Public website data
The public marketing site should collect only ordinary contact and scheduling information needed to respond to inquiries. It should not request patient information.
Client and patient information
Any PHI or client files should live only in the billing system or a contracted portal under appropriate agreements and access controls—not in public website forms.
Analytics
Use privacy-respecting analytics only on marketing pages. Do not place marketing analytics inside authenticated client portals.
Retention and contact
The final policy should state retention practices, third-party processors, visitor rights that apply in relevant jurisdictions and a public contact method.