Privacy Policy
Overview
Geneva Family Medicine & Aesthetics LLC, doing business as GENEVA Primary Care & Med Spa (“GENEVA,” “we,” “us,” or “our”), respects your privacy. This Privacy Policy explains what information we collect through our website at geneva-med.com (the “Website”), through our online booking, forms, emails and text messages, and in the course of running our practice; how we use and share it; and the choices you have.
There are two kinds of information, and different rules apply to each:
- Protected health information (PHI) we create or receive as your healthcare provider, such as your medical record, is governed by the Health Insurance Portability and Accountability Act (HIPAA) and Georgia law. How we use and disclose PHI is described in our Notice of Privacy Practices. If this Privacy Policy and the Notice of Privacy Practices ever conflict about PHI, the Notice of Privacy Practices controls.
- Website and marketing information, such as how you browse our Website, what you type into a newsletter or offer form, and cookie data, is covered by this Privacy Policy.
Please read this policy together with our Terms of Use.
Information We Collect
Information you give us
- Contact details, such as your name, email address, phone number and mailing address, when you book an appointment, request an offer, download a guide, sign up for emails, call, text or email us.
- Appointment and account information you enter when you book online, buy a membership or package, or pay, such as the service you choose, the time you choose, and payment details. Payment card details are handled by our payment processors; we do not store full card numbers on our Website.
- Health information you provide as a patient (intake forms, medical history, photographs taken for your chart, test results and communications with your care team). This information is PHI and is handled under our Notice of Privacy Practices.
- Answers to website tools, such as a treatment finder or weight-loss estimator. Unless the tool says otherwise, these tools run in your browser and your answers are not sent to us.
Please do not send us detailed health information through general website forms, social media or unsecured email. Use a phone call or your patient channels instead.
Information collected automatically
When you visit the Website, we and our service providers automatically collect certain information using cookies, pixels, local storage, server logs and similar technologies, including:
- device and browser type, operating system, language, screen size, IP address and approximate location derived from it;
- the pages you view (including the page address, or URL, and page title), the website or ad that referred you, advertising campaign codes and click identifiers, and the date and time of your visit;
- how you interact with pages, such as clicks, scrolling, buttons pressed (for example, a “Book” button and which service it was for), videos played and time on page; and
- identifiers assigned to your browser by us or our providers (for example, an analytics client ID).
Because many pages on our Website describe a particular treatment or service, the address and title of a page you visit may indicate an interest in that service. Visiting a page does not make you a patient, and we do not use browsing information to make decisions about your care.
Cookies, Analytics, Advertising and Session Recording
We use the following technologies on our Website. Each provider processes information under its own privacy policy.
- Google Tag Manager, which loads the other tools listed here.
- Google Analytics 4, to measure how visitors find and use the Website and whether online bookings are completed.
- Google Ads, Meta (Facebook and Instagram) and TikTok advertising tools, to measure the performance of our advertising and, where enabled, to show our ads to people who have visited our Website. These tools may receive the information described above, including the address of the page viewed.
- Microsoft Clarity, which records how visitors interact with pages (mouse movements, clicks, scrolling and page content) so we can find and fix problems with the Website. This is sometimes called “session recording.” We configure it to mask what you type into form fields.
- Our own testing cookies, which assign your browser a random identifier and a page version so we can compare versions of a page (A/B testing).
- Local storage in your browser that remembers, for up to 90 days, the ad campaign codes you arrived with, and your accessibility display preferences.
- Embedded services: our online booking provider (Boulevard), our video host (Bunny.net), Google Maps and our website host (Netlify) receive technical information such as your IP address when their content loads.
When you open our online booking, we pass the analytics identifiers and campaign codes described above to our booking provider, so that a completed booking can be counted in Google Analytics. Information sent to analytics and advertising providers is limited to what is described above. We do not send them your medical records, your intake answers, or the contents of your conversations with our care team, and we do not sell your personal information for money.
Your choices
- Browser controls: you can block or delete cookies and local storage in your browser settings, use private browsing, or use a browser or extension that blocks tracking. Some parts of the Website, such as online booking, may not work without cookies.
- Google: Google Ad Settings and the Google Analytics opt-out add-on.
- Meta and TikTok: the ad preferences in your Facebook, Instagram or TikTok account settings.
- Interest-based ads generally: the Digital Advertising Alliance and Network Advertising Initiative opt-out pages.
- Ask us: email careteam@geneva-med.com and we will help.
Our Website does not currently respond to “Do Not Track” browser signals.
How We Use Information
- to schedule, provide, coordinate and bill for care, and to communicate with you about appointments, results and follow-up;
- to answer your questions and send the information, offers or guides you request;
- to send marketing emails and texts where permitted, which you can stop at any time;
- to operate, secure, test and improve the Website and our services;
- to measure and improve our advertising; and
- to comply with law, enforce our terms, and protect the rights and safety of our patients, staff and others.
How We Share Information
- Service providers who work for us, such as our scheduling and payment providers, electronic health record system, laboratories and pharmacies involved in your care, email and text-message providers, website host, and the analytics and advertising providers described above. Where a provider handles PHI for us, we require a HIPAA business associate agreement.
- For care, payment and operations and as required by law, as described in our Notice of Privacy Practices.
- Legal and safety reasons: to comply with a law, subpoena or court order, or to protect rights, property or safety.
- Business transfers: in connection with a merger, sale or transfer of our practice, subject to applicable law.
- With your permission, for any other purpose.
We do not share mobile phone numbers or text-messaging consent with third parties or affiliates for their own marketing or promotional purposes.
Photographs
Clinical photographs are part of your medical record. We use your photographs for marketing (for example, before-and-after images on our Website or social media) only with your separate written authorization. You can revoke that authorization at any time by telling any member of our team or writing to careteam@geneva-med.com. We will stop using the photographs going forward, but we cannot recall material already published or shared by others.
Text Messages and Email
We send appointment reminders, care follow-up and practice updates by text message and email. If you agree to receive marketing texts, our Text Messaging Terms apply. You can stop texts at any time by replying STOP, and stop marketing emails with the unsubscribe link in any email. Stopping marketing messages does not stop essential messages about your care. Text messages and regular email are not fully secure; please do not use them for urgent medical concerns or to send detailed health information.
Your Rights and Choices
Patients have rights under HIPAA to access, copy and request amendment of their medical records, request restrictions and confidential communications, and receive an accounting of certain disclosures. These rights are explained in our Notice of Privacy Practices.
Everyone may ask us to update their contact information, stop marketing communications, or delete website and marketing information we hold about them (other than information we must keep by law, such as medical records). Depending on where you live, you may have additional rights under your state’s law. We will honor requests as required by applicable law.
To make a request, contact us using the details below. We may need to verify your identity before acting on a request, and we will respond within 30 days or the time required by law.
Data Security
We use administrative, physical and technical safeguards designed to protect information, including encrypted systems, access controls, multi-factor authentication for staff, staff training, and HIPAA policies and risk assessments. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a breach of your information occurs, we will notify you and the appropriate authorities as required by HIPAA and Georgia law.
Data Retention
We keep medical records for as long as Georgia law requires (generally at least 10 years after the record is created, and longer for minors) and other information for as long as we need it for the purposes described in this policy, to comply with law, resolve disputes and enforce our agreements.
Children
Our Website is intended for adults. We do not knowingly collect personal information online from children under 13. If you believe a child has given us information through the Website, contact us and we will delete it. Care for patients under 18 requires the consent of a parent or legal guardian except where Georgia law allows a minor to consent.
Links to Other Websites
Our Website links to websites and services we do not control, such as social media, review sites and our booking and payment providers. Their privacy practices are governed by their own policies.
Changes to This Policy
We may update this Privacy Policy from time to time. We will post the updated policy on this page and change the “Last Updated” date. If we make a material change to how we use personal information, we will provide additional notice as required by law.
Contact Us
Geneva Family Medicine & Aesthetics LLC
d/b/a GENEVA Primary Care & Med Spa
3275 North Point Pkwy, Suite 204
Alpharetta, Georgia 30005
Phone: (470) 704-9687
Email: careteam@geneva-med.com
Privacy Officer: Megha Jerath, megha@geneva-med.com
If you believe your privacy rights have been violated, you may file a complaint with our Privacy Officer or with the U.S. Department of Health and Human Services, Office for Civil Rights. We will not retaliate against you for filing a complaint.