Privacy Policy
Privacy Policy
This Privacy Policy describes how Dermatology and Laser Centre handles information collected through its public website, including information you provide through contact, appointment-request and newsletter interactions and technical information generated when the site is used. Medical-record privacy is addressed separately in the practice’s Notice of Privacy Practices when HIPAA applies.
This page explains what happens to information you give us through this website, and to the basic technical information created when you use it. That includes anything you type into the contact form, the appointment form or the newsletter signup. Your medical records are covered by a separate document, the practice’s Notice of Privacy Practices.
Privacy Policy: the essentials
The short version
Personal information and website-use data handled through the public website and connected website services.
Personal information, and information about how the site is used, handled through this website.
Covered separately by the practice’s Notice of Privacy Practices where HIPAA applies.
Those are covered by a separate document, the practice’s Notice of Privacy Practices.
Information may include contact details, appointment-request information, newsletter preferences, communications you submit, and technical website-use data, depending on the features in use.
Your contact details, what you put in an appointment request, your newsletter preferences, anything you write to us, and technical information about your visit.
Any use or disclosure of website data for advertising must be described accurately and handled according to applicable privacy law and the site’s actual technology settings.
If any information from this website is used for advertising, the policy has to say so plainly and follow the law.
What does this Privacy Policy cover?
What does this policy cover?
It covers information handled through the public website and website-connected services controlled by the practice. It should identify exclusions, such as independent third-party websites and the separate HIPAA Notice of Privacy Practices for protected health information.
Information handled through this website and the services connected to it. It does not cover other people’s websites, and it does not cover your medical records, which have their own separate notice.
- Public browsing and device/log information.
- Contact and appointment-request forms.
- Newsletter or other voluntary signups.
- Cookies, analytics, embedded content and similar technologies that are used on the website.
- Links or transfers to third-party scheduling, mapping, email or other services, where applicable.
- Ordinary browsing, and the technical records your visit creates.
- The contact form and the appointment request form.
- Signing up for the newsletter, or anything else you choose to join.
- Cookies, analytics, embedded content and similar technology used on this site.
- Links or transfers to other services, such as booking, maps or email, where those are used.
What information may the website collect?
What information might be collected?
The website may collect information you choose to provide, such as your name, email address, phone number, scheduling preferences and message content. It may also generate technical information such as IP address, browser/device details, security logs, referral information and cookie or analytics data when those technologies are enabled. Ordinary marketing forms should not request unnecessary medical details.
Whatever you choose to give us: your name, email address, phone number, when you would like to come in, and what you write. The site also records technical things automatically: your IP address, what browser and device you used, security logs, where you came from, and cookie or analytics data, where those are switched on. Ordinary forms should never ask you for medical detail you do not need to give.
| Contact identifiers | Name, email, phone number | Contact/appointment/newsletter forms |
|---|---|---|
| Appointment information | Requested service/visit category, scheduling preferences, new/existing patient status if used | Appointment form |
| Communication content | Message text or question submitted voluntarily | Contact form |
| Subscription preferences | Email address and consent/unsubscribe status | Newsletter platform |
| Device/network data | IP address, browser type, device type, timestamps, requested pages, security logs | Web server/CDN/security tools |
| Cookie/analytics data | Cookie identifiers, traffic events, referral source, analytics measurements | Only if enabled |
| Sensitive/health information | May arise if a user voluntarily includes health details | Minimize; secure workflow/privacy review required |
Who you are Name, email, phone number, from the contact, appointment or newsletter forms.
What you are asking for The kind of visit, the days and times that suit you, and whether you are a new or existing patient.
What you write Whatever you type into the message box.
Newsletter preferences Your email address, and whether you have subscribed or unsubscribed.
Technical information Your IP address, your browser and device, timestamps, the pages you asked for, and security logs.
Cookies and analytics Cookie identifiers, what you did on the site, where you came from, and measurements. Only if those are switched on.
Health information This can arise if you choose to include it. Please do not. If you do, it needs handling securely.
How may information be used?
What is it used for?
Website information should be used only for disclosed, legitimate purposes that match the actual workflow, such as responding to inquiries, routing appointment requests, delivering requested communications, operating and securing the website, measuring performance, and meeting legal obligations.
Only for the purposes set out here: answering you, passing your appointment request to the right person, sending you what you asked for, running and protecting the website, seeing how it performs, and meeting our legal obligations.
- Respond to contact or scheduling requests.
- Operate, maintain, troubleshoot and secure the website.
- Send newsletters or marketing communications only under the practice’s approved consent process.
- Measure website performance/usage only through approved tools and configurations.
- Comply with applicable law, legal process and recordkeeping obligations.
- Replying to you, and dealing with your appointment request.
- Running, maintaining, fixing and protecting the website.
- Sending newsletters or marketing only where you have agreed to receive them.
- Measuring how the website performs, using approved tools only.
- Complying with the law, with legal process, and with record keeping requirements.
Does the website use cookies, analytics or tracking technologies?
Does the site use cookies or tracking?
Cookies and similar technologies may be used for essential site functions, security, analytics, embedded content or other disclosed purposes. The specific technologies and choices offered should reflect the tools actually enabled on the website. Patient and appointment pages require particular care because website activity can reveal sensitive information.
Website analytics. The website uses Amplitude, an analytics service, to understand how visitors use the site: which pages are viewed, which links and buttons are selected, how far a page is scrolled, and anonymized recordings of page activity used to improve the site. Analytics are not linked to your name. Text typed into fields is masked, and the new patient registration form, the contents of the appointment request form and the staff area are never recorded. If your browser sends a Global Privacy Control signal, page recordings are switched off.
Cookies and similar technology may be used to make the site work, to keep it secure, for analytics, for embedded content, or for other purposes set out here. Which ones are actually in use, and what choices you get, depend on what is switched on. Pages about patients and appointments need particular care, because what you do on them can reveal something private about you.
Website analytics. We use a service called Amplitude to see how people use the site: which pages they look at, what they click, how far they scroll, and recordings of page activity with personal details hidden. None of this is tied to your name. Anything you type is hidden, and we never record the new patient form, what you enter when you ask for an appointment, or the staff area. If your browser sends a Global Privacy Control signal, recordings are turned off.
When may information be disclosed to other parties?
When is information shared with anyone else?
Information may be disclosed to service providers that help operate the website or process a request, such as hosting/security, form or scheduling, email and analytics providers, and to professional advisers or authorities when legally required. The categories listed should match the services actually used by the practice.
With the companies that help run the website or handle your request, such as hosting and security, the form or booking system, the email provider, and analytics. And with our professional advisers, or with the authorities, where the law requires it. The list below covers only the categories actually used.
| Hosting/CDN/security | Operate and protect the website | Applies only when this category is actually used or legally required |
|---|---|---|
| Form/scheduling/CRM | Process contact or appointment requests | Applies only when this category is actually used or legally required |
| Email/newsletter provider | Manage subscriptions and messages | Applies only when this category is actually used or legally required |
| Analytics/measurement | Understand site use and performance | Applies only when this category is actually used or legally required |
| Professional advisers | Legal, compliance, accounting or security support | Applies only when this category is actually used or legally required |
| Government/law enforcement | When disclosure is legally required or permitted | Applies only when this category is actually used or legally required |
Hosting and security To run and protect the website.
Forms and booking To process your contact or appointment request.
Email and newsletter provider To manage subscriptions and send messages.
Analytics To understand how the site is used.
Professional advisers Legal, compliance, accounting or security support.
Government or law enforcement Where disclosure is required or permitted by law.
Each of these applies only where that service is actually used, or where the law requires it.
How is health information different from ordinary website data?
How is health information different?
Protected health information handled by a HIPAA-covered practice is governed by the practice’s Notice of Privacy Practices and applicable HIPAA requirements. A website privacy policy should explain website data practices but should not be presented as the HIPAA NPP. If the practice is a covered entity, a current NPP must be prominently available on the website and updated as required.
Your medical records are covered by a separate set of rules, and by the practice’s own Notice of Privacy Practices. This website policy explains what happens to website data. It is not the medical privacy notice, and it does not replace it. Ask the office for the current medical privacy notice.
- An ordinary unsecured contact form is not the place for a detailed health history or medical photographs, and this website does not ask for them there.
- An ordinary website form is not the place for a detailed medical history or photographs of your skin, and we do not ask for them there.
What California privacy disclosures or rights may apply?
What California privacy rights apply?
California privacy rights depend on the law that applies and the type of information involved. When a right applies, the website provides the required notice and a method for exercising that right.
That depends on which law applies and what kind of information is involved. Where a right does apply, this website gives you the required notice and a way to use that right.
How long is information kept and how is it protected?
How long is information kept, and how is it protected?
Information should be retained only as long as reasonably needed for the purpose collected, legal obligations, security, dispute resolution or other legitimate requirements. Reasonable administrative, technical and physical safeguards should be used, although no internet system can promise absolute security.
Only as long as it is reasonably needed for the purpose it was collected for, or for a legal, security or record keeping reason. Reasonable safeguards are used to protect it. But no system connected to the internet can ever be described as completely secure.
- No method of transmission or storage is completely secure, and nothing here claims otherwise.
- Nobody should ever tell you that sending or storing information is 100 percent secure. It is not.
What about children’s information?
What about children's information?
Parents or legal guardians may submit information on behalf of a minor when appropriate. The website is not designed to encourage children to submit personal information independently, and any minor-related workflow should follow applicable privacy and healthcare rules.
A parent or legal guardian may give us information about a child where that is appropriate. This website is not designed to encourage children to send us personal information themselves, and anything involving a minor follows the relevant privacy and healthcare rules.
What happens when I follow a link to another website or service?
What if I click a link to another website?
Third-party services have their own privacy practices. The policy should identify material integrations and explain that external destinations are governed by their own terms and privacy policies.
Other services have their own privacy practices. This policy identifies the important ones we use, and once you leave this site, you are covered by that site’s terms and its privacy policy, not ours.
How will this policy be updated, and how can I ask a privacy question?
How is this policy updated, and how do I ask a privacy question?
This policy may be updated as the website, the services behind it or the law change. The version posted here shows the date it took effect and how to reach the practice with a privacy question.
This policy may change as the site, our services or the law change. The version posted here shows the date it took effect, and how to contact us with a privacy question.
- Effective date: September 17, 2026.
- Privacy contact: office@gallachermd.com, or (925) 820-3376.
- Practice address: 770 San Ramon Valley Blvd #A, Danville, CA 94526.
- Effective date: September 17, 2026.
- Privacy contact: email office@gallachermd.com or call (925) 820-3376.
- Practice address: 770 San Ramon Valley Blvd #A, Danville, CA 94526.
Questions patients ask
Is this Privacy Policy the same as the HIPAA Notice of Privacy Practices?
Is this the same as the medical privacy notice?
No. This policy addresses website data practices. A HIPAA Notice of Privacy Practices explains how a covered healthcare provider may use and disclose protected health information and describes patient rights. If HIPAA applies, the current NPP should be separately linked and available.
No. This page is about information handled by the website. The medical privacy notice explains how a healthcare provider may use and share your health information and your medical records, and what rights you have over them. Ask the office for the current one.
Does the website sell or share personal information?
Do you sell my information?
Whether website data is sold or shared for advertising purposes depends on the technologies in use and the legal definition that applies. The published policy must state the practice’s actual data practices and provide any legally required choices.
Whether website data counts as sold or shared for advertising depends on the technology in use and on the legal definition that applies. The published policy has to state exactly what the practice does, and give you any choices the law requires.
Should I send medical details through the contact form?
Should I send medical details through the contact form?
Use only the information necessary for the initial request. Detailed histories, records or photographs should be submitted only through a practice-approved secure workflow.
Only what is needed for your first request. Detailed histories, records and photographs should only go through a secure route the practice has approved.
Can I control cookies or tracking?
Can I control cookies and tracking?
Cookie or tracking choices vary with the technologies in use and applicable law. When consent or opt-out controls apply, they are provided through the website’s privacy controls.
What choices you get depends on which technologies are in use and on the law that applies. Where consent or an opt out applies, the controls are provided on the website.
How can I make a privacy request?
How do I make a privacy request?
Email office@gallachermd.com or call (925) 820-3376 and say what you are asking for. Where applicable privacy law requires additional ways of making a request, those are provided as well.
Email office@gallachermd.com or call (925) 820-3376, and say what you are asking for. Where the law requires other ways of making a request, those are provided too.
How often should the Privacy Policy be reviewed?
How often is this reviewed?
Review it whenever website data practices, vendors or legal obligations materially change and on the cadence required by applicable law. California guidance also emphasizes keeping privacy policies current.
Whenever what the website does with data, the suppliers, or the legal obligations change materially, and as often as the law requires. California guidance also stresses keeping privacy policies current.
Where to go next
Something here wrong, or something that should not be published? Tell us and we will look at it. Email office@gallachermd.com or call (925) 820-3376, and say which page you mean. That covers a fact that needs correcting, a photograph or a name you would like taken down, and any question about information of your own that appears on this site.
