Privacy Policy

Peak Heart & Vascular (“we,” “our,” or “the practice”) respects your privacy. This Privacy Policy explains what information we collect through this website, how we use it, who we share it with, how long we keep it, and the choices you have. By using this website, you agree to the practices described here.

This policy covers this website. Our use and disclosure of your medical records is governed separately by our Notice of Privacy Practices, which is published on this site and describes your rights under HIPAA in full.

We collect information in two ways:

• Information you provide — when you request an appointment, submit a contact, careers, or patient-review form, complete a patient intake form, sign up for text messaging, or otherwise communicate with us. Depending on the form, this may include your name, phone number, email address, date of birth, gender, emergency contact, insurance details, allergies, health history, and the reason for your visit.
• Information collected automatically when you submit a form — when you submit any form on this site we record the IP address and browser user-agent the submission came from, together with the date and time. We keep this as a receipt: it evidences when and from where a consent or request was given, and it helps us investigate misuse.
• Website analytics, only with your permission and never on health-related pages — see the section below. We do not run advertising pixels or session-replay tools.

We use Google Analytics, delivered through Google Tag Manager, to understand how visitors find and move through this website so we can improve it. This sets cookies in your browser.

Nothing is set until you agree. When you first visit we ask once, and that single answer covers both analytics and the embedded content described below — if you decline, or simply ignore the request, no analytics cookie is written, no measurement is sent, and no video or financing estimator is loaded from an outside company. You can change your mind at any time by clearing this site's data in your browser settings.

We deliberately exclude our health-related pages from measurement entirely. Analytics does not run on pages about a specific condition, on individual patient form pages, or on the pages where you request an appointment, send us a message, submit feedback, or use the symptom checker. On those pages nothing is reported to Google whether or not you accepted analytics, because the address of such a page can itself reveal something about your health.

We do not use advertising pixels, session-replay tools, or any technology that builds an advertising profile of you, and we do not share analytics data with advertising networks. Google Analytics is configured without advertising features.

Separately, where a page offers content hosted by another company — a provider video or the payment estimator — that content does not load until you click to load it, and until you do, that company receives nothing about your visit. The interactive map on our locations page is the exception: it loads from Google together with the page, so Google receives your IP address and the address of that page when you open it. That page names only our clinics and never a condition, and our addresses and phone numbers are also listed there as plain text.

We use the information we collect to:

• Schedule and confirm appointments and respond to your requests
• Coordinate your care, including prescription refills and medical records requests
• Send administrative messages such as billing and insurance communications
• Evaluate applications for employment when you apply through our careers form
• Operate, maintain, and secure this website
• Comply with legal and regulatory obligations

Medical information that identifies you and relates to your care is Protected Health Information (PHI) under the Health Insurance Portability and Accountability Act (HIPAA). Our use and disclosure of PHI is governed by our Notice of Privacy Practices, which is published on this website and also available at our offices on request. It describes your rights regarding your medical records, how we may use and disclose your information, and how to file a complaint.

Information you submit through this website that becomes part of your medical record is handled under those same protections.

We work with a small number of companies that process information on our behalf. Those that handle Protected Health Information do so under a HIPAA Business Associate Agreement, which contractually binds them to safeguard it and restricts what they may do with it. We do not sell your personal information to anyone.

• Website hosting and infrastructure — hosts this site and the database that stores form submissions.
• Email delivery — delivers appointment confirmations and routes your form submissions to the appropriate staff inbox.
• Payment processing — processes continuing medical education registration payments. Card details are entered on the processor's own secure page and are never received or stored by us.
• Cherry Technologies — provides the optional patient-financing estimator on our payment plans page. It loads only if you click to load it, and any application you begin is governed by Cherry's own privacy policy.
• Google — provides the interactive location map, which loads together with our locations page, and supplies the public reviews shown on our site.
• YouTube — hosts provider video biographies. Videos load only when you choose to play them.

If you opt in to text messaging, we use your mobile number to send appointment reminders, care coordination messages, and administrative updates. Message frequency varies. Message and data rates may apply. You may opt out at any time by replying STOP, and you can reply HELP for assistance.

Your mobile number and your consent to receive text messages are never sold, rented, or shared with third parties for their own marketing purposes. Consent to receive text messages is not a condition of receiving care.

We do not sell your personal information. We share information only as needed to:

• Work with the service providers listed above, under confidentiality obligations and, where PHI is involved, a Business Associate Agreement
• Coordinate treatment with other providers involved in your care, as permitted by HIPAA
• Process payments and verify insurance coverage
• Comply with subpoenas, court orders, or other legal requirements

If you apply for a position through our careers form, we collect your name, contact details, the position you are applying for, your cover note, and your resume if you attach one. We use this information solely to evaluate your application and to contact you about it. Application materials are shared with the hiring staff involved in filling the role and are not used for any other purpose.

Form submissions made through this website are automatically deleted from the website's database 90 days after they are submitted. That window exists so our staff can act on your request and transfer anything clinically relevant into your medical record.

Your medical record itself is retained separately in our clinical records system for the period Arizona law requires, and is not affected by the website retention period above. Newsletter subscriptions are kept until you unsubscribe.

We use administrative, technical, and physical safeguards designed to protect your information, including encrypted and authenticated transmission (HTTPS), encrypted connections to our database, access controls and role-based permissions on our systems, and restrictions that keep patient information out of application logs.

No method of transmission over the internet is completely secure, so we cannot guarantee absolute security, but we work to protect your information consistent with industry standards and HIPAA requirements.

Please do not send detailed medical information to us by ordinary email. Email is not a secure channel. Use the patient portal or call our office for anything sensitive.

Regarding your medical records, you have the right to inspect and obtain a copy of them, to request a correction, to request an accounting of certain disclosures, to request restrictions on how we use or disclose your information, and to request that we communicate with you by a particular method or at a particular address. These rights and how to exercise them are described in full in our Notice of Privacy Practices.

You may also opt out of text messages at any time by replying STOP, unsubscribe from our newsletter using the link in any newsletter email, and decline third-party content on this site by choosing Decline when we ask, or by ignoring the request.

To exercise any of these rights, contact us using the information below.

If you believe your privacy rights have been violated, you may file a complaint with us using the contact information below, and you may also file a complaint directly with the U.S. Department of Health and Human Services, Office for Civil Rights, at www.hhs.gov/ocr/privacy/hipaa/complaints or by calling 1-800-368-1019. We will not retaliate against you for filing a complaint.

If we discover a breach affecting your unsecured protected health information or other personal information, we will notify you as required by the HIPAA Breach Notification Rule and Arizona law, without unreasonable delay.

This website links to third-party services we use for scheduling, bill pay, and the patient portal, and it offers embedded content from the companies named above. Video and the financing estimator are not loaded until you accept them; the interactive map on our locations page loads with that page. Where we can show you the same information without an outside company — our addresses and phone numbers, for instance — we do. Those services have their own privacy policies, and we are not responsible for their practices. Following a link or loading embedded content takes you outside the scope of this policy.

This website is intended for adults. We do not knowingly collect personal information from children under 13 through this website. Where a parent or legal guardian completes a form on behalf of a minor patient, the information is handled as part of that patient's medical record under HIPAA. If you believe a child has provided us information through this site, please contact us and we will delete it.

We may update this Privacy Policy from time to time. The “Last updated” date above reflects the most recent revision. Material changes will be posted on this page.

Peak Heart & Vascular
12361 W Bola Dr, Ste 100, Surprise, AZ 85378
Phone: 602-698-7325
Email: info@peakheart.com