Privacy Policy

This Privacy Policy describes how Coastal Spine & Pain, LLC (“Coastal Spine & Pain,” “the Practice,” “we,” “us,” or “our”) collects, uses, discloses, and protects information when you visit our website at coastal-spine.com (the “Site”) or interact with us electronically. It applies to the Site and the online services made available through it.

Effective Date: May 24, 2026 · Last Reviewed: May 24, 2026

Important: Website Privacy vs. HIPAA Notice of Privacy Practices

This Website Privacy Policy governs information collected through the Site, including information you submit through online forms and information automatically collected when you visit. It is not the same as our HIPAA Notice of Privacy Practices, which separately governs how we handle Protected Health Information (“PHI”) under the Health Insurance Portability and Accountability Act of 1996, as amended (“HIPAA”) once a treatment relationship has been established.

Patients should review both documents. The HIPAA Notice of Privacy Practices is available on our Online Forms page and is provided at the time of the first visit.

1. Information We Collect

We collect two general categories of information through the Site: information you provide to us directly, and information that is collected automatically when you visit.

1.1 Information You Provide Directly

You may provide information to us when you complete the Request Appointment form, contact us by email, sign up for communications, complete patient intake forms downloaded from the Site, or otherwise interact with the Site. The information we collect may include:

Identifiers: First and last name, date of birth, street address, city, state, ZIP code, telephone number, and email address.

Health-Related Information: Information you voluntarily provide regarding your pain condition, treatment history, prior providers, or reason for seeking care — including any notes you enter in optional free-text fields.

Insurance Information: Any insurance details you choose to share in correspondence with the Practice.

Communications Content: The content of emails, contact forms, and any other written communication you send to us through or in connection with the Site.

Employment Application Information: If you submit an employment application, we collect the information you provide in that application, including work history, education, and any attached documents.

1.2 Information Collected Automatically

When you visit the Site, we and our service providers automatically collect certain technical information about your visit. This information may include:

Device and Browser Information: Internet Protocol (IP) address, browser type and version, operating system, device type, screen resolution, and language preference.

Usage Information: Pages visited, time spent on each page, links clicked, referring website, exit pages, and date and time of access.

Approximate Location: General geographic location derived from your IP address (typically city or region level), used for analytics and to display location-relevant content.

Cookies and Similar Technologies: Small data files stored on your device that allow the Site to function properly, remember your preferences, and provide analytics information. See Section 4 for additional information about cookies.

2. How We Use Information

We use the information we collect for the following purposes:

To respond to inquiries and requests. We use the contact and health-related information you submit to evaluate appointment requests, respond to your questions, schedule visits, and coordinate with referring providers or other parties at your direction.

To establish and maintain a treatment relationship. If you become a patient of the Practice, information you submitted through the Site may be transferred into our electronic health record system and used as part of your medical record. From that point forward, that information is governed primarily by HIPAA and our HIPAA Notice of Privacy Practices.

To operate, maintain, and improve the Site. We use technical and usage information to analyze traffic patterns, diagnose technical issues, improve content and navigation, and protect the Site against unauthorized access, fraud, and abuse.

To communicate with you. We may use your contact information to send you appointment confirmations, reminders, billing information, and other communications related to your care or your relationship with the Practice. You may opt out of non-essential communications at any time.

For employment evaluation. If you submit an employment application, we use the information you provide to evaluate your candidacy, contact you regarding the position, and retain the application in accordance with our records retention policies and applicable law.

To comply with legal obligations. We may use information as necessary to comply with applicable federal, state, and local laws and regulations, respond to lawful requests from government authorities, defend against legal claims, and enforce our agreements.

3. How We Share Information

We do not sell, rent, or trade your personal information. We share information only as described in this Policy:

3.1 Service Providers

We share information with third-party service providers that perform functions on our behalf and that are bound by confidentiality and data protection obligations. Categories of service providers include, but are not limited to:

Website Hosting and Infrastructure: Our website is hosted by WP Engine, which provides server infrastructure, content delivery, and related services.

Content Management: The Site is built on the WordPress content management platform.

Analytics: We may use analytics providers, such as Google Analytics, to understand how visitors interact with the Site. These providers may set cookies and collect technical and usage information described in Section 1.2.

Electronic Health Record & Patient Portal: Our electronic health record and patient portal services are provided by eClinicalWorks. If you create a patient portal account or your appointment information is transferred into the EHR, the eClinicalWorks privacy and security framework applies to that information in addition to ours.

Payment Processing: Online patient payments are processed by a third-party payment processor under our agreement with eClinicalWorks and its healow payment services. Payment card information is collected, transmitted, and stored by the payment processor; we do not store full payment card numbers on our servers.

Communications Infrastructure: Our telephone and voicemail services are provided by Dialpad, our fax services are provided through eClinicalWorks and Sinch, and our email is provided through Google Workspace.

Mapping and Directions: Map content and directions on the Site are provided by Google Maps.

3.2 Treatment, Payment, and Healthcare Operations

If you become a patient, your health information may be shared with other healthcare providers, health plans, and entities involved in your treatment, payment for care, or healthcare operations, as permitted by HIPAA and described in our HIPAA Notice of Privacy Practices.

3.3 Legal and Safety Disclosures

We may disclose information when we believe in good faith that disclosure is required to: (a) comply with applicable law, subpoena, court order, or other legal process; (b) respond to lawful requests from public authorities, including for national security, public health, or law enforcement purposes; (c) enforce our policies and agreements; (d) protect the rights, property, or safety of the Practice, our patients, our staff, or the public; or (e) investigate or prevent fraud, security incidents, or other harmful activity.

3.4 Business Transitions

In the event of a merger, acquisition, financing, sale of assets, reorganization, dissolution, or similar business transition, information collected through the Site may be transferred to the successor entity as part of that transition. Any successor will be bound by the commitments described in this Policy or will provide notice and an opportunity to object before any material change in use.

4. Cookies and Tracking Technologies

A cookie is a small data file that a website stores on your device to remember information about your visit. The Site uses cookies and similar technologies for the following purposes:

Essential cookies are necessary for the Site to function properly — for example, to remember form input as you move between pages.

Preference cookies remember choices you make on the Site to provide a more personalized experience.

Analytics cookies help us understand how visitors interact with the Site, which pages are most useful, and where to improve. These may be set by Google Analytics or similar providers.

Most web browsers allow you to control cookies through your browser settings. You can typically refuse cookies, delete cookies that have already been set, or be alerted before cookies are stored. Disabling cookies may affect the functionality of the Site.

The Site does not currently respond to browser “Do Not Track” signals because there is no industry-standard interpretation of those signals.

5. Information Security

We maintain reasonable administrative, technical, and physical safeguards designed to protect information collected through the Site against unauthorized access, alteration, disclosure, and destruction. These safeguards include encryption of data in transit through TLS (Transport Layer Security), access controls limiting employee and contractor access to information on a need-to-know basis, secure hosting infrastructure, and regular review of our security practices.

No method of transmission over the Internet and no method of electronic storage is completely secure. While we take reasonable measures to protect your information, we cannot guarantee absolute security. You should consider this when transmitting sensitive information through the Site, and we encourage you to use our telephone line at (251) 291-2311 for the most sensitive communications.

6. Data Retention

We retain information collected through the Site for as long as reasonably necessary to fulfill the purposes described in this Policy, to provide the services you have requested, to comply with applicable legal obligations, to resolve disputes, and to enforce our agreements. Medical records and information related to patient care are retained in accordance with applicable Alabama and federal law, including state record-retention requirements for licensed medical practices.

7. Children’s Privacy

The Site is intended for use by adults aged eighteen (18) and older. We do not knowingly collect personal information directly from children under thirteen (13) through the Site in violation of the Children’s Online Privacy Protection Act (COPPA). If you believe a child has submitted information to us through the Site, please contact us at privacy@coastal-spine.com and we will take appropriate steps to investigate and, where required, delete the information.

8. Your Choices and Rights

Depending on your state of residence and the applicable law, you may have the following rights regarding the personal information we hold about you:

Right to access. The right to request confirmation of whether we hold personal information about you and, where applicable, to receive a copy of that information.

Right to correction. The right to request that inaccurate or incomplete personal information be corrected.

Right to deletion. The right to request deletion of personal information we hold about you, subject to limitations imposed by medical record retention laws, ongoing treatment relationships, and other legal obligations.

Right to opt out of certain processing. The right to opt out of certain forms of processing of your personal information, including processing for targeted advertising (we do not currently engage in targeted advertising), the sale of personal information (we do not sell personal information), or profiling that produces legally significant effects.

Right to non-discrimination. The right not to be discriminated against for exercising any of the rights described above.

These rights are not absolute and may be limited by applicable law, including laws governing medical records, billing records, and the practice of medicine. To exercise any of these rights, please contact us using the information in Section 11. We may need to verify your identity before responding to a request.

9. Third-Party Websites and Services

The Site may contain links to third-party websites, applications, and services that are not operated by us. This Policy does not apply to information collected by those third parties. We encourage you to review the privacy policies of any third-party site you visit. We are not responsible for the privacy practices, content, or accuracy of any third-party site.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the services we offer, or applicable law. When we make material changes, we will update the “Effective Date” and “Last Reviewed” date at the top of this Policy and, where appropriate, provide additional notice through the Site or other means. Your continued use of the Site after the effective date of a revised Policy constitutes acceptance of the updated terms.

11. How to Contact Us

If you have questions, concerns, complaints, or requests regarding this Privacy Policy or our information practices, please contact us:

Coastal Spine & Pain, LLC

Privacy Inquiries: privacy@coastal-spine.com

Mailing Address: 150 W. Peachtree Avenue, Foley, AL 36535

Telephone: (251) 291-2311

Fax: 1-888-894-5212

For HIPAA-related inquiries, including requests to access or amend your medical record, please refer to our HIPAA Notice of Privacy Practices, available on our Online Forms page, or contact our Privacy Officer at the address above.

Important Notice: This Privacy Policy is intended to describe our information practices in a clear and reasonable manner. It does not, and is not intended to, create any contractual or other legal rights in or on behalf of any person beyond those rights expressly granted by applicable law. Coastal Spine & Pain, LLC reserves the right to modify or amend this Policy at any time, subject to the notice provisions in Section 10. This Policy does not create a physician-patient relationship.