Website Privacy Policy
1.Introduction
Firm Hill Cardiometabolic Center (“Firm Hill,” “the Practice,” “we,” “us,” or “our”) respects the privacy and confidentiality of individuals who visit our website, inquire about our services, or receive medical care through our practice.
This Website Privacy Policy describes how we collect, use, disclose, protect, and manage personal information obtained through our public website and associated nonclinical digital services.
Our commitment is to handle personal information responsibly, transparently, and in accordance with applicable federal and Texas law.
This policy applies to our public website, general inquiries, membership information requests, and other website-based interactions.
Protected health information maintained by Firm Hill in its capacity as a healthcare provider is governed by applicable healthcare privacy laws and our separate HIPAA Notice of Privacy Practices.
Where applicable law provides greater protection than this policy, that law controls.
2.Information We Collect
Depending on how visitors interact with our website, we may collect the following categories of information:
Information Provided Voluntarily
- Name
- Email address
- Telephone number
- General contact inquiries
- Program or service interest
- Preferred appointment or enrollment period
- Communication preferences
- Information voluntarily submitted through permitted website forms
Technical and Website Information
- IP address
- Browser type
- Device type
- Operating system
- Website navigation and interaction data
- Referral information
- Cookies and similar technical identifiers, where enabled
Appointment and Patient Information
When visitors proceed to our designated patient portal, clinical scheduling, or intake services, additional information may be collected and processed through Tebra or other authorized clinical service providers.
Depending on the service and configuration, this information may include identification details, appointment information, medical history, health records, insurance information, and payment-related information.
Such information is subject to the applicable privacy requirements and contractual arrangements governing those services.
We do not intentionally request detailed medical histories, diagnoses, laboratory reports, or other sensitive clinical information through ordinary public website contact forms.
3.How We Use Information
We may use information collected through our website to:
- Respond to inquiries.
- Provide information about available services.
- Facilitate appointment requests and enrollment inquiries.
- Administer appropriate waitlist communications.
- Maintain and improve website functionality.
- Protect website security and prevent misuse.
- Comply with applicable legal obligations.
- Communicate administrative information relevant to a visitor's request.
- Maintain business records as permitted or required by law.
We will not use protected health information for purposes prohibited by applicable law.
Promotional communications, where offered, will be subject to applicable consent and opt-out requirements.
4.Healthcare Information and HIPAA
Certain information maintained by Firm Hill in connection with healthcare services may constitute protected health information under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and applicable regulations.
Where Firm Hill is acting as a HIPAA-covered entity, protected health information will be used and disclosed only as permitted or required by applicable law or pursuant to a valid authorization.
Our separate HIPAA Notice of Privacy Practices explains the permitted uses and disclosures of protected health information and patients' associated rights.
A general website privacy acknowledgment does not constitute authorization for uses or disclosures of protected health information that require a separate HIPAA-compliant authorization.
5.Patient Portal and Third-Party Clinical Services
Firm Hill uses Tebra as its designated patient portal and primary clinical scheduling platform.
When visitors access the patient portal or related services, they may be redirected to a website or application operated by Tebra.
These services may support patient registration, scheduling, intake, clinical communications, health record access, and billing, depending on the Practice's enabled features.
Firm Hill remains responsible for its own obligations under applicable privacy and healthcare laws.
The use of third-party clinical systems does not eliminate our responsibilities to protect patient information.
Patients should review applicable portal instructions and privacy disclosures.
Insurance Acceptance Checker
Read the [Standalone Consultation — Financial, Patient Access & Compliance Policy](/legal/standalone-consultation-policy), which now includes the Insurance Acceptance Checker Privacy and Data Protection Policy, for the checker’s privacy safeguards, limitations and separate secure onboarding process.
Our Insurance Acceptance Checker lets visitors see whether an insurance company and service appear in Firm Hill's practice-confirmed directory without providing a name, email address, telephone number, date of birth, member identification number or other personal information.
The website loads the published directory, which contains only insurance company and service information, and compares the visitor's selections on the visitor's own device. The application is designed not to send those selections to Firm Hill, store them in our database, the Staff Portal, cookies, local or session storage, analytics or application logs, or include them in web addresses or third-party tracking scripts.
Unavoidable technical processing still occurs when the page and directory are loaded: like any website, our hosting and infrastructure providers may automatically process standard request information such as IP address, browser type and the time of the request for security and operation. These requests do not include the visitor's checker selections.
A checker result is a preliminary directory match only. It does not establish active coverage, eligibility, benefits, authorization or payment. Patients who continue to onboarding do so separately through Tebra, where Tebra's own invitation, authentication and privacy practices apply and where coverage is verified.
6.Information Sharing and Disclosure
We may disclose information to the following categories of recipients when appropriate and legally permitted:
Authorized Service Providers
Technology, website hosting, communications, scheduling, payment processing, and administrative service providers acting on our behalf.
Clinical Service Providers
Authorized healthcare technology vendors, laboratories, pharmacies, referral providers, and other participants in patient care, as permitted by applicable law.
Legal and Regulatory Authorities
Government agencies, regulators, courts, and law enforcement authorities when disclosure is required or otherwise permitted by law.
Professional Advisers
Attorneys, accountants, insurers, auditors, and other professional advisers, subject to applicable confidentiality requirements.
Where a vendor acts as a HIPAA business associate, Firm Hill will obtain the required contractual assurances, including a Business Associate Agreement where applicable.
We do not sell protected health information.
We do not disclose protected health information to advertising platforms for targeted advertising without a lawful basis and any authorization required by HIPAA.
8.Data Security
Firm Hill maintains administrative, technical, and organizational safeguards appropriate to the nature of the information it processes and applicable legal requirements.
Such measures may include access restrictions, authentication controls, encryption where appropriate, vendor oversight, secure communications, workforce training, and incident response procedures.
No internet-based system can be guaranteed to be completely secure.
Users should avoid sending confidential medical information through ordinary website forms, public messaging services, or unsecured email.
9.Data Retention
We retain personal information only for as long as reasonably necessary to fulfill the purposes for which it was collected, meet legitimate operational requirements, and comply with applicable laws.
Clinical records are maintained according to applicable medical record retention requirements and professional obligations.
Retention periods may differ depending on the information involved.
When information is no longer required, we will dispose of or de-identify it as appropriate and consistent with applicable requirements.
10.Individual Privacy Rights
Depending on the nature of the information and applicable law, individuals may have rights to:
- Request access to certain personal information.
- Request correction of inaccurate information.
- Request deletion where legally applicable.
- Request information about certain disclosures.
- Exercise applicable privacy choices.
- Submit a privacy complaint.
Rights concerning protected health information are described in our HIPAA Notice of Privacy Practices.
Some information may need to be retained despite a deletion request because of medical record retention laws, legal obligations, or other permitted exceptions.
We will not discriminate or retaliate against individuals for exercising legally protected privacy rights.
11.Electronic Communications
Visitors who provide contact information may receive communications responding to their inquiries, scheduling requests, or other administrative needs.
Email and ordinary text messages may present confidentiality risks.
Clinical information should be communicated through approved secure channels whenever appropriate.
Any use of electronic communications for clinical purposes will be subject to applicable consent, security, and practice communication policies.
Providing a telephone number or email address does not automatically authorize unrestricted marketing communications.
12.Children's Privacy
Firm Hill's clinical services are intended for adults.
Our public website is not directed toward children under 13, and we do not knowingly solicit personal information from children under 13 through general website services.
If we become aware that information was collected in violation of applicable children's privacy laws, we will take appropriate corrective action.
13.External Websites
Our website may contain links to third-party websites, including patient portal services, pharmacies, publications, and educational resources.
Third-party websites may operate under their own privacy policies and security practices.
Firm Hill is not responsible for the independent privacy practices of unrelated third-party websites, except to the extent responsibility is imposed by applicable law.
14.Data Security Incidents
If Firm Hill becomes aware of a security incident involving personal information, we will investigate, assess, contain, and respond to the incident in accordance with applicable law.
Where notification is required, affected individuals and appropriate authorities will be notified within legally applicable timeframes.
15.Changes to This Policy
We may revise this policy to reflect changes in law, technology, services, or information practices.
The current version will be posted on our website with an updated effective date.
Material changes will be communicated when required by law.
16.Contact Information
For questions about this policy or to submit a privacy request, contact:
Firm Hill Cardiometabolic Center
Privacy Contact: name or title — pending
Email: admin@firmhillcenter.com
Telephone: 830 444 4477
Mailing Address: 5900 Balcones Dr. Ste 100, Austin TX 78731
Important: This Website Privacy Policy is separate from our HIPAA Notice of Privacy Practices, which governs protected health information maintained by the Practice.