Website Privacy Policy

This policy covers the public Astra Medical Group LLC website and related contact requests. Our HIPAA Notice of Privacy Practices explains our handling of protected health information. Information submitted online may also be protected health information depending on its content and circumstances; using a website does not remove those protections.

This website is not a patient portal or an emergency service. Do not put diagnoses, medications, medical records, financial account details or other sensitive information in the general contact form. For urgent medical needs, call 911 or seek emergency care.

When you request a callback, we collect your name, phone number, email, preferred language, selected service interest, optional message and agreement to be contacted. We also record the submission time, the form and page language, the connection IP address when available, and processing and notification status.

We use these details to respond, route your inquiry, arrange appropriate follow-up and prevent misuse. Requests are stored in a database controlled by Astra, and notifications containing the request details are sent to designated staff mailboxes. Access is intended for staff and service providers who need it for these purposes.

Your agreement to receive a response to an inquiry is separate from permission for unrelated marketing or website analytics. A contact request does not guarantee an appointment or create a clinician–patient relationship.

Where enabled, our first-party analytics records public pages viewed, clicks on selected links and buttons, approximate active viewing time, broad referral categories and a device category based on screen size. Approximate country, region and city may be recorded when supplied by our hosting infrastructure. Location can be unavailable or inaccurate and does not identify a precise address.

A randomly generated tab-session identifier lets us understand navigation between pages. These are pseudonymous records, not a guarantee of anonymity. We store them in separate analytics tables in an Astra-controlled database and use aggregate reports to improve content, navigation and performance.

Our first-party analytics does not collect contact-form contents, full URL query strings, search terms or raw IP addresses in those analytics tables. We do not connect the analytics session identifier to contact records or patient charts, or use these analytics records to build advertising profiles or sell them to advertisers. Separate security systems and contact submissions may process IP addresses.

A click to open appointment scheduling does not tell us that an appointment was completed. We do not record activity inside the Tebra scheduling service through this first-party collector.

We also use Google Analytics on the public website to measure visits and navigation. Google may receive page addresses and titles, referral information, browser and device information, and usage events. Its tag uses cookies and identifiers and connects directly to Google. This is separate from the first-party records stored by Astra.

Our Google tag loads only after interaction, such as a click, tap, key press or scroll. Visits without interaction are not measured by this tag. Our Google tag disables Google signals and advertising personalization signals and does not load when the browser reports Do Not Track or Global Privacy Control. We do not attach contact-form contents or patient records to Google Analytics events. Google handles information under its own privacy policy; Google Analytics retention settings are separate from the retention period for our own database.

The contact form uses a security cookie to limit repeated submissions. Our first-party analytics uses sessionStorage, rather than a persistent visitor cookie, to retain the random tab-session identifier. Browsers normally clear sessionStorage when a tab closes; a new tab may initially copy it. The collector reuses a session while its last report is less than 30 minutes old. Closing the tab does not delete statistics already received by Astra.

Our first-party analytics collector does not send measurements when it detects Do Not Track or Global Privacy Control enabled in your browser. These settings do not disable necessary security processing or control independent third-party services. Your browser also lets you manage site storage; restricting storage can affect features.

Where applicable law requires consent for a particular measurement, that measurement must not begin without it. Reading this policy or browsing the site is not a substitute for consent where required. Contact us with questions about your choices.

We use service providers for website hosting, database storage, security and email delivery, including Amazon Web Services and Microsoft. These providers process information as needed to provide their services. We may also disclose information when required by law or as permitted to protect rights, safety and security.

Appointment links open Tebra. Cherry and CareCredit payment widgets load only after you choose to open the portal. Its code can then communicate with the selected financing provider and its technology providers before you submit a financing application. External maps, WhatsApp and social links take you to services with their own privacy practices. These services may receive network and device information and use their own browser storage or tracking technologies. Our first-party analytics choices do not govern their processing.

Review the privacy information of any service before submitting sensitive data. Use the appropriate patient channel for medical information; do not assume ordinary email or WhatsApp is a secure patient portal.

We use measures such as encrypted connections, restricted database access, input validation and controls against repeated submissions. No website, email service or storage system can guarantee absolute security.

Our retention period for website contact submissions, associated IP addresses and first-party website analytics records is five years from collection, unless an applicable legal obligation or preservation requirement calls for a longer period. This period is separate from the shorter lifetime of browser storage and temporary anti-abuse counters. Medical records and required HIPAA documentation follow their applicable retention requirements and are not subject to a blanket five-year deletion rule. Contact us about a particular record or retention request.

To ask about information submitted to Astra, request correction or deletion where available, or raise a concern, contact Celio Hernandez, our designated privacy contact, at (786) 936-3427 (dedicated privacy complaint line) or info@astramedical.group. We may need to verify identity before disclosing or changing records. Some records may need to be retained, and rights depend on the information and applicable law.

Do not attach medical records or sensitive identification documents to an initial email. We will explain the appropriate next step. For protected health information, see the specific rights and complaint options in the HIPAA Notice.

The public website and general inquiry form are not directed to children under 13. A parent or guardian should contact the office about care for a child. If you believe a child submitted personal information inappropriately, contact us so we can review it.

We will identify an updated version when this policy changes. Material changes to collection or use will be addressed as required by applicable law; posting revised language does not replace any consent or authorization that is required.