Website Privacy Policy

Entity: Harmony Endocrinology, LLC

Jurisdiction: Peachtree City, Georgia, USA

Effective Date: October 12, 2026

Emergency Notice: This website, its contact telephone numbers, and electronic links are not intended for acute emergency medical conditions. If you are experiencing a medical emergency, please dial 911 immediately or visit your nearest hospital emergency department.

1. Introduction & Scope

Harmony Endocrinology, LLC ("Harmony Endocrinology," "we," "our," or "us"), led by Dr. Ghurulakshmi Moorthy, MD, values your trust and is committed to protecting your digital privacy. This Website Privacy Policy explains our practices concerning the collection, storage, use, and disclosure of personal information when you access or interact with our public website located at our domain (the "Website").

By using this Website, you acknowledge the terms of this Privacy Policy. If you do not agree with our practices, please discontinue website usage.

2. Crucial Legal Distinction: Website Privacy vs. HIPAA Notice of Privacy Practices

HIPAA & PHI Distinction: Federal healthcare law draws a strict boundary between information gathered from general visitors browsing a public marketing website and clinical health records maintained for patients.

Protected Health Information (PHI): When you become an established patient, register in our clinical database, request lab tests, or communicate through the eClinicalWorks Patient Portal or healow™ mobile application, your medical information is governed under federal law by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and our clinical HIPAA Notice of Privacy Practices (NPP).

Public Website Channel: This Website Privacy Policy applies solely to digital interactions with our public-facing, unauthenticated website. Unencrypted public web channels and general email are not secure HIPAA channels; please do not transmit confidential clinical records or urgent medical queries through unauthenticated public web forms.

3. Information We Collect

We collect personal information through two main channels:

A. Information You Voluntarily Provide

Administrative Inquiries: Name, phone number, email address, and comments when you contact our clinic by phone, email, or fax.
Appointment Initiation: Contact information provided when accessing scheduling links via our electronic booking partners.

B. Technical and Automated Information

Device & Network Data: Internet Protocol (IP) address, browser type and version, language preference, operating system, and hardware model.
Usage Analytics: High-level clickstream data, referring website URLs, navigation timestamps, and page engagement durations.

We do not collect sensitive government identifiers (such as Social Security Numbers) or financial payment data through our public website.

4. Collection Methods

We obtain information directly from your interactions, through automated server logging mechanisms, and via secure hand-offs when you choose to click links to our Electronic Health Record (EHR) partner (eClinicalWorks / healow™).

5. How We Use Data & Legal Bases

We utilize website information for legitimate healthcare business operations:

Providing accurate clinic practice information, provider credentials, and patient education resources.
Responding to administrative inquiries and scheduling requests.
Ensuring website network security, load balancing, cyber defense, and technical troubleshooting.
Fulfilling legal, statutory, and regulatory obligations under Georgia and federal US law.

Legal Bases under International Frameworks (GDPR): Processing is based on our Legitimate Interests in operating an educational medical practice portal, your explicit Consent for voluntary communications, and steps taken toward clinical Contract Formation.

6. Third-Party Sharing & Healthcare Integrations

We do not sell, rent, or trade your personal information. Information is disclosed solely to vetted service partners under strict confidentiality obligations:

EHR & Portal Infrastructure (eClinicalWorks, LLC / healow™): Provides HIPAA-compliant cloud hosting for our patient portal and mobile apps under a formal Business Associate Agreement (BAA).
Infrastructure & Web Hosting: Trusted server hosting, DNS providers, and firewall networks maintaining site security and uptime.
Google Maps: Embedded maps for providing physical directions to our clinic (4000 Shakerag Hill, Ste 302, Peachtree City, GA 30269).
Legal Authorities: Where disclosure is required by subpoena, court order, or applicable state or federal law.

7. Cookies & Healthcare Analytics Compliance

Our website utilizes strictly necessary and functional cookies. In adherence to the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) guidance on tracking technologies:

We do not deploy invasive commercial advertising pixels (such as Meta Pixel or TikTok Pixel) on clinical condition pages.
Visitor viewing patterns regarding specific conditions (diabetes, thyroid nodules, osteoporosis) are never linked to commercial advertising identifiers.

For detailed information, please review our complete Cookie Policy.

8. Security, Storage & Data Retention

We enforce 256-bit Transport Layer Security (TLS/SSL) encryption for all web communications in transit. General server diagnostic logs are retained for a limited period (typically 30–90 days) for security review before being purged. Medical records are preserved strictly according to Georgia Composite Medical Board rules (minimum 10 years).

9. Your Legal Privacy Rights

Depending on your jurisdiction, you have specific statutory protections:

Jurisdiction	Key Rights Conferred	Applicable Scope
California (CCPA / CPRA)	Right to Know, Delete, Correct; Right to Opt-Out of Sale/Share; Freedom from Discrimination.	Applies to digital non-PHI data. PHI is governed under the HIPAA exemption (Cal. Civ. Code § 1798.145).
EU / UK (GDPR)	Rights of Access, Rectification, Erasure, Restriction, Portability, and Objection.	Applies to visitors located within the European Economic Area or United Kingdom.
Georgia & US States	Data breach notifications, consumer dispute mechanisms, and state privacy rights.	Applies across US jurisdictions based on state residency.

To exercise any of these consumer rights, please contact our compliance administrator at 678-671-4321.

10. Children's Online Privacy Protection Act (COPPA)

Our website is directed toward adult patients and parents/guardians. Although Dr. Moorthy assists families with endocrine conditions, we do not knowingly solicit or collect personal information online directly from children under 13 without verified parental consent.

11. External Portals & Third-Party Platforms

Our website includes links to third-party domains: eClinicalWorks Cloud (`ecwcloud.com`), healow™ (`healow.com`), Google Maps, and app marketplaces. We encourage you to review their respective privacy policies upon leaving our site, as we do not control third-party platforms.

12. International Users & Data Transfers

Harmony Endocrinology operates in Peachtree City, Georgia, within the United States. If you visit our website from abroad, your data will be transmitted and processed in the United States in accordance with US legal standards.

13. Modifications to This Privacy Policy

We may update this policy periodically to align with evolving medical privacy standards or website technical updates. Changes are effective immediately upon posting with a refreshed "Effective Date."

14. Contact Officer & Data Protection Inquiries

If you have questions regarding this Privacy Policy or our compliance procedures, please contact:

Privacy & Compliance Coordinator
Harmony Endocrinology, LLC
4000 Shakerag Hill, Ste 302, Peachtree City, GA 30269
Telephone: 678-671-4321
Fax: 678-671-9985
Email: Info@harmonyendocrine.com