Legal

Privacy Policy

Effective Date: 1/2026 · Last Updated: 8/2026

This page contains two documents: our Privacy Policy, which covers information collected through this website, and our HIPAA Notice of Privacy Practices, which covers protected health information collected as part of your care.

Dr Heather Vandeven, Professional Corporation ("we," "us," or "our") respects your privacy and is committed to protecting the personal information you share with us. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you visit our website drheathervandeven.com (the "Site") or interact with our practice.

This Privacy Policy applies to information collected through our Site. It does not apply to Protected Health Information ("PHI") that we collect as your healthcare provider, which is instead governed by our Notice of Privacy Practices under the Health Insurance Portability and Accountability Act ("HIPAA"), available at our office upon request.

1. Information We Collect

a. Information You Provide Directly

We may collect information you voluntarily submit through contact forms, appointment requests, consultation inquiries, or email, such as:

Name, email address, phone number, mailing address
Information about the procedure(s) you're interested in
Photos you choose to upload for consultation purposes
Any other information you choose to include in a message to us

If you become a patient, additional health information collected during your care is protected under HIPAA and is covered by our separate Notice of Privacy Practices, not this policy.

b. Information Collected Automatically

When you visit our Site, we and our third-party service providers may automatically collect certain information, including:

IP address, browser type, device type, operating system
Pages visited, time spent on pages, referring/exit pages
General geographic location (city/region level)

c. Cookies and Tracking Technologies

This Site does not use advertising cookies or advertising tracking pixels. We do not load Google Analytics, Google Ads, or the Meta Pixel, and we do not build advertising or lookalike audiences from your visit.

Our hosting platform, Wix, collects basic usage analytics on our behalf — pages viewed, approximate location, and device and browser type — using a visitor identifier. We use this only to operate and measure the Site.

The Site sets the following on your device:

A session cookie set by our hosting platform so that pages and forms function correctly
A visitor identifier used by our hosting platform’s built-in analytics, as described above
Browser session storage that remembers you have acknowledged the age notice on our before-and-after gallery, so you are not asked again while you browse. It is cleared when you close the tab and is never transmitted to us or to anyone else.

If we add further analytics or any advertising tools in future, we will update this policy to describe what they collect before turning them on.

The map in our footer is served by OpenStreetMap. Loading it sends your IP address and the page you are viewing to OpenStreetMap’s servers, as happens with any embedded map.

The Site’s fonts are served by Google Fonts. Loading them sends your IP address to Google’s font servers, as happens with any externally hosted font.

You can control cookies through your browser settings at any time. Because we do not run interest-based advertising from this Site, there is no advertising opt-out for you to exercise here.

Important: We do not knowingly use tracking pixels to transmit PHI (such as details about a specific medical condition or procedure you've had) to advertising platforms. Please avoid including sensitive health details in general contact forms not designed for secure health information exchange.

2. How We Use Your Information

We use the information we collect to:

Respond to inquiries and schedule consultations or appointments
Provide information about our services, promotions, or events (with your consent, where required)
Improve our Site, marketing, and patient experience
Understand which pages people find useful, so we can improve the site
Comply with legal and regulatory obligations

We do not sell your personal information. We may share information with:

Service providers who help us operate our Site, EMR systems and phone systems — for example our website host and the provider that delivers our consultation form — under confidentiality obligations
Legal authorities, if required by law, subpoena, or to protect our rights or the safety of others
Business transfers, in the event of a merger, acquisition, or sale of practice assets

4. Your Privacy Rights

California Residents (CCPA/CPRA)

If you are a California resident, you have the right to:

Know what personal information we collect and how it's used
Request deletion of your personal information (subject to legal exceptions)
Opt out of the "sale" or "sharing" of personal information for cross-context behavioral advertising
Not be discriminated against for exercising these rights

To exercise these rights, contact us at Drvandeven@drheathervandeven.com. Note that health information subject to HIPAA is generally exempt from CCPA and is instead governed by HIPAA's rules regarding access, amendment, and disclosure.

HIPAA Rights

As a patient, you have rights regarding your PHI, including the right to access, request amendment of, and receive an accounting of certain disclosures of your health records. These rights are described in our Notice of Privacy Practices.

5. Data Security

We implement reasonable administrative, technical, and physical safeguards designed to protect information collected through our Site. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

6. Children's Privacy

Our Site is not directed to individuals under 18, and we do not knowingly collect personal information from children through the Site.

7. Third-Party Links

Our Site may contain links to third-party websites (e.g., social media, review platforms). We are not responsible for the privacy practices of those sites and encourage you to review their policies.

8. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last Updated" date at the top reflects the most recent revision. Material changes will be posted on this page.

9. Contact Us

If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact us:

Drvandeven@drheathervandeven.com

Notice of Privacy Practices

Dr. Heather Vande Ven — Effective Date: 1/2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Our Commitment to Your Privacy

Dr Heather Vandeven, Professional Corporation is dedicated to maintaining the privacy of your protected health information ("PHI"). In the course of providing you with plastic and reconstructive surgery services, we create records regarding you and your treatment. We are required by law to maintain the confidentiality of health information that identifies you and to provide you with this Notice of our legal duties and privacy practices with respect to your health information.

We are required to abide by the terms of this Notice currently in effect.

How We May Use and Disclose Your Health Information

Treatment

We may use and disclose your PHI to provide, coordinate, or manage your healthcare and related services. This includes consultation with other physicians (e.g., anesthesiologists, surgery centers) involved in your care, and communication with pharmacies regarding prescriptions.

Payment

We may use and disclose your PHI to obtain payment for services, including verifying insurance coverage (where applicable), billing, and collections.

Healthcare Operations

We may use and disclose your PHI for operations necessary to run our practice, including quality assessment, staff training, licensing, and business planning.

Appointment Reminders and Treatment Alternatives

We may contact you by phone, text, email, or mail to remind you of appointments or provide information about treatment options or health-related services that may interest you.

Required by Law

We may disclose PHI when required to do so by federal, state, or local law (e.g., reporting certain wounds or injuries, public health reporting).

Other Permitted or Required Disclosures

This may include disclosures to:

Public health authorities for disease prevention or control
Health oversight agencies for audits or investigations
Coroners, medical examiners, or funeral directors, as authorized
Law enforcement, under limited circumstances specified by law
To avert a serious threat to health or safety

Marketing and Photography

We will not use your before-and-after photos, testimonials, or any identifiable information for marketing, advertising, or social media purposes without your separate, specific written authorization. You may revoke this authorization at any time, in writing, except to the extent we have already relied on it.

Uses Requiring Your Written Authorization

Other than as described above, we will not use or disclose your PHI without your written authorization. This includes most uses and disclosures of psychotherapy notes (if applicable) and any sale of PHI. You may revoke an authorization at any time in writing.

Your Rights Regarding Your Health Information

You have the right to:

Request Restrictions — Ask us to restrict certain uses or disclosures of your PHI. We are not required to agree, except when you request a restriction on disclosure to a health plan for services you paid for out of pocket in full, which we must honor.
Request Confidential Communications — Ask that we communicate with you in a certain way or at a certain location (e.g., cell phone only).
Inspect and Copy — Request access to and a copy of your medical and billing records, generally within 30 days of your request. A reasonable fee may apply for copies.
Request Amendment — Ask us to amend your health information if you believe it is incorrect or incomplete. We may deny the request in certain circumstances.
Receive an Accounting of Disclosures — Request a list of certain disclosures of your PHI made for purposes other than treatment, payment, or healthcare operations, for up to six years prior to your request.
Obtain a Paper Copy of This Notice — Even if you agreed to receive it electronically.
File a Complaint — If you believe your privacy rights have been violated, you may file a complaint with our practice or with the U.S. Department of Health and Human Services, Office for Civil Rights. You will not be penalized for filing a complaint.

To exercise any of these rights, please contact our Privacy Officer using the information below.

Changes to This Notice

We reserve the right to change this Notice and to make the revised Notice effective for PHI we already have as well as any information we receive in the future. We will post the current Notice at our office and, if applicable, on our website. You may request a copy at any time.