Privacy notice and notice of privacy practices

The Health Initiative, a nonprofit, runs this telehealth service, and Dr. Diana Nieves Castro, MD, provides the medical care. Together they are responsible for the information you give us. For any question about this privacy notice or your information, write to our privacy contact: [email protected]. Our mailing address is on the contact page. If the Spanish and English versions of this notice differ, the Spanish version controls.

The pages of this telehealth service do not load Google Analytics, advertising pixels, LinkedIn, Mautic or session-recording tools. We use no tracking or advertising cookies on them.

Like any website, our servers and our network provider (Cloudflare) process technical data such as your IP address to deliver the pages and protect them from abuse. We do not use it to identify you or for advertising.

Your answer to the confirmation checkbox on the booking page is not sent or saved; we only count, as a daily total, how many times it was ticked. If you arrive from another part of casrai.org, the page reloads fully so that no analytics tool from that site follows you.

To know whether the service works, our own server counts only daily totals, such as how many times a page is opened or the pay button is enabled or clicked, with no cookies, without storing your IP address and with nothing that identifies you; all condition pages are counted as one, and all symptom pages as another, never by name. We also count the language, the visit type and what kind of site you came from (for example, Google), never the exact address.

You pay on Stripe's secure page. Stripe receives your name, email, phone, card details, billing address if it asks for one, your answer that you will be in Puerto Rico during the visit, and the visit type you chose (doctor visit, follow-up visit or school and work forms), so that you are charged the right price.

We send Stripe no health information: no symptoms, no reason for the visit, and not the condition page you came from. After you pay, we receive an internal email notice with your email, phone, visit type and payment reference, so we can contact you and give you a time. Stripe handles payment data under its own privacy policy (opens in a new tab).

Your record, forms, appointment messages and video visit are held by a HIPAA-compliant electronic health record provider. That provider acts as our business associate under an agreement that requires it to protect your information (a BAA). We send you a secure video link; it works on your phone, tablet or computer. Visits are not recorded.

When you sign the informed consent on our page, the signed document is kept privately in a clinic Google Workspace account covered by a business associate agreement (BAA), shared with no one. To be able to prove who signed and when, the signed document records the date and time, your IP address and the type of browser you used. We do not use that data for anything else.

We can use and share your health information without asking for your written authorization to:

We do not sell your information. We do not use it for advertising or marketing, and we do not share it with advertising platforms. Any other use not described in this notice needs your written authorization, which you can revoke at any time, also in writing.

To use any of these rights, write to [email protected]. You have the right to:

We see patients of all ages. In Puerto Rico the age of majority is 21. A parent with patria potestad (parental authority) or a legal guardian signs the consent for a minor and, as their representative, can see the record and use these rights for them, except where the law lets the minor decide for themselves.

With teenagers, the doctor may talk with the patient alone for part of the visit if the parent or guardian agrees. The doctor keeps that conversation private during the visit, but she notes in the record what matters for the patient's health, and the parent or guardian can ask for the record. The doctor must also act if there is a risk that the patient will harm themselves or others. More in the informed consent.

Health professionals in Puerto Rico are required by law to report any suspected abuse or neglect of a child under 18 to the authorities (Ley 57-2023). If the doctor has such a suspicion during a visit, she will report it, and that duty overrides confidentiality.

We protect your information with reasonable administrative, technical and physical safeguards, and we work with providers that commit to do the same. If a breach affects your health information, we will notify you as federal law requires.

We may change this notice. Changes will apply to all the information we hold. The current version and its date will always be on this page. See also the terms of service.

If you think we have not protected your privacy, you can complain to us at [email protected] or to the U.S. Department of Health and Human Services Office for Civil Rights (OCR). We will not retaliate against you for filing a complaint.