver their services. We do not sell inquiry information or use it for targeted advertising. Information may be disclosed when legally required, to respond to valid legal process, or as necessary to address fraud, security incidents, or threats to safety, subject to applicable law.
Health information and HIPAA
This public website does not accept medical records. Do not submit health information by ordinary email.
This website privacy policy is not a HIPAA Notice of Privacy Practices. Whether HIPAA applies depends on the entity’s role and activities. Any notice required for an accepted service will be provided before health records are collected. We do not make a blanket claim that visiting this site, or using email, is “HIPAA compliant.”
Retention and requests
We retain inquiry information as needed to handle the request, administer the service, maintain security, and meet applicable legal obligations. A specific retention period for clinical records is not established by this website policy.
To ask about access, correction, or deletion of inquiry information, email hello@plainspokenhealth.com with the subject “Privacy request.” Please do not attach identification or medical records. We may need to verify your authority through an appropriate method. Some information may need to be retained for legal obligations or in backups.
Security, children, and external links
No online communication method is risk-free. Ordinary email should not be used for sensitive health information. Our service is for adults aged 18 or older; we do not seek information from children. If a child’s information is sent by mistake, contact us. Links to other websites open in a new tab. Those sites have their own privacy practices.
Updates and contact
We will post material updates here with a revised effective date. Privacy questions can be sent to hello@plainspokenhealth.com.