What this site collects, and what it doesn't.

Last updated August 23, 2026. This policy covers this website only. Work done for a client is governed by the written agreement signed before that work starts.

1. What this site collects

When you send the contact form

The form asks for your name, and an email address or phone number so I can reply. It optionally asks which you prefer, what city you are in, and who you are asking about. It has one free-text field for a sentence or two about what is happening.

That field carries a visible instruction asking you not to include medical details — diagnoses, medications, treatment. That is deliberate and it matters; see section 4.

Automatically, because the site is hosted

The site is hosted by Vercel, which keeps standard server logs — IP address, browser and device type, the page requested, the time. That happens for any website; it is how a server answers a request and how abuse is detected. I do not use those logs to build a profile of you, and I do not combine them with anything else.

Visitor measurement, and the cookies it sets

This site uses Google Analytics to count visits — how many people arrive, which pages they read, roughly where in the world they are, and whether they came from a search or a link. I use it to find out which of these pages are actually useful, and nothing else.

Google Analytics sets cookies in your browser to recognise a repeat visit. They do not tell me who you are, and I have deliberately switched off the two settings that would make it more than counting: Google signals (which links behaviour across your devices via your Google account) and ad personalisation signals (which would let the data feed advertising audiences). Both are off. This site runs no advertising and never will, and your visit does not become an advertising audience anywhere.

How to refuse it entirely is in section 7.

In your browser, from the site itself

If you use the light/dark switch in the header, your choice is saved in your own browser under a single key named “theme”. It never leaves your device and I cannot read it. Clearing your browser data removes it.

2. What this site does not do

Stated plainly, because most sites of this kind do all of it:

• No advertising pixels, no retargeting, no social media trackers, no tag manager. Google Analytics, described above, is the only third-party script on the site.
• No cross-device tracking and no advertising audiences — the two Google Analytics settings that would enable them are switched off.
• No selling or sharing of your information, for money or anything else. Not to facilities, agencies, insurers, plans, providers, or lead brokers.
• No referral fees, in either direction. That is a promise the whole practice rests on, and it applies to your information as much as to money.
• Nothing you type into the contact form is sent to Google or to any analytics tool. Measurement and enquiries are entirely separate.

3. Why I hold it, and who else sees it

I use what you send for one thing: to reply to you, and to have the conversation you asked for. Not for marketing lists, not for anything else.

Three companies process it on my behalf, and only to do that job:

• Vercel — hosting. Serves the pages and keeps the server logs described above.
• Resend — email delivery. Carries the contact form to my inbox.
• Google — visitor measurement only, as described in section 1. Google receives page views and the cookie identifier its own script sets. It never receives anything you type into the contact form. Google processes this data on servers that may be outside your country, including in the United States.

A form submission is emailed and not written to any database. There is no stored copy on this website. If email delivery fails at the moment you submit, the form tells you so and asks you to phone instead, and your message is discarded rather than held.

Beyond those three, nobody. I would only hand something over if the law required it (see section 8).

4. Health information, and HIPAA

This is the part most sites get wrong, so it is worth being exact.

An independent advocate paid directly by a client is generally not a HIPAA covered entity. That means HIPAA’s obligations mostly do not attach to this practice, and I am not going to claim a compliance status I do not hold. It is a legal fact, not permission to be casual: I intend to handle your information to the standard a covered entity would be held to, because the information is sensitive whether or not a statute says so.

What follows from that is practical. A web form is not a secure channel for medical information. Please do not put diagnoses, medications, test results, or treatment details into it. Bring those to the phone call, where they can be handled properly and, once you are a client, under a signed authorization. If you have already sent something clinical through the form, tell me and I will delete it.

California’s Confidentiality of Medical Information Act may impose obligations separately from HIPAA. That question is with counsel.

5. How long it is kept

Enquiries that do not become work are deleted from my inbox within twelve months. If you become a client, records are kept under the retention schedule set out in your written agreement, which is longer because professional records have to be. You can ask me to delete an enquiry sooner and I will.

Vercel’s server logs are kept on their retention schedule, which I do not control.

6. How it is protected

The site is served over HTTPS. Client information is held with encrypted storage, unique credentials, multi-factor authentication, and device encryption, entirely separate from any other organisation’s systems. No one can honestly promise a system is impossible to breach, and I am not going to. What I can say is what the arrangements are, so you can judge them.

7. Your choices

You can ask me what I hold about you, ask for a copy, ask me to correct it, or ask me to delete it. Phone me; the number is at the bottom of this page. I answer within thirty days and I will not charge you or make it difficult.

To refuse visitor measurement: install Google’s Analytics Opt-out Browser Add-on, turn on your browser’s tracking protection, or block cookies for this site. Nothing on this site breaks if you do, and I will never know you did.

California residents have rights under the California Consumer Privacy Act, including to know, to delete, to correct, and to opt out of the sale or sharing of personal information. A practice this small is very unlikely to meet the thresholds that make the CCPA formally apply — but the rights above are honored regardless, and there is nothing to opt out of, because nothing is sold or shared. I will not treat you differently for asking.

8. When I might have to tell someone

Two situations, and you should know about both before you call rather than after.

• If the law compels it — a subpoena, a court order, or a legal obligation I cannot refuse.
• Suspected abuse or neglect of an elder or dependent adult. Whether a private advocate is a mandated reporter under California law is genuinely unsettled. Rather than rely on being right about a contested question, this practice reports as a matter of policy. If I have reasonable suspicion that an older or dependent adult is being abused or neglected, I will report it to Adult Protective Services. I would rather you knew that now.

9. Children

This site is meant for adults and is not directed at children. I do not knowingly collect information from anyone under 13.

10. Changes to this policy

If this changes materially, the date at the top changes with it. The version that applies to you is the one published when you sent your information.

11. How to reach me

Guided Health Navigation — Orange County, California
(714) 747-5403