Privacy Policy

Last updated: October 2026

Overview

Secoya Health ("we," "our," or "us") is committed to protecting your privacy. This policy describes how we collect, use, disclose, and safeguard your personal information when you visit our website at secoyahealth.com, use our online services, or interact with us as a patient or prospective patient.

Information We Collect

Information you provide directly:

• Contact information (name, email, phone number) submitted through consultation request forms, contact forms, and referral forms
• Health concerns and preferred contact method selected on intake forms
• Email address and first name when subscribing to our health digest newsletter
• Any messages or notes you include in form submissions

Information collected automatically:

• Standard web analytics data (page views, browser type, device, referring URL) via Vercel Analytics
• IP address for rate limiting and bot protection on form submissions
• Cookies necessary for website functionality and secure admin access

How We Use Your Information

• To respond to consultation requests and schedule appointments
• To follow up on referral submissions
• To send you our health education newsletter if you subscribe (you can unsubscribe at any time)
• To send internal staff notifications about new form submissions
• To improve our website and services
• To protect against spam and abuse (bot detection on forms)

Third-Party Services

We use the following third-party services to operate our website. Each has their own privacy policies:

• Vercel — Website hosting and analytics
• MongoDB Atlas — Secure database hosting for form submissions and content
• Cloudinary — Image and video hosting for website media
• Resend — Email delivery for staff notifications and, if you subscribe, our health newsletter
• Charm Health (EHR) — Patient scheduling and electronic health records (accessed via embedded booking widgets)

We do not sell, rent, or share your personal information with third parties for their marketing purposes.

Bot Protection on Our Forms

Our consultation and appointment request forms (including those on our service and landing pages), contact form, referral form, event registration form, Brain–Body Reset application, quiz results form, newsletter sign-up forms and account sign-in form use Cloudflare Turnstile, a service of Cloudflare, Inc., to check that submissions come from a person and not an automated program. When you visit a page with one of these forms (for the Brain–Body Reset application, when you reach its final step), Turnstile runs in your browser and sends Cloudflare technical information about your connection and browser, such as your IP address and browser type, whether or not you submit the form. Cloudflare uses this information to detect and block bots and to improve its bot-detection service, as described in its Turnstile Privacy Addendum.

HIPAA Compliance

As a healthcare provider, Secoya Health complies with the Health Insurance Portability and Accountability Act (HIPAA). Protected health information (PHI) collected during the course of your care is handled in accordance with federal regulations and our Notice of Privacy Practices, which is provided to patients at intake. Information submitted through website forms (consultation requests, contact forms) is treated as confidential but may not constitute PHI until a patient relationship is established.

Cookies & Tracking

We use essential cookies for website functionality and secure admin access. To understand how the site is used and to measure our advertising, we use Vercel Web Analytics, Google Analytics and Google Ads conversion tracking, and the Meta Pixel on some service and landing pages. These services may set cookies and receive information about your visit, such as the pages you view and the device you use. We allow search engine and AI search crawlers (including OpenAI, Google, Anthropic and Perplexity) to access our public pages so we can appear in search and AI answers. We block bulk web scrapers (CCBot, Bytespider), and we ask all crawlers to stay out of our admin area and APIs.

Data Retention

Form submissions (consultation requests, referrals, contact messages) are retained in our secure database for the purpose of patient follow-up and are managed by our coordination staff. Newsletter subscribers are maintained in our secure database until they unsubscribe. You may request deletion of your personal information at any time by contacting us.

Data Security

We implement reasonable technical and organizational measures to protect your personal information, including encrypted data transmission (HTTPS/TLS), secure database hosting with MongoDB Atlas, strict access controls for staff, and security headers (Content Security Policy, HSTS, X-Frame-Options) on our website.

Children's Privacy

Our website is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has submitted information through our website, please contact us and we will promptly delete it.

Your Rights

You have the right to access, correct, or request deletion of your personal information. You may unsubscribe from our newsletter at any time using the link in any email. For requests regarding your data, contact us using the information below.

Changes to This Policy

We may update this privacy policy from time to time. Changes will be posted on this page with an updated "last updated" date. Your continued use of our website after changes constitutes acceptance of the updated policy.

Contact

If you have questions about this privacy policy or wish to exercise your data rights, contact us: