Privacy Policy
1. Who we are and what this policy covers
Last updated: 11/11/2026
Modern Dermatology P.C. (“Modern Dermatology,” “we,” “us”) operates dermatology offices in Westport and Greenwich, Connecticut. This Privacy Policy explains how we collect, use and share information through the following (together, the “Site”):
our website at www.moderndermct.com, including its online shop and newsletter signup. The Site has no contact or appointment-request forms.
This policy does not cover:
Patient systems operated for us by vendors. Our online appointment booking, patient portal, bill payment and telehealth services are run on our behalf by Gleam Health, Sadio and EZDerm. You can also book by phone. Information you enter in those systems relates to your care and is protected under HIPAA and our Notice of Privacy Practices (section 4), not this policy.
Independent third party websites. The Site links to sites we do not operate or control, such as our social media pages on Instagram and Facebook and professional organizations. Those sites have their own privacy policies, and a link is not an endorsement.
Information we receive outside the Site, for example in our offices or by phone. Health information about your care is covered by our Notice of Privacy Practices.
This policy accompanies our Terms of Use. Using the Site or agreeing to the Terms of Use does not, by itself, permit us to use your information for every purpose. Where a use needs your separate consent or written authorization, we ask for it separately (section 3).
2. Information we collect
We collect information in two ways: information you choose to give us, and information collected automatically when you use the Site. “Personal Data” in this policy means information that identifies you or can reasonably be linked to you or your device.
Information you provide. You don’t have to provide any of this to browse the Site. The Site has no contact or appointment-request form; appointments are booked through Gleam Health or by phone (section 1).
When you sign up for our newsletter or promotional texts, you provide your email address or mobile number and your consent choice.
When you buy from our online shop, you provide your name, shipping and billing address, email, phone number and payment card details. Card payments are processed by Squarespace Payments or PayPal, and we do not store full card numbers. If you apply for a job or our Gap Year Program through the Site, you provide contact details, a résumé and other application materials.
Information collected automatically. When you visit the Site, our hosting provider and the services described in section 5 automatically receive technical information. This includes your IP address, browser and device type, operating system, referring website, pages viewed, links clicked, and the date and time of your visit. Some of this information, such as IP addresses and device identifiers, can be linked to you or your device, so we treat it as Personal Data.
3. How we use information and when we ask for consent
We use Personal Data only for the purposes below, and we don’t use it for unrelated purposes without telling you and, where required, getting your consent.
To respond to you: reply to questions about your orders, applications or subscriptions.
To fulfill orders: process payments, ship products, and handle returns.
To operate and secure the Site: host the Site, prevent spam and fraud, and fix problems.
To understand how the Site is used: measure traffic in aggregate, only if you accept analytics cookies (section 5).
To send communications you asked for: newsletters and promotional messages, only as described in section 7.
To meet legal obligations: comply with law, respond to lawful requests, and protect rights and safety.
What needs your separate consent or authorization. Visiting the Site, placing an order, signing up for updates, or continuing to use the Site does not authorize every use or disclosure of your information. We ask you separately before we:
set non-essential (analytics) cookies;
send promotional text messages or make marketing calls using automated technology;
add you to a newsletter or marketing email list [confirm current practice];
use or disclose your protected health information for marketing, or use patient photographs or testimonials. These require a signed HIPAA authorization, which is a separate written form. Accepting this policy or our Terms of Use is not a HIPAA authorization.
Aggregated information. We may create statistics that do not identify you or your device, such as total visits per page, and use or share them to improve the Site and describe our services.
4. Health information and our Notice of Privacy Practices
Health information we create or receive in connection with your care is protected health information (“PHI”) under the Health Insurance Portability and Accountability Act (“HIPAA”). Our [Notice of Privacy Practices](insert link) explains how we use and disclose PHI and your rights over it, and is also available from our office. If this policy and the Notice conflict regarding PHI, the Notice controls.
Booking appointments. Appointments are booked by phone or through Gleam Health, which runs our online scheduling on our behalf; the Site itself has no appointment or contact form. What you enter in Gleam Health, such as your name, contact details and reason for the visit, is PHI. We protect it under HIPAA, our Notice of Privacy Practices and our agreement with Gleam Health, not this policy. General browsing of our public web pages is handled as website information under this policy; section 5 explains how we limit what analytics services receive.
Please use secure channels for health details. Regular email is not designed for detailed medical information, so please don’t send symptoms, photographs or medical history that way. Call us at (203) 635-0770 or use the patient portal instead. If you do send us health information, we still protect it as the law requires.
We do not use or disclose PHI for marketing, including patient photographs and testimonials, without your prior written HIPAA authorization.
5. Cookies, analytics and other tracking technologies
The Site uses essential cookies and services it needs to work and, only with your consent, Google Analytics. We do not use advertising cookies, retargeting pixels or social media tracking pixels [confirm in the technical review], and we do not sell or share Site information for targeted advertising.
Your choices. On your first visit, a cookie banner lets you accept or reject non-essential cookies. Analytics scripts do not load unless you accept. You can change or withdraw your choice at any time with the “Cookie Settings” link at the bottom of every page, and you can block or delete cookies in your browser. [If enabled in CookieYes: We treat a Global Privacy Control (GPC) signal as a request to reject non-essential cookies.] The Site does not respond to “Do Not Track” signals because there is no common standard for them.
Services that run regardless of your cookie choice. Some services load on every visit because they are needed for the Site to work, stay secure or be accessible. They can send technical information such as your IP address and device data to their providers even without cookies.
Squarespace hosts the Site and sets essential cookies for security and site functionality; its optional analytics cookies are turned off. CookieYes displays the cookie banner and stores your cookie choice.
Google reCAPTCHA protects the Site from spam and automated abuse [confirm: on every page or only at checkout and signup]. It sends hardware and software information to Google and is subject to Google’s Privacy Policy and Terms of Service.
The accessiBe accessibility widget provides display options and stores your accessibility preferences. [List any maps, videos or other widgets, with their purpose, or delete this sentence.] The Book Now links take you to Gleam Health’s scheduling pages [confirm they are links, not an embedded widget].
Google Analytics, which measures Site traffic in aggregate, runs only if you accept analytics cookies. See the Google Privacy Policy.
How we configure Google Analytics. Google signals, advertising features and ad personalization are off, and granular location and device data collection is off. We set Google Analytics to remove email addresses and [list] URL parameters before data is stored. That filtering happens after data leaves your browser, so Google still receives technical information such as your IP address when analytics loads. Analytics event data is kept for 2 months. You can also block Google Analytics with the Google Analytics Opt-out Browser Add-on.
6. Who we share information with
We do not sell Personal Data, and we do not share it with third parties for their own marketing or for targeted advertising.
Service providers acting for us. We use vendors to run parts of the Site and our services. They receive only the information they need for their task, may use it only to provide services to us, and are bound by contracts that require confidentiality and security. Vendors that create, receive, maintain or transmit PHI for us sign business associate agreements as HIPAA requires. You don’t need to review or manage these arrangements; they are our responsibility.
Squarespace hosts the Site and receives technical data and shop order information so it can run the Site and process orders. CookieYes receives your consent choice and technical data to record your cookie preferences. If you accept analytics cookies, Google receives technical and usage data to measure Site traffic.
Squarespace Payments or PayPal receives your name, billing details and card data to process shop orders. [Messaging provider] receives your mobile number, message content and consent record to send texts you agreed to receive. [Email provider] receives your email address and subscription status to send newsletters you signed up for.
Gleam Health, Sadio and EZDerm, which run our online booking, patient portal, bill payment and telehealth services, receive the information you enter in those systems so they can provide those services for your care. That information is covered by our Notice of Privacy Practices.
Independent third parties. Some services use information under their own terms rather than only on our behalf, such as Google when it provides reCAPTCHA, social media sites we link to, and [any third party seller you buy from through the Site]. Their privacy policies govern their use of your information.
Other disclosures. We may also disclose Personal Data:
With your consent or at your direction.
In a business transfer, such as a merger, sale or reorganization, subject to this policy and, for PHI, to HIPAA.
For legal reasons, when required by law or when we believe in good faith it is needed to comply with a legal obligation, protect the rights, property or safety of Modern Dermatology, our patients or the public, or defend against legal claims.
7. Appointment messages, marketing and text messaging
We send two kinds of messages, and you sign up for and stop them differently.
Service messages include appointment confirmations and reminders, scheduling follow-ups, billing notices and replies to your inquiries. You receive them when you book by phone or through Gleam Health and give us your contact information for that purpose. To stop them, reply STOP to a text or contact us.
Promotional messages include newsletters, offers, cosmetic service promotions and product announcements. You receive them only if you choose a separate opt-in [checkbox or keyword], which is never required to book, buy or receive care. To stop them, use the unsubscribe link in any email, reply STOP to a text, or contact us.
Promotional texts and calls. We send marketing texts, or make marketing calls using automated technology, only to people who have given express written consent for them. This privacy policy is not that consent; we collect it separately. Consent is never a condition of a purchase or of care. Message frequency varies. Message and data rates may apply. Reply STOP to unsubscribe or HELP for help.
Promotional email. Every promotional email includes a working unsubscribe link and our postal address, and we honor unsubscribe requests within 10 business days.
How your mobile information is shared. We share your mobile number and text-messaging consent only with [messaging provider], which sends texts on our behalf, and only to deliver messages and keep consent records. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent are not shared with any third party except that service provider.
Text messages are not a secure channel, so please don’t send health information by text.
8. Information you send without our asking
If you send us information we did not request, we use it only to respond to you and for the purpose it was evidently sent, and we protect any Personal Data in it under this policy. If it relates to your health care, we treat it as PHI (section 4). We may use general feedback about the Site or our services, without your name, to improve them.
[If the Site has any public comment or posting areas:] Anything you post in a public area of the Site can be seen by others, so please don’t post personal or health information there.
9. How long we keep information
We keep Personal Data only as long as we need it for the purpose it was collected, then delete or de-identify it, unless the law requires us to keep it longer.
Appointment bookings made through Gleam Health or by phone become part of your medical record and are kept for the period Connecticut law requires. Shop orders and payment records are kept for [X years] for tax and accounting purposes.
We keep you on our newsletter and promotional text lists until you unsubscribe, and we keep a suppression list afterward so we continue to honor your opt-out. Marketing consent and opt-out records are kept for [X years] after you unsubscribe, so we can show when consent was given or withdrawn.
Cookie consent records are kept for up to 5 years. Google Analytics event data is kept for 2 months. Server and security logs are kept by our hosting provider, Squarespace, and by Google for reCAPTCHA, for the periods set in their own retention practices, which we do not control. See the Squarespace Privacy Policy and the Google Privacy Policy for details.
10. Security, children, your rights, changes and contact
Security. We take reasonable administrative, technical and physical steps to protect Personal Data from loss, misuse and unauthorized access, disclosure, alteration or destruction. No internet or email transmission is completely secure, so please don’t send health information by regular email.
Children. We do not knowingly collect Personal Data through the Site from anyone under 18. If you believe a minor has given us Personal Data through the Site, contact us and we will delete it unless we must keep it, for example as part of a medical record. Health information of minor patients is handled as described in our Notice of Privacy Practices.
Your rights and choices. You may ask us to access, correct or delete Personal Data collected through the Site, or to stop sending you marketing, by contacting us below. Residents of Connecticut and some other states may have additional rights under state privacy laws, and we respond to requests as those laws require. Your rights over PHI are described in our Notice of Privacy Practices. We do not disclose Personal Data to third parties for their direct marketing.
Changes to this policy. We will post changes here with a new “Last updated” date. If a change materially affects how we use information we already hold, we will give notice [on the Site or by email] and, where the law requires, ask for your consent first.
Contact us. Modern Dermatology P.C., 1032 Post Road East, Westport, CT 06880, (203) 635-0770, info@moderndermct.com