Privacy Policy

Effective Date: July 28, 2026 Last Updated: September 14, 2026

1. About This Policy

Palms Medical Group (“Palms Medical Group,” “we,” “us,” or “our”) is a not-for-profit Federally Qualified Health Center serving North Central Florida. We respect your privacy and are committed to protecting the information you share with us.

This Privacy Policy explains how we collect, use, and disclose information through our website at palmsmg.org (the “Site”). It applies to visitors to the Site, including patients, prospective patients, job applicants, and members of the public.

What this policy does not cover

Your medical records. Health information we create or receive in connection with your care is Protected Health Information (“PHI”) governed by the Health Insurance Portability and Accountability Act (“HIPAA”) and Florida law. How we use and disclose PHI, and your rights regarding it, are described in our separate Notice of Privacy Practices. If anything in this Privacy Policy appears to conflict with our Notice of Privacy Practices with respect to PHI, the Notice of Privacy Practices controls.

Third-party platforms. Our Site links to services operated by other companies, including our online appointment request tool and our patient portal. Those services have their own privacy policies and are not governed by this one. See Section 6.

Offline interactions. Information you provide in person at one of our health centers, by phone, or on paper forms is not covered by this Site policy, though it may be covered by our Notice of Privacy Practices.

2. Information We Collect

2.1 Information you provide to us

We collect information you choose to submit through the Site, including:

• Contact form submissions. Your name, email address, telephone number, and the content of your message.
• Employment applications. If you apply for a position through our Careers page, we collect information contained in your application and resume, which may include your name, contact details, work history, education, credentials, and licensure information.
• Correspondence. If you email us or otherwise communicate with us through the Site, we retain those communications.
• Optional information. Any additional information you voluntarily include in a message to us.

Please do not send sensitive health information through our website contact form or by unencrypted email. Standard email and web forms are not secure methods of transmitting medical information. To communicate about your care, use our patient portal or call us directly.

2.2 Server logs

We do not use website analytics services, advertising networks, or visitor tracking tools on this Site. We do not build profiles of visitors, and we do not follow you across other websites.

Everything needed to display our pages — text, images, fonts, styling, and our accessibility tool — is served from our own domain. Simply browsing the Site does not send information about you to any outside company.

Like virtually all websites, our web hosting provider keeps standard server logs as a routine part of delivering and securing the Site. These logs record information such as the IP address making the request, the page requested, and the date and time. We use server logs only to keep the Site running, diagnose technical problems, and protect against attacks and abuse. We do not use them to identify individual visitors, and they are overwritten or deleted on a routine schedule.

2.3 Cookies

A cookie is a small text file placed on your device by a website.

We do not use analytics cookies, advertising cookies, or tracking pixels on this Site.

Our Site may set a small number of cookies that are strictly necessary for it to work — for example, to keep a form submission secure, to remember an accessibility setting you have chosen, or to maintain a session while you move between pages. Any such cookies are set by our own site, not by outside companies, and they are not used for marketing.

Your choices. Most web browsers allow you to refuse or delete cookies through their settings. Disabling cookies may limit some Site functionality, such as accessibility preferences. You can find instructions in your browser’s help documentation.

Do Not Track and Global Privacy Control. Some browsers send “Do Not Track” or Global Privacy Control signals. Because we do not track visitors across websites, do not serve advertising, and do not sell or share personal information, these signals do not change how our Site behaves — there is nothing for them to opt you out of.

2.4 Information we do not knowingly collect

We do not ask for and do not want to receive Social Security numbers, financial account numbers, insurance member numbers, or detailed medical histories through the Site’s public contact form.

3. How We Use Information

We use information collected through the Site to:

• Respond to your questions, requests, and messages
• Direct you to the appropriate health center, provider, or department
• Process and evaluate employment applications
• Operate, maintain, and secure the Site
• Communicate about services, health center news, community events, and health education, where you have requested such communications or where permitted by law
• Comply with legal, regulatory, accreditation, and federal grant program obligations, including those applicable to us as a Health Center Program grantee under 42 U.S.C. § 254b and a deemed Public Health Service employee under 42 U.S.C. § 233(g)–(n)
• Detect, investigate, and prevent fraud, abuse, security incidents, and other unlawful activity

Information submitted through a form on our Site is used only for the purpose for which it was collected, and for related follow-up.

4. How We Share Information

We do not sell your personal information. We do not rent, trade, or otherwise distribute your personal information to third parties for their own marketing purposes.

We share information only as described below:

• Service providers. We use vendors to host our website, deliver email, support accessibility features, and manage employment applications. These vendors may access information only as needed to perform services for us and are contractually restricted from using it for other purposes. Where a vendor handles PHI on our behalf, we require a HIPAA Business Associate Agreement.
• Within Palms Medical Group. We share information internally among our locations, departments, and workforce members as needed to respond to you and operate our health centers.
• When required by law. We may disclose information in response to a subpoena, court order, warrant, or other lawful legal process, or where disclosure is required by federal, state, or local law.
• To protect health or safety. We may disclose information where necessary to prevent a serious and imminent threat to the health or safety of any person, or to report suspected abuse, neglect, or exploitation as required by Florida law.
• Regulatory and oversight bodies. We may disclose information to the U.S. Department of Health and Human Services, the Health Resources and Services Administration, accreditation organizations, auditors, and other oversight bodies in connection with our obligations as a federally funded health center.
• Business transfers. In the event of a merger, affiliation, reorganization, or transfer of operations, information may be transferred as part of that transaction, subject to the protections described in this policy and applicable law.
• With your consent. We will share information for any other purpose only with your permission.

5. Protected Health Information

If you are a Palms Medical Group patient, the health information we maintain about you is protected by HIPAA, by 42 C.F.R. Part 2 where applicable to substance use disorder records, and by Florida law. That information is governed by our Notice of Privacy Practices, which describes:

• How we may use and disclose your health information for treatment, payment, and health care operations
• Your rights to inspect, copy, and amend your records
• Your right to request restrictions and confidential communications
• Your right to an accounting of disclosures
• Your right to be notified of a breach affecting your health information
• How to file a privacy complaint with us or with the Secretary of the U.S. Department of Health and Human Services

Information you submit through the Site’s general contact form is not automatically added to your medical record.

6. Third-Party Services and Links

Our Site does not embed content or load resources from other companies. It does, however, link out to services operated by other organizations. Those links do nothing until you click them. Once you do, that organization’s privacy policy governs your information, not ours. These include:

• Online appointment requests. Our “Schedule Your Appointment” links direct you to a scheduling platform operated by a third-party vendor. Information you enter there is handled under that vendor’s terms and under our Business Associate Agreement with them.
• Patient Portal. Our patient portal is operated by a third-party electronic health record vendor. Access requires separate registration and is subject to that platform’s terms and privacy policy.
• Social media. Our Site links to our Facebook and X (formerly Twitter) pages. Interactions on those platforms are governed by their privacy policies. Please do not post health information on social media.
• Other linked sites. We link to external health resources for your convenience. A link is not an endorsement, and we are not responsible for the privacy practices or content of external sites.

We encourage you to review the privacy policy of any third-party service before providing information to it.

7. Data Security

We maintain administrative, physical, and technical safeguards designed to protect information against unauthorized access, use, disclosure, alteration, and destruction. These include encryption of our website traffic, access controls, workforce training, and periodic review of our security practices.

No method of transmission over the internet and no method of electronic storage is completely secure. While we work to protect your information, we cannot guarantee absolute security. If we experience a breach of unencrypted personal information, we will notify affected individuals and regulators as required by the Florida Information Protection Act (Fla. Stat. § 501.171), HIPAA’s Breach Notification Rule, and other applicable law.

8. Data Retention

We retain information collected through the Site only as long as necessary for the purposes described in this policy, or as required by law, our federal grant obligations, accreditation standards, and applicable record retention schedules. Medical records are retained according to the retention periods required by Florida law and federal regulation. Employment application materials are retained in accordance with applicable federal and state recordkeeping requirements.

9. Children’s Privacy

Our Site is intended for a general audience and is not directed to children under 13. We do not knowingly collect personal information from children under 13 through the Site.

We do provide pediatric and adolescent health services, and a parent or legal guardian may submit information about a minor child in the course of seeking care. Such information is handled under our Notice of Privacy Practices and applicable law, including Florida law governing minors’ rights to consent to certain categories of care.

If you believe a child under 13 has submitted personal information through our Site, please contact us using the information in Section 12 and we will delete it.

10. Your Privacy Choices and Rights

Email communications. If you receive email from us, you may unsubscribe at any time using the link in the message or by contacting us. We may still send you communications related to your care, appointments, or billing.

Access and correction. To request access to, correction of, or deletion of information we hold about you from the Site, contact us using the information in Section 12. If your request concerns your medical record, follow the process described in our Notice of Privacy Practices, which sets out your HIPAA rights and how to exercise them.

Opting out of tracking or targeted advertising. We do not track visitors, serve advertising, or sell or share personal information, so there is no opt-out to offer. See Section 2.3.

State privacy laws. Depending on your state of residence, you may have additional rights regarding your personal information. Many state privacy laws contain exemptions for HIPAA-covered entities and for PHI. Where a state law grants you rights that apply to us, we will honor them. Contact us to make a request.

Nondiscrimination. We will not deny you services, charge you a different price, or provide you a different level of care because you exercise a privacy right.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we do, we will revise the “Last Updated” date at the top of this page. Material changes will be highlighted on the Site. Your continued use of the Site after a change takes effect constitutes acceptance of the revised policy.

We encourage you to review this page periodically.

12. Contact Us

If you have questions about this Privacy Policy or our privacy practices, or if you wish to exercise a privacy right, please contact us:

Palms Medical Group Attn: Clinical Compliance Officer 16916 NW US Highway 441 High Springs, FL 32643
Phone: (888) 730-2374 Compliance: (386) 454-0698

To file a privacy complaint, you may contact our EVP of Clinical Compliance at (386) 454-0698, or file a complaint with the Secretary of the U.S. Department of Health and Human Services, Office for Civil Rights. You will not be penalized or retaliated against for filing a complaint.

Website accessibility. Palms Medical Group is committed to ensuring our website is accessible to everyone. If you have difficulty accessing information on this Site, or wish to file a formal grievance under Section 504 or Title II, please call (888) 730-2374.

Palms Medical Group is a Health Center Program grantee under 42 U.S.C. § 254b and a deemed Public Health Service employee under 42 U.S.C. § 233(g)–(n). This institution is an equal opportunity provider and employer.