Privacy Policy

Alderon Medical privacy policy: scope and application

This Privacy Policy applies to Alderon Medical’s public-facing WordPress website, related website infrastructure, and the analytics or advertising technologies expressly described in this Policy.

The public website is informational and may host limited nonclinical interest or professional inquiry forms. These forms are not patient intake and are not intended for protected health information. Clinical intake begins only through a secure patient-care workflow specifically designated by Alderon.

This Privacy Policy does not replace Alderon’s Notice of Privacy Practices or other healthcare privacy notices that govern protected health information created, received, maintained, or transmitted in connection with healthcare services when HIPAA or other healthcare privacy laws apply.

Separate privacy notices and terms may apply to Elation, telehealth services, payment processors, laboratories, pharmacies, imaging providers, or other third-party systems used in connection with patient care or business operations.

Who We Are

Alderon Medical is the patient-facing brand and trade name used by SMPA Medical One, LLC.

In this Privacy Policy, “Alderon,” “Alderon Medical,” “we,” “us,” and “our” refer to SMPA Medical One, LLC operating under the Alderon Medical name, as applicable to the public website and related operations.

Information the Public Website May Process

Information you provide through nonclinical forms

Alderon’s public website may provide limited forms for a patient interest list and for professional or organizational inquiries. Depending on the form, information may include name, email address, telephone number, state, service interest, organization, professional role, preferred contact method, referral or source information, and campaign or attribution parameters.

These forms are not patient intake. Do not submit symptoms, diagnoses, medications, medical records, insurance identifiers, discharge summaries, test results, or other protected health information through a public website form.

If you contact Alderon using a telephone number, email address, or other communication channel listed on the website, information you choose to provide through that separate channel is handled according to the nature of the communication and applicable law. Do not send protected health information through ordinary email, social media, or other nonclinical channels unless Alderon specifically instructs you to do so.

Information collected through secure Elation patient intake

When clinical enrollment opens, Alderon plans to use Elation’s secure patient-facing systems for patient registration and clinical onboarding. Depending on the forms and services configured by Alderon, patients may be asked to provide information such as:

• name, date of birth, address, telephone number, and email address;
• demographic and identity information;
• insurance, payer, guarantor, or payment information where applicable;
• medical history, current conditions, symptoms or concerns;
• medications, allergies, surgeries, and relevant prior care;
• laboratory, imaging, discharge, referral, or other healthcare records;
• consents, acknowledgements, signatures, and communication preferences; and
• other information reasonably necessary to establish or coordinate care.

Information submitted through the designated Elation patient-care workflow may constitute protected health information (“PHI”) and is handled separately from Alderon’s public Azure NoPHI lead environment.

Information collected or generated automatically

When you access the public website, hosting, cybersecurity, content-delivery, analytics, and advertising technologies may automatically collect, generate, or receive information such as:

• IP address;
• browser and device type;
• operating system;
• date and time of access;
• requested URL or page;
• referring and exit page information;
• approximate geographic information derived from an IP address;
• cookie, browser, device, or advertising identifiers;
• page views and website navigation events;
• ad or campaign interaction information;
• security and authentication events; and
• error, diagnostic, and performance information.

The exact information depends on the technology, page visited, browser settings, consent or preference controls where applicable, and the configuration in effect at the time of the visit.

Public form submissions may be processed by Microsoft Azure services used by Alderon to receive and store nonclinical lead information. Cloudflare Turnstile may also process technical information needed to evaluate whether a submission appears legitimate and to help prevent automated abuse.

How We Obtain Information

Information associated with the public website may come from:

• your browser, device, or network;
• website hosting, security, and content-delivery infrastructure;
• cookies, pixels, and similar technologies;
• Meta Pixel, as described in this Policy;
• LinkedIn Insight Tag on approved B2B pages, as described in this Policy;
• information you submit through an approved nonclinical website form;
• Microsoft Azure services used to process nonclinical lead submissions;
• Elation Health patient-facing and EHR systems when you complete clinical onboarding or receive care;
• Cloudflare security and bot-management services;
• service providers acting on Alderon’s behalf; and
• third-party websites or systems when you choose to leave the public website and interact with them.

Information entered through Alderon’s public interest forms is limited to nonclinical lead information. Future clinical intake information will be collected only through a separately designated secure patient-care workflow rather than through the public website lead forms.

How We Use Website Information

Alderon may use information associated with the public website for purposes reasonably related to operating, securing, measuring, and improving the website and Alderon’s marketing activities, including to:

• operate, maintain, and secure the website;
• receive and respond to nonclinical patient-interest and professional inquiries;
• provide pre-launch, access, or partnership follow-up requested by the submitter;
• maintain referral-source, campaign, and service-interest attribution;
• through Elation, complete patient registration and clinical onboarding when enrollment opens;
• create or update the patient’s medical record and support clinical review;
• support consent, scheduling, payment, insurance, referral, and care-coordination workflows where applicable;
• troubleshoot errors and improve site performance;
• understand general website usage and navigation;
• detect, investigate, and prevent fraud, abuse, malicious activity, or security incidents;
• measure advertising reach, campaign performance, and website traffic attributable to advertising;
• understand aggregate or audience-level engagement with public marketing content;
• create or use advertising audiences or retargeting capabilities where permitted by law and platform policy;
• measure B2B interest in selected professional content, such as referral-partner, case-management, facility/community, employer-health, and transitional-care information, through LinkedIn where the Insight Tag is approved for that page;
• maintain records necessary for privacy, security, compliance, or legal purposes; and
• protect Alderon, its patients, workforce members, users, and systems.

Alderon does not use the public WordPress website as a clinical intake system. Public lead forms are designed to collect nonclinical information only. Alderon does not intentionally send clinical intake content, Elation data, authenticated patient-system content, or medical-record information to Meta or LinkedIn advertising technologies.

Interest Forms, Health Information, and HIPAA

Some information handled by Alderon in connection with healthcare services may constitute protected health information (“PHI”) under HIPAA or may otherwise be protected by applicable health-privacy law.

When HIPAA applies, the collection, use, disclosure, safeguarding, and individual rights associated with PHI are governed by applicable HIPAA requirements and Alderon’s Notice of Privacy Practices .

Public website versus patient intake

Alderon’s public WordPress website provides information about the practice and may contain limited nonclinical interest forms. A patient-interest form is not a clinical intake form and does not establish a clinician-patient relationship. Patient-specific health information must be provided only through a secure patient-care workflow specifically designated by Alderon.

Alderon’s public interest-list workflow may collect limited personal and eligibility-related information, but it is intentionally designed to exclude patient-specific clinical information. When clinical onboarding becomes available, Alderon plans to collect health history, medications, allergies, records, insurance information where applicable, consents, and other clinical information through Elation’s secure patient-facing systems. Elation is intended to serve as the clinical system of record for that information. This workflow is separate from Alderon’s Azure NoPHI lead environment and is subject to the privacy, security, contractual, and healthcare requirements applicable to patient care.

Elation, HIPAA, and the Business Associate Agreement

Elation Health offers a HIPAA Business Associate Agreement for covered-entity customers using its services. Alderon will not activate PHI-based clinical intake until the applicable Elation service agreement and Business Associate Agreement requirements have been confirmed for Alderon’s account and the practice has completed its own required privacy, security, and risk-management review.

A Business Associate Agreement is one part of HIPAA compliance. Alderon remains responsible for how its workforce configures and uses the system, access controls, minimum-necessary practices, training, risk analysis, incident response, retention, and other safeguards.

Advertising technology boundary

Alderon does not intend to place Meta Pixel, LinkedIn Insight Tag, or similar advertising technologies inside Elation Patient Passport, the Elation EHR, authenticated patient portals, clinical intake systems, medical-record workflows, or other authenticated patient-care environments.

LinkedIn Insight Tag is limited to approved B2B pages directed to organizations and healthcare professionals. If any tagged B2B page is materially changed so that it contains sensitive consumer health content, the tag placement should be reevaluated.

Patients who want independent information about federal health-information privacy rights may review Your Rights Under HIPAA from the U.S. Department of Health and Human Services .

Cookies, Pixels, and Similar Technologies

Alderon’s public website uses or may use cookies, pixels, browser storage, and similar technologies for security, site operation, analytics, advertising measurement, campaign attribution, and audience development.

Necessary and security technologies

Certain technologies may be necessary for functions such as security, fraud prevention, traffic management, website availability, load balancing, session integrity, or remembering privacy preferences.

Cloudflare Turnstile and security services

Alderon may use Cloudflare security services, including Turnstile on approved public forms, to reduce automated abuse and protect website infrastructure. Cloudflare may process technical information associated with a request or form submission for security and bot-detection purposes. Turnstile is used only with approved public NoPHI forms unless a future healthcare-specific implementation is separately reviewed and approved. Alderon does not intend to use the public Turnstile workflow as part of Elation clinical intake or for submission of PHI.

Meta Pixel

Alderon uses Meta Pixel on portions of the public marketing website to help measure advertising performance, understand traffic attributable to Meta advertising, and support audience development or retargeting where permitted by law, platform terms, and Alderon’s page-level privacy controls. Pages that may reveal especially sensitive consumer health interests require separate review before Meta Pixel is permitted to operate on them.

Through Meta Pixel, Meta may receive information such as the page or URL visited, referring information, IP address, browser or device information, timestamps, cookies or similar identifiers, and interactions associated with the tagged page. Meta’s own privacy notices and settings govern Meta’s processing of information it receives.

Alderon does not intend to send clinical intake content, Elation data, authenticated patient-portal content, medical-record information, appointment details, or other patient-specific clinical data to Meta through this website implementation. A privacy notice or cookie preference does not by itself authorize disclosure of PHI or other regulated sensitive health data.

LinkedIn Insight Tag

Alderon uses LinkedIn Insight Tag only on selected B2B and professional pages directed to employers, healthcare organizations, facilities, case managers, discharge professionals, referral partners, and other professional audiences. Approved professional content may include Referral Partners, Case Managers & Discharge Planners, Employer Health, Facility & Community Care, and Transitional Care. The exact active page list may change as Alderon adds, removes, or reviews professional pages.

According to LinkedIn, the Insight Tag may collect information about a website visit such as the URL, referring page, IP address, device and browser characteristics, and timestamp. LinkedIn states that direct identifiers are removed within seven days and remaining pseudonymized Insight Tag data is deleted within 180 days, subject to LinkedIn’s then-current policies and settings.

The LinkedIn Insight Tag is not intentionally placed on Elation, authenticated patient systems, medical-appointment or patient-account pages, clinical intake workflows, or consumer pages focused on especially sensitive health conditions, medications, or treatment interests. LinkedIn Enhanced Matching is not enabled for this implementation.

Analytics and advertising controls

Browser settings, privacy tools, ad-platform controls, and website preference controls where provided may affect whether or how certain cookies and advertising technologies operate. Some technologies may be necessary for site security or functionality and may not be subject to the same controls as nonessential advertising technologies.

How We May Disclose Information

Alderon may disclose or make website-related information available to service providers, advertising and measurement partners, and other organizations when reasonably necessary for the purposes described in this Policy and permitted by applicable law.

Service providers and infrastructure

Website-related information may be processed by organizations that provide services such as:

• website hosting;
• Microsoft Azure cloud processing and nonclinical lead storage;
• Elation Health for patient registration, clinical intake, patient portal, and electronic health record services;
• Cloudflare network security and bot protection;
• content delivery and network services;
• cybersecurity and fraud prevention;
• website development and maintenance;
• analytics and performance measurement;
• advertising measurement and attribution;
• data storage or backup;
• professional advisory services; or
• other operational functions performed for Alderon.

Advertising and measurement partners

Meta may receive information through Meta Pixel on tagged public marketing pages. LinkedIn may receive information through LinkedIn Insight Tag on the approved B2B pages identified in this Policy.

These companies process information under their own terms, privacy policies, and advertising settings. Alderon does not control all downstream processing or retention performed by an independent advertising platform after information has been transmitted to that platform.

Healthcare service providers

Where a vendor creates, receives, maintains, or transmits PHI on Alderon’s behalf and qualifies as a business associate under HIPAA, Alderon will address applicable HIPAA and business-associate requirements. Advertising platforms are not used as substitutes for Elation Patient Passport, the Elation EHR, secure clinical intake, or other designated patient-care systems.

Legal and safety purposes

Alderon may disclose information when required or permitted by applicable law, court order, legal process, regulatory obligation, or when reasonably necessary to investigate fraud, security incidents, unlawful activity, or threats to rights or safety.

Business transactions

Information may be transferred as permitted by law in connection with a merger, acquisition, restructuring, financing, sale of assets, or similar organizational transaction. Healthcare information remains subject to applicable healthcare privacy requirements.

Advertising, “Sale” or “Sharing,” and Privacy Choices

Alderon does not sell personal information collected through the public website for money.

Alderon does use third-party advertising and measurement technologies, including Meta Pixel and the limited B2B LinkedIn Insight Tag implementation described in this Policy. These technologies can support campaign attribution, audience measurement, audience creation, retargeting, or other advertising functions.

Some state privacy laws define terms such as “sale,” “sharing,” or “targeted advertising” more broadly than an exchange of information for money. Depending on the law that applies to a particular individual or processing activity, the use of certain advertising technologies may fall within one or more of those definitions.

Where applicable law gives you a right to opt out of covered sale, sharing, targeted advertising, or profiling activities, Alderon will provide or honor the legally required method for exercising that right. Depending on the law and technology involved, this may include a website privacy-preference control, recognition of a qualifying universal opt-out signal, or another legally permitted request method. You may also use browser controls and privacy or advertising settings made available by Meta, LinkedIn, and other platforms.

Alderon does not intentionally disclose clinical intake information, Elation data, authenticated patient-system content, or medical records to Meta or LinkedIn for targeted advertising.

Third-Party Websites, Cloud Services, and Patient Systems

The public Alderon website may interact with or link to separate systems and services. Nonclinical website lead forms may submit information to Alderon’s Azure-hosted processing workflow. Future clinical onboarding and authenticated patient-care functions will use systems separate from the public marketing website.

Alderon may also use separate systems for electronic health records, patient portals, telehealth, payment, pharmacies, laboratories, imaging, referrals, or other healthcare and operational functions, including Elation where applicable.

Advertising tags described in this Policy are not intended to operate inside Elation, authenticated patient portals, clinical intake systems, medical-record workflows, or other authenticated patient-care environments.

When you leave Alderon’s public website or interact directly with another organization’s platform, that organization’s own privacy notice and terms may apply in addition to any obligations Alderon has under healthcare privacy law or contract.

Data Retention

Alderon intends to retain information under its control only for as long as reasonably necessary for the purpose for which it was collected, to comply with legal or regulatory requirements, to maintain necessary records, to resolve disputes, or to protect the security and integrity of the practice and its systems.

Retention periods may vary by category of information and context. Information transmitted to independent third-party advertising platforms may also be retained by those platforms according to their own policies and settings.

Information Security

Alderon uses administrative, technical, and organizational safeguards designed to protect information against unauthorized access, misuse, alteration, loss, or disclosure appropriate to the nature of the information and the systems involved.

Alderon’s architecture separates the public website and its Azure NoPHI lead workflows from Elation clinical intake, the medical record, and authenticated patient-care functions. Public-site advertising tags are not intended to operate inside Elation, authenticated patient portals, clinical intake systems, or other patient-care environments.

No website, network, storage system, or electronic transmission method can be guaranteed to be completely secure. Users should therefore avoid sending sensitive information through channels not specifically designated for that purpose.

Security safeguards and practices may change as technology, risks, systems, and regulatory requirements evolve.

Privacy Rights

Depending on your state of residence, the type of information involved, Alderon’s size and activities, and whether a particular privacy law applies, you may have rights concerning certain personal information.

Those rights may include the ability to:

• confirm whether personal information is being processed;
• request access to certain personal information;
• correct inaccurate personal information;
• request deletion of certain personal information;
• obtain a portable copy of certain information;
• opt out of certain sales, sharing, targeted advertising, or profiling where applicable;
• withdraw consent where processing depends on consent; and
• appeal certain privacy-rights decisions where applicable law provides an appeal right.

These rights are subject to exceptions and limitations under applicable law. Alderon may need to verify your identity before processing certain requests.

Alderon will not unlawfully discriminate against an individual for exercising an applicable privacy right.

Advertising-platform controls

Meta and LinkedIn also provide their own advertising and privacy settings. Choices made through those platforms may affect how those companies use information for advertising but do not replace any rights you may have directly against Alderon under applicable law.

HIPAA rights

Rights relating to PHI governed by HIPAA—such as certain rights to access, amendment, restrictions, confidential communications, or an accounting of disclosures—are addressed in Alderon’s Notice of Privacy Practices and applicable healthcare privacy procedures.

Browser Privacy Signals and Global Privacy Control

Some browsers and privacy tools allow users to send automated privacy preference signals, including Global Privacy Control (“GPC”) or other recognized universal opt-out mechanisms.

Where applicable law requires Alderon to recognize a valid universal opt-out mechanism for covered sale, sharing, targeted advertising, or similar activity, Alderon will process qualifying recognized signals in accordance with that law. For example, Global Privacy Control is a recognized universal opt-out mechanism under the Colorado Privacy Act for controllers subject to that law.

Browser privacy settings, ad blockers, cookie controls, and platform-level advertising preferences may also affect certain tracking or advertising technologies. These tools do not necessarily prevent all security, hosting, or technically necessary processing.

Children’s Privacy

The public Alderon website is intended to provide general information about the practice and is not directed to children under 13 for independent use.

Alderon’s clinical services are intended for adults age 18 and older. Parents or legal guardians may use the public website for general informational purposes, but Alderon’s current patient-care model is not designed for pediatric care.

Alderon does not knowingly use the public website to collect personal information directly from children under 13 for marketing purposes.

Changes to the Alderon Medical privacy policy

Alderon may update this Privacy Policy as website features, patient-intake architecture, analytics, advertising technology, business practices, regulations, or privacy requirements change.

When the Policy is revised, Alderon will update the “Last updated” date shown on this page. Additional notice or choice mechanisms may be provided when required by law or when Alderon determines that a material change warrants additional communication.

Contact Us About Privacy

Questions concerning the Alderon Medical privacy policy or requests to exercise an applicable public- website privacy right may be submitted using the privacy contact pathway listed on Alderon’s Contact page .

Please identify the communication as a privacy inquiry so it can be directed appropriately.

Legal entity: SMPA Medical One, LLC, operating under the Alderon Medical brand