Legal review
Privacy documentation is a release requirement.
This page identifies what must be documented before a real service processes customer information. It is not a completed production privacy notice.
Current website and contact flow
These public information pages do not create an account, accept patient records through a form or send claims. The contact link opens your email app; no message is sent until you choose to send it. FAQ search filters the questions on the FAQ page; its search terms are not sent by the website.
Website hosting can process request metadata. If you send a business email and it is delivered, your email service and ITC handle that message outside this website. Keep patient records, passwords and other sensitive information out of it.
This review does not establish hosting or email retention periods, deletion deadlines, approved vendor terms or a completed privacy notice for those services. Those details must be checked against the actual services and responsible owners; the production-service decisions below remain required.
Required privacy decisions
- Actual data categories, purposes and processing roles
- Approved vendors and applicable agreements
- Access, retention, deletion, export and legal-hold responsibilities
- Incident response and contact channels
- Published notice reviewed against the implemented data flow
These decisions need the responsible business and legal owners. A design prototype does not supply their approval or substitute for legal review.