Privacy Policy

1. Introduction

This Privacy Policy explains how ThriveWell Health ("we," "us," "our") collects, uses, discloses, and protects information gathered through our website, patient portal, and online appointment request forms (collectively, the "Site"). This Policy applies to website and general personal information practices. Our separate Notice of Privacy Practices governs how we handle Protected Health Information ("PHI") under HIPAA once you become a patient.

2. Information We Collect

Information You Provide Directly:

• Appointment Request Form: name, date of birth, phone number, email, patient status, visit type, preferred date/time, insurance provider, and reason for visit/notes.
• Patient Portal Registration/Login: username, password (stored encrypted/hashed), and account security information.
• Contact Forms/Communications: any information you include when emailing or messaging our office.

Information Collected Automatically: IP address, browser/device type, pages visited, and time on Site, via server logs and/or analytics tools. Cookies are used to operate the Site and remember preferences.

Information Collected as a Patient: Once you become a patient, health information collected during care (history, diagnoses, medications, treatment notes, labs, etc.) is PHI and is governed by our Notice of Privacy Practices, not this general Privacy Policy.

3. How We Use Your Information

• Schedule, confirm, and manage appointment requests
• Communicate with you about your appointment, services, or account
• Operate, maintain, and improve the patient portal and Site
• Verify insurance and process billing-related inquiries
• Comply with legal, regulatory, and accreditation requirements
• Maintain security and integrity of our systems
• Send administrative communications related to your care

We do not sell your personal information or PHI.

4. How We Share Information

We may share information with our workforce (for treatment, payment, operations), business associates/service providers (website host, patient portal/EHR vendor, scheduling platform, IT support) under agreements including Business Associate Agreements where PHI is involved, insurance companies for coverage/claims, legal or regulatory authorities when required, and successors in the event of a practice sale, subject to applicable protections.

5. Data Security

We use administrative, technical, and physical safeguards including encryption in transit (and at rest where applicable), access controls, secure hosting with signed BAAs where PHI is handled, and regular security reviews. No method of transmission or storage is 100% secure.

6. Data Retention

We retain personal information and health records as long as necessary to provide services and comply with legal/regulatory obligations, including North Dakota medical record retention requirements.

7. Your Choices and Rights

You may request correction/deletion of non-clinical contact information, update portal account details directly, disable cookies via your browser, and opt out of any marketing communications. PHI-specific rights (access, amendment, accounting of disclosures, restrictions, confidential communications) are described in our Notice of Privacy Practices.

8. Children's Privacy

Our appointment request form may be used by parents/guardians on behalf of minor patients. We do not knowingly collect information directly from children outside this context.

9. Third-Party Links and Services

Our Site may link to or use third-party services (e.g., patient portal platform, payment processor, scheduling tool). This Policy does not apply to those third parties; please review their respective policies.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The updated version will be posted here with a revised effective date.

11. Contact Us

ThriveWell Health
3210 27th St W STE 104
Williston, ND 58801
Phone: (701) 503-3778
Email: hello@thrivewellhealthnd.com

For questions specifically about your health records or HIPAA rights, please refer to our Notice of Privacy Practices.