Privacy Policy隐私政策

1. TL;DR

• We collect information only when needed to deliver care, run the site, or comply with the law.
• We never sell or rent your personal information to third-party marketers.
• You can access, correct, delete, or unsubscribe at any time.
• This site uses Google Analytics and Google Ads conversion measurement to understand how the site is used and how many calls, bookings, and inquiries our ads bring in. We install no Meta (Facebook) or other advertising pixels, run no remarketing or personalized ads, and send Google no health information or form content; our online health assessment pages load none of these tools. See Sections 2.2 and 9.
• In-clinic medical records are governed by HIPAA — see our HIPAA Notice of Privacy Practices.

2. Information We Collect

2.1 Information You Submit

• Booking form: name, phone, email, preferred clinic, preferred time, reason for visit.
• Contact form: name, phone, email, inquiry topic, message body, marketing opt-in flag.
• Insurance verification: name, phone, email, date of birth, insurance company, member ID, group number, optional notes.
• Newsletter sign-up: email address.
• Fresha online booking (off-site redirect): handled by Fresha under their privacy policy.

2.2 Information Collected Automatically

• Server access logs (recorded automatically by our host, Vercel — not actively collected by us): IP address, browser/OS string (User-Agent), URL requested, timestamp, referrer.
• Site analytics and ad measurement (Google Analytics and Google Ads conversion measurement — see Section 9): the address and title of pages you view; how you reached us (e.g. Google Search, Google Maps, or one of our Google ads, including the ad-click ID); browser and device type; screen size; approximate city (inferred by Google from your IP — Google Analytics neither gives us nor stores your full IP); time of visit and engagement time; and whether you tapped a phone number, online booking, or map directions, or successfully submitted the contact, insurance, video-consult, or newsletter form — we record only that it happened, never what you typed.
• Our online health assessment (/assessment) pages load none of these analytics or advertising tools; your answers are used only to produce your report and for our follow-up, and are never sent to Google or any ad platform.
• We do not collect mouse movement, click heatmaps, or session recordings; we install no Meta (Facebook), TikTok, or other advertising pixels; and we do not perform cross-site behavioral tracking or remarketing.
• Local browser storage preferences (e.g. lastClinic, used to remember which NYC clinic you last viewed — never sent to our servers).

2.3 Information We Do Not Collect via This Website

• Credit-card numbers (online payments are handled by Fresha directly).
• Social Security Numbers.
• Medical records you have not voluntarily submitted.

3. How We Use This Information

• Respond to inquiries, schedule first visits, verify insurance benefits.
• Send appointment reminders, follow-ups, and benefit-verification results (where a care relationship exists).
• Send health-education or event emails only if you opt in; one-click unsubscribe in every footer.
• Analyze site traffic and conversion paths to improve information architecture and accessibility, and count how many calls, bookings, and inquiries our Google ads bring in (aggregate numbers only).
• Comply with NY-state and federal obligations (HIPAA, ADA, consumer-protection laws).

4. How We Do Not Use It

• We never sell or rent your personal data.
• We do not run remarketing or personalized ads: we never target ads to you based on your browsing or health information and build no remarketing audiences; Google Signals and ads personalization are turned off in Google Analytics.
• We never send Google or any ad platform your health information, symptoms, assessment results, insurance carrier, or any form content.
• We do not share your medical information with employers or unrelated insurers without your written authorization (except where required by law).

5. When We Disclose to Third Parties

6. Data Retention

• Bookings / messages / insurance verifications: kept 7 years, matching NY-state medical-record retention.
• Email subscribers: kept until you unsubscribe; removed from active marketing list within 90 days of unsubscribe.
• Web logs (Vercel): rotated after 30–90 days.
• Cookie-linked visitor-level data in Google Analytics: deleted automatically after 14 months (aggregate reports are unaffected).

7. Data Security

• HTTPS (TLS 1.3) site-wide.
• Database (Supabase) uses Row-Level Security; only the server-side service-role can write.
• Admin console secured via HMAC-signed cookies, with sign-in by a strong password or an allow-listed Google account.
• Suspicious access attempts are logged.

That said, no system is 100% secure. Please report suspicious activity or vulnerabilities to service@healthkeygroup.com immediately.

8. Your Rights

Whether you live in NY, another US state, California (CCPA/CPRA), the EU (GDPR), or elsewhere, you have these rights:

• Right to know: ask us what data we hold about you.
• Right to correct: ask us to fix inaccurate information.
• Right to delete: ask us to delete your data (subject to medical-record retention obligations).
• Right to opt out: unsubscribe from marketing at any time.
• Opt out of "sale / sharing": we do not sell your personal information, and we do not "share" it for cross-context behavioral advertising (see Sections 4 and 9). If your browser sends a Global Privacy Control (GPC) signal, we treat it as an opt-out request and stop setting ad-measurement cookies (see Section 9.3).
• Right to complain: file a complaint with the NY State Attorney General or your local data-protection authority.

To exercise any of these rights, email service@healthkeygroup.com with subject "Privacy Request". We respond within 30 days.

9. Cookies, Site Analytics & Your Privacy Choices

9.1 Cookies and Local Storage We Use

• Essential: admin-console session (admin_session, HttpOnly + Secure), plus a sign-in check cookie (__Host-hk_admin_g, HttpOnly + Secure, expires within 10 minutes) when an administrator signs in with Google.
• Preferences: lastClinic in localStorage — remembers the clinic you last viewed so the "Call" button picks the right number; never sent to our servers.
• Analytics (Google Analytics): _ga and _ga_<ID> — distinguish new vs. returning visitors and count visits; kept up to 2 years.
• Ad measurement (Google Ads): _gcl_au and _gcl_aw — tell whether you arrived from one of our Google ads so we can count the calls, bookings, and inquiries our ads bring in; kept up to 90 days.

9.2 Limits We Put on These Tools

• Our online health assessment (/assessment) pages load none of them.
• We never send Google health information, symptoms, assessment results, insurance carriers, or form content; URL parameters other than ad-source tags are stripped before anything is sent.
• Google Signals, ads personalization, and data sharing are off in Google Analytics; Google Ads enhanced conversions are off and we build no remarketing audiences.
• We install no Meta (Facebook), TikTok, or other advertising pixels, and the phone numbers on this site are always the clinics' real numbers — we do not use Google forwarding numbers.

9.3 Your Privacy Choices

• Global Privacy Control (GPC): turn on GPC in your browser or an extension and this site automatically stops setting ad-measurement cookies (_gcl_*) and redacts the ad-click ID sent to Google Ads.
• Opt out of Google Analytics: install Google's official Google Analytics Opt-out Browser Add-on (tools.google.com/dlpage/gaoptout).
• Browser settings: clear or block cookies at any time; declining cookies does not stop you from browsing, calling, or booking online.
• Contact us: email service@healthkeygroup.com with subject "Privacy Request".

Because we run no personalized ads and do not sell or share personal information, this site shows no cookie banner; the choices above are available at any time.

10. Children

This site is not directed to children under 13. If we learn we collected such data, we delete it immediately. Minors must be accompanied by a guardian who signs the consent form.

11. International Transfers

The site is hosted on Vercel (USA) and the database on Supabase (us-east-1, Virginia, USA). If you access from outside the US, your data is transferred to and processed in the US under this policy and US law.

12. Changes to This Policy

Updates are posted on this page with a new "Last updated" date. Material changes (sharing or rights) trigger an email or banner notice.

13. Contact

HealthKey Group · Nikki Zhang, LAc
Manhattan (Chinatown): 139 Centre St #202, New York, NY 10013 · 212-343-9398
Email: service@healthkeygroup.com
Accessibility / privacy issues: service@healthkeygroup.com

This document is informational and not specific legal advice. For questions about your data, contact us at the email above.