Privacy Policy

1. Information We Collect

1.1 Information You Provide Directly

We collect information you voluntarily provide, including:

• Full name, date of birth, and gender
• Contact information: postal address, phone number(s), and email address
• Health insurance information, including policy numbers and group numbers
• Medical history, symptoms, and treatment preferences submitted through intake forms
• Payment information processed through our third-party payment processors
• Communications you send to us via forms, email, phone, or text message
• Username and password if you create a patient portal account

1.2 Information Collected Automatically

When you visit our Website, we automatically collect:

• IP address and approximate geographic location
• Browser type and version, operating system, and device identifiers
• Pages viewed, links clicked, time spent on pages, and referring URLs
• Cookie identifiers and similar tracking technologies (see Section 5)
• Date and time of your visit

1.3 Information from Third Parties

We may receive information about you from:

• ChiroTouch (our patient management and portal platform)
• Google Analytics and Google Business Profile
• Insurance verification services
• Referring healthcare providers

2. How We Use Your Information

We use the information we collect for the following purposes:

• To schedule, confirm, and manage your appointments
• To provide, personalize, and improve our healthcare services
• To process payments and manage your billing account
• To send appointment reminders, follow-up communications, and care-related notifications
• To send SMS text messages and emails as described in Sections 9 and 10 below
• To comply with legal and regulatory obligations, including HIPAA
• To respond to your inquiries and provide customer support
• To analyze Website usage and improve our digital properties
• To send promotional communications where you have provided consent
• To enforce our Terms of Use and other agreements
• To detect, prevent, and investigate fraud, security breaches, and other illegal activity

3. Sharing of Your Information

We do not sell your personal information. We may share your information with:

• Healthcare providers involved in your treatment, in compliance with HIPAA
• ChiroTouch and other technology service providers that support our operations under Business Associate Agreements (BAAs)
• Payment processors (e.g., Stripe, Square) under data processing agreements
• Google Analytics for Website analytics (anonymized and aggregated)
• Legal authorities when required by law, court order, or governmental regulation
• Professional advisors, including attorneys and accountants, under confidentiality obligations
• Successor entities in the event of a merger, acquisition, or sale of assets, subject to the same privacy protections

We do not share mobile information (including phone numbers and SMS consent) with third parties or affiliates for marketing or promotional purposes. All categories of SMS opt-in data and consent are not shared with any third parties.

4. California Privacy Rights (CCPA / CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to Know: You have the right to request disclosure of the categories and specific pieces of personal information we have collected about you, the categories of sources from which that information was collected, the business or commercial purposes for collecting it, and the categories of third parties with whom we share it.
• Right to Delete: You have the right to request deletion of personal information we have collected from you, subject to certain exceptions including our legal obligations and healthcare record retention requirements.
• Right to Correct: You have the right to request correction of inaccurate personal information we maintain about you.
• Right to Opt-Out of Sale or Sharing: We do not sell or share personal information for cross-context behavioral advertising. If this practice changes, we will provide a "Do Not Sell or Share My Personal Information" link on the Website.
• Right to Limit Use of Sensitive Personal Information: You have the right to limit our use of sensitive personal information (including health information) to uses necessary to provide our services.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise any of these rights, please submit a verifiable consumer request by:

• Calling us at (760) 600-5553
• Emailing us at info@pacificspinerehab.com
• Writing to us at 2530 Vista Way, Suite P, Oceanside, CA 92054

We will respond to verifiable consumer requests within forty-five (45) days as required by the CCPA. We may extend this period by an additional forty-five (45) days when reasonably necessary, with prior notice.

5. Cookies and Tracking Technologies

We use cookies, web beacons, pixels, and similar tracking technologies to enhance your experience on our Website. Categories of cookies we use include:

• Strictly Necessary Cookies: Required for the Website to function and cannot be switched off. These include session management and security cookies.
• Performance / Analytics Cookies: Used to collect information about how visitors use the Website, including Google Analytics. Data collected is anonymized and aggregated.
• Functional Cookies: Allow us to remember your preferences and settings.
• Marketing Cookies: Used to deliver relevant advertisements. We may use Google Ads or similar platforms.

You may control cookies through your browser settings. Note that disabling certain cookies may affect Website functionality. California residents may opt out of certain tracking by emailing us at info@pacificspinerehab.com with the subject line "Cookie Opt-Out."

6. Data Security

We implement and maintain reasonable administrative, technical, and physical security measures designed to protect your personal information from unauthorized access, disclosure, alteration, and destruction. These measures include SSL/TLS encryption for data in transit, access controls, and vendor security assessments. However, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

In the event of a data breach affecting California residents, we will provide notification in compliance with California Civil Code § 1798.82 within the time periods required by law.

7. Data Retention

We retain personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, comply with legal obligations (including California healthcare record retention requirements of a minimum of ten (10) years for adult patients), resolve disputes, and enforce our agreements. Health information retained as part of a medical record is subject to HIPAA retention requirements.

8. Children's Privacy

Our Website is not directed to children under the age of thirteen (13). We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13 without verified parental consent, we will take steps to delete that information promptly. If you believe we may have collected information from a child under 13, please contact us immediately at info@pacificspinerehab.com.

9. SMS & Text Messaging

This section describes how Pacific Spine and Rehab collects, uses, and protects information related to our SMS text messaging program, and is designed to comply with the Telephone Consumer Protection Act (TCPA, 47 U.S.C. § 227), FCC regulations, CTIA Messaging Principles and Best Practices, A2P 10DLC carrier requirements, and California Business & Professions Code § 17529 et seq.

9.1 Information We Collect for SMS

When you contact us through our Website, by phone, by email, or through an appointment request form, we may collect information you voluntarily provide, including your full name, phone number, email address, mailing address, appointment information, and information related to your inquiry, treatment, or services. When you visit our Website we may also automatically collect your IP address, browser type, operating system, referring URLs, pages viewed, and the dates and times of your Website visits.

9.2 How We Use Your Information

We may use the information we collect to:

• Respond to your inquiries
• Schedule or confirm appointments
• Send appointment reminders
• Provide administrative information
• Send health tips and care plan updates
• Communicate with you regarding our services

With your consent, we may use your information to send you updates, newsletters, promotions, or marketing communications by email, phone, or text message. You may opt out of promotional communications at any time by following the instructions included in the communication or contacting us directly. We may also use or disclose your information when necessary to comply with applicable laws, regulations, court orders, subpoenas, or other legal obligations.

9.3 Consent to Receive Text Messages

You are not required to consent to receiving text messages from Pacific Spine and Rehab as a condition of purchasing or receiving services.

By providing your phone number and affirmatively opting in, you consent to receive text messages from Pacific Spine and Rehab regarding:

• Appointment confirmations and reminders
• Responses to your inquiries
• Health tips
• Care plan updates
• Service-related information
• Promotional communications when separately authorized

Message frequency may vary. Message and data rates may apply. You may opt out at any time by replying STOPto any text message. After opting out, you may receive one final message confirming that your request has been processed. For assistance, reply HELP or contact us at (760) 600-5553. Carriers are not responsible for delayed or undelivered messages.

You may provide consent by:

• Completing our online patient intake form and checking the SMS consent checkbox
• Signing a paper consent form at either of our clinic locations
• Texting an opt-in keyword such as START or JOIN to our designated SMS number
• Verbally consenting during a call with our staff, which will be documented in your patient record
• Submitting your phone number through a web form that displays clear SMS consent disclosure language at the point of submission

9.4 Information Sharing and Disclosure

We do not sell or rent your personal information. We do not sell, rent, release, transfer, or share your mobile phone number, SMS consent, or SMS opt-in information with third parties or affiliates for third-party marketing or promotional purposes.

We may share information with service providers that perform services on our behalf, such as appointment scheduling, text-message delivery, Website hosting, customer support, technical services, and data security. These service providers may only use your information to perform services for Pacific Spine and Rehab and are required to protect the information they receive. SMS consent and opt-in information will not be shared with third parties for marketing purposes.

We may also disclose information when required by law, regulation, court order, subpoena, or legal process, or when we reasonably believe disclosure is necessary to protect our rights, property, patients, employees, or the public.

9.5 Opt-Out and HELP

You may stop receiving text messages at any time by replying STOP, STOPALL, UNSUBSCRIBE, CANCEL, END, or QUIT to any text message, by calling (760) 600-5553, or by emailing info@pacificspinerehab.com with "SMS Opt-Out" in the subject line. Upon receipt of a valid opt-out request, we will send a single confirmation message and then cease all marketing text messages. Even after opting out of marketing texts, you may still receive transactional messages necessary for patient care (e.g., appointment reminders) unless you request complete cessation of all messaging. We will process all opt-out requests within ten (10) business days.

If you reply HELP to any text message, you will receive the following response:

9.6 Message Frequency, Carriers, and Rates

Message frequency varies based on your appointment schedule. You may receive up to two (2) appointment reminder messages per scheduled appointment and up to four (4) promotional or re-engagement messages per month, plus transactional messages as needed for billing or care coordination. Our SMS program supports all major U.S. wireless carriers. Message and data rates may apply based on your wireless plan. Pacific Spine & Rehab is not responsible for charges incurred through your wireless carrier, and carriers are not responsible for delayed or undelivered messages.

9.7 A2P 10DLC and TCPA Compliance

All commercial text messages are transmitted through the Application-to-Person (A2P) 10-Digit Long Code (10DLC) messaging system, registered with The Campaign Registry (TCR) under the brand "Pacific Spine & Rehab" with a Healthcare / Mixed use case (appointment reminders + marketing). We do not use shared short codes. We comply with TCPA requirements including obtaining prior express written consent before sending autodialed or prerecorded marketing texts, maintaining internal do-not-text lists, and not sending texts before 8:00 a.m. or after 9:00 p.m. in the recipient's local time zone.

9.8 Privacy of Text Message Data

Phone numbers and text message content are personal information and, where applicable, protected health information under HIPAA. We implement reasonable administrative, technical, and physical safeguards designed to protect your personal information from unauthorized access, use, disclosure, alteration, or destruction. However, no method of internet transmission or electronic storage is completely secure, and we cannot guarantee absolute security. We do not sell or share your phone number with third parties for their marketing purposes, and mobile opt-in data and consent records are never shared with third parties.

10. Email Communications

This section governs all email communications sent by Pacific Spine & Rehab and is designed to comply with the CAN-SPAM Act (15 U.S.C. § 7701 et seq.), California Business & Professions Code § 17529 et seq. (California Anti-Spam Act), HIPAA requirements for electronic communications, and applicable FTC regulations.

10.1 Types of Email Communications

Transactional / Relationship Emails (no opt-out required by CAN-SPAM):

• Appointment confirmation and reminder emails
• Post-visit care instructions and follow-up information
• Patient portal access notifications and account alerts
• Billing statements and payment receipts
• HIPAA-related communications and consent acknowledgments
• Responses to your direct inquiries

Commercial / Promotional Emails (opt-out required):

• New patient special offers and promotions
• Newsletter and health tip communications
• Seasonal promotions and service announcements
• Re-engagement / recall campaigns

10.2 CAN-SPAM Act Compliance

All commercial email messages comply with the CAN-SPAM Act, including:

• Accurate header information: All emails clearly identify Pacific Spine & Rehab as the sender using our actual business name and email domain (@pacificspinerehab.com)
• Non-deceptive subject lines that accurately reflect the content of the email
• Identification as advertisement where required for promotional content
• Physical postal address in every commercial email: Pacific Spine & Rehab, 2530 Vista Way, Suite P, Oceanside, CA 92054
• Clear opt-out mechanism operable for at least thirty (30) days after the email is sent
• Prompt opt-out processing within ten (10) business days, with no fee or additional information required
• No third-party transfers of your email address after you have opted out

In compliance with California Business & Professions Code § 17529 et seq., we do not use a third party's domain without permission, falsify header information, use misleading subject lines, harvest email addresses, or send to addresses generated by combining names, letters, or numbers.

10.3 Opt-Out / Unsubscribe

You may opt out of commercial email communications at any time by:

• Clicking the "Unsubscribe" or "Manage Preferences" link included in every commercial email
• Emailing us at info@pacificspinerehab.com with "Unsubscribe" in the subject line
• Calling our office at (760) 600-5553

Opting out of commercial emails does not affect transactional emails necessary for your healthcare, such as appointment reminders and billing statements, unless you request complete cessation of all email communications.

10.4 Email Security and HIPAA

• Unencrypted email is not a secure form of communication for sensitive PHI. We strongly encourage patients to use our secure patient portal (patient.chirotouch.com/PacificSpineRehab) for all health-related communications
• Where patients consent to communicate via email for healthcare purposes, we implement reasonable safeguards and will use encryption where available
• Do not send sensitive health information (including Social Security numbers, insurance policy details, or detailed medical information) via unencrypted email
• If you receive an email from us requesting sensitive personal information, do not respond. Call us directly at (760) 600-5553 to verify the request

10.5 Frequency, Providers, and Recordkeeping

We send commercial promotional emails no more than two (2) to four (4) times per month. Transactional emails are sent as needed based on your appointment schedule and account activity. We may use third-party email service providers (ESPs) contractually prohibited from using your email address for any purpose other than sending emails on our behalf. We maintain records of email consent, opt-in timestamps, and opt-out requests for a minimum of five (5) years or as required by applicable law.

11. Contact for Privacy Inquiries

Pacific Spine & Rehab — Privacy Officer
2530 Vista Way, Suite P, Oceanside, CA 92054
Phone: (760) 600-5553
Email: info@pacificspinerehab.com