Website Privacy Policy

We may collect:

• Information you provide directly, such as your name, contact information, state, appointment request details, insurance information, payment information, communications, and other information you submit through forms or scheduling tools;
• Technical and usage information, such as IP address, browser type, device information, pages visited, timestamps, and similar Website usage data;
• Portal and account information, if you access patient-facing systems through Website links or integrations.

We may use information to:

• operate, maintain, and secure the Website;
• process appointment requests, intake submissions, and other communications;
• verify eligibility, location, and service availability;
• process payments and support billing functions;
• comply with legal obligations;
• protect patient safety, users, the Clinic, and the Website; and
• improve Website functionality and user experience.

3.1 HIPAA. If Sunflower Clinic is acting as a HIPAA-covered healthcare provider, PHI is governed by HIPAA and our Notice of Privacy Practices rather than by this Website Privacy Policy to the extent of any conflict.

3.2 42 CFR Part 2. If Sunflower Clinic creates or maintains substance use disorder patient records subject to 42 CFR Part 2, those records are subject to additional confidentiality protections.

3.3 No Expanded Use Rights. Nothing in this Privacy Policy authorizes use or disclosure of PHI or 42 CFR Part 2 records beyond what applicable law permits.

We may use cookies and similar technologies for Website operation, security, basic analytics, and functionality.

We do not use patient- or treatment-specific information from the Website for advertising or remarketing in a manner that would reveal or imply health status, treatment interest, substance use disorder status, or similar sensitive information.

If we later adopt optional analytics, tracking, or marketing technologies, we will update this Privacy Policy before those technologies are deployed, and we will evaluate them for HIPAA, 42 CFR Part 2, and state health-privacy compliance.

We may disclose information:

• to service providers who support scheduling, hosting, communications, portal access, billing, payment processing, analytics, or other Website functions;
• to professional advisers and vendors acting on our behalf;
• when required or permitted by law;
• to protect rights, safety, or security; and
• in connection with a merger, reorganization, financing, or transfer of assets, subject to applicable law.

We do not disclose PHI or 42 CFR Part 2 records for advertising or marketing except as permitted by law and any required patient authorization or consent.

We use reasonable administrative, technical, and physical safeguards designed to protect information. No system is completely secure, and we cannot guarantee absolute security.

We retain information for as long as reasonably necessary for Website operations, legal compliance, patient care operations, and defense of claims, subject to applicable law and record-retention requirements.

Depending on the nature of your relationship with Sunflower Clinic and applicable law, you may have rights regarding your information. Rights relating to PHI are described in the Notice of Privacy Practices.

If you wish to ask questions about this Privacy Policy or our data practices, contact us at compliance@sunflowerclinic.com.

Sunflower Clinic currently uses this Website in connection with services for patients who are 18 years of age or older. If Sunflower Clinic later begins serving minors, this Privacy Policy and related consent and intake workflows will be reviewed and updated accordingly.

We may update this Privacy Policy from time to time by posting an updated version on the Website.