Privacy Policy

Effective Date: 07/28/2026

1. About This Policy

Palms Medical Group (“Palms Medical Group,” “we,” “us,” or “our”) is a not-for-profit Federally Qualified Health Center serving North Central Florida. We respect your privacy and are committed to protecting the information you share with us.

This Privacy Policy explains how we collect, use, and disclose information through our website at palmsmg.org (the “Site”). It applies to visitors to the Site, including patients, prospective patients, job applicants, and members of the public.

What this policy does not cover

Your medical records. Health information we create or receive in connection with your care is Protected Health Information (“PHI”) governed by the Health Insurance Portability and Accountability Act (“HIPAA”) and Florida law. How we use and disclose PHI, and your rights regarding it, are described in our separate Notice of Privacy Practices. If anything in this Privacy Policy appears to conflict with our Notice of Privacy Practices with respect to PHI, the Notice of Privacy Practices controls.

Third-party platforms. Our Site links to services operated by other companies, including our online appointment request tool and our patient portal. Those services have their own privacy policies and are not governed by this one. See Section 6.

Offline interactions. Information you provide in person at one of our health centers, by phone, or on paper forms is not covered by this Site policy, though it may be covered by our Notice of Privacy Practices.

2. Information We Collect

2.1 Information you provide to us

We collect information you choose to submit through the Site, including:

Contact form submissions. Your name, email address, telephone number, and the content of your message.
Employment applications. If you apply for a position through our Careers page, we collect information contained in your application and resume, which may include your name, contact details, work history, education, credentials, and licensure information.
Correspondence. If you email us or otherwise communicate with us through the Site, we retain those communications.
Optional information. Any additional information you voluntarily include in a message to us.

Please do not send sensitive health information through our website contact form or by unencrypted email. Standard email and web forms are not secure methods of transmitting medical information. To communicate about your care, use our patient portal or call us directly.

2.2 Information collected automatically

When you visit the Site, certain information is collected automatically by us or by service providers acting on our behalf:

Internet Protocol (IP) address and general geographic location derived from it
Browser type, operating system, device type, and screen settings
Pages you view, links you click, and time spent on pages
The website or search engine that referred you to our Site
Date and time of your visit

We collect this information to operate and secure the Site, understand how it is used, and improve it.

2.3 Cookies and similar technologies

A cookie is a small text file placed on your device by a website. Our Site may use cookies and similar technologies, which fall into the following general categories:

Strictly necessary cookies that enable core functionality such as page navigation, security, and form submission. The Site cannot function properly without these.
Preference cookies that remember settings such as your accessibility preferences or language selection.
Analytics cookies that help us understand aggregate traffic patterns and improve the Site.
Third-party cookies set by services embedded in our pages, including web fonts, our accessibility tool, and any embedded social media content.

Your choices. Most web browsers allow you to refuse or delete cookies through their settings. Disabling cookies may limit some Site functionality. You can find instructions in your browser’s help documentation.

Do Not Track and Global Privacy Control. Some browsers transmit “Do Not Track” or Global Privacy Control signals.

2.4 Information we do not knowingly collect

We do not ask for and do not want to receive Social Security numbers, financial account numbers, insurance member numbers, or detailed medical histories through the Site’s public contact form.

3. How We Use Information

We use information collected through the Site to:

Respond to your questions, requests, and messages
Direct you to the appropriate health center, provider, or department
Process and evaluate employment applications
Operate, maintain, secure, and improve the Site
Analyze aggregate usage patterns and Site performance
Communicate about services, health center news, community events, and health education, where you have requested such communications or where permitted by law
Comply with legal, regulatory, accreditation, and federal grant program obligations, including those applicable to us as a Health Center Program grantee under 42 U.S.C. § 254b and a deemed Public Health Service employee under 42 U.S.C. § 233(g)–(n)
Detect, investigate, and prevent fraud, abuse, security incidents, and other unlawful activity

Information submitted through a form on our Site is used only for the purpose for which it was collected, and for related follow-up.

4. How We Share Information

We do not sell your personal information. We do not rent, trade, or otherwise distribute your personal information to third parties for their own marketing purposes.

We share information only as described below:

Service providers. We use vendors to host our website, deliver email, provide analytics, support accessibility features, and manage employment applications. These vendors may access information only as needed to perform services for us and are contractually restricted from using it for other purposes. Where a vendor handles PHI on our behalf, we require a HIPAA Business Associate Agreement.
Within Palms Medical Group. We share information internally among our locations, departments, and workforce members as needed to respond to you and operate our health centers.
When required by law. We may disclose information in response to a subpoena, court order, warrant, or other lawful legal process, or where disclosure is required by federal, state, or local law.
To protect health or safety. We may disclose information where necessary to prevent a serious and imminent threat to the health or safety of any person, or to report suspected abuse, neglect, or exploitation as required by Florida law.
Regulatory and oversight bodies. We may disclose information to the U.S. Department of Health and Human Services, the Health Resources and Services Administration, accreditation organizations, auditors, and other oversight bodies in connection with our obligations as a federally funded health center.
Business transfers. In the event of a merger, affiliation, reorganization, or transfer of operations, information may be transferred as part of that transaction, subject to the protections described in this policy and applicable law.
With your consent. We will share information for any other purpose only with your permission.

5. Protected Health Information

If you are a Palms Medical Group patient, the health information we maintain about you is protected by HIPAA, by 42 C.F.R. Part 2 where applicable to substance use disorder records, and by Florida law. That information is governed by our Notice of Privacy Practices, which describes:

How we may use and disclose your health information for treatment, payment, and health care operations
Your rights to inspect, copy, and amend your records
Your right to request restrictions and confidential communications
Your right to an accounting of disclosures
Your right to be notified of a breach affecting your health information
How to file a privacy complaint with us or with the Secretary of the U.S. Department of Health and Human Services

Information you submit through the Site’s general contact form is not automatically added to your medical record.

6. Third-Party Services and Links

Our Site links to and embeds services operated by other organizations. When you leave our Site or interact with an embedded service, that organization’s privacy policy governs your information, not ours. These include:

Online appointment requests. Our “Schedule Your Appointment” links direct you to a scheduling platform operated by a third-party vendor. Information you enter there is handled under that vendor’s terms and under our Business Associate Agreement with them.
Patient Portal. Our patient portal is operated by a third-party electronic health record vendor. Access requires separate registration and is subject to that platform’s terms and privacy policy.
Social media. Our Site links to our Facebook and X (formerly Twitter) pages. Interactions on those platforms are governed by their privacy policies. Please do not post health information on social media.
Web fonts, accessibility tools, and content delivery. Our Site loads resources from third-party providers to render fonts, provide assistive technology, and deliver images efficiently. These providers may receive your IP address and basic browser information.
Other linked sites. We link to external health resources for your convenience. A link is not an endorsement, and we are not responsible for the privacy practices or content of external sites.

We encourage you to review the privacy policy of any third-party service before providing information to it.

7. Data Security

We maintain administrative, physical, and technical safeguards designed to protect information against unauthorized access, use, disclosure, alteration, and destruction. These include encryption of our website traffic, access controls, workforce training, and periodic review of our security practices.

No method of transmission over the internet and no method of electronic storage is completely secure. While we work to protect your information, we cannot guarantee absolute security. If we experience a breach of unencrypted personal information, we will notify affected individuals and regulators as required by the Florida Information Protection Act (Fla. Stat. § 501.171), HIPAA’s Breach Notification Rule, and other applicable law.

8. Data Retention

We retain information collected through the Site only as long as necessary for the purposes described in this policy, or as required by law, our federal grant obligations, accreditation standards, and applicable record retention schedules. Medical records are retained according to the retention periods required by Florida law and federal regulation. Employment application materials are retained in accordance with applicable federal and state recordkeeping requirements.

9. Children’s Privacy

Our Site is intended for a general audience and is not directed to children under 13. We do not knowingly collect personal information from children under 13 through the Site.

We do provide pediatric and adolescent health services, and a parent or legal guardian may submit information about a minor child in the course of seeking care. Such information is handled under our Notice of Privacy Practices and applicable law, including Florida law governing minors’ rights to consent to certain categories of care.

If you believe a child under 13 has submitted personal information through our Site, please contact us using the information in Section 12 and we will delete it.

10. Your Privacy Choices and Rights

Email communications. If you receive email from us, you may unsubscribe at any time using the link in the message or by contacting us. We may still send you communications related to your care, appointments, or billing.

Access and correction. To request access to, correction of, or deletion of information we hold about you from the Site, contact us using the information in Section 12. If your request concerns your medical record, follow the process described in our Notice of Privacy Practices, which sets out your HIPAA rights and how to exercise them.

Cookies. See Section 2.3.

State privacy laws. Depending on your state of residence, you may have additional rights regarding your personal information. Many state privacy laws contain exemptions for HIPAA-covered entities and for PHI. Where a state law grants you rights that apply to us, we will honor them. Contact us to make a request.

Nondiscrimination. We will not deny you services, charge you a different price, or provide you a different level of care because you exercise a privacy right.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we do, we will revise the “Last Updated” date at the top of this page. Material changes will be highlighted on the Site. Your continued use of the Site after a change takes effect constitutes acceptance of the revised policy.

We encourage you to review this page periodically.

12. Contact Us

If you have questions about this Privacy Policy or our privacy practices, or if you wish to exercise a privacy right, please contact us:

Palms Medical Group Attn: Clinical Compliance Officer 16916 NW US Highway 441 High Springs, FL 32643

Phone: (888) 730-2374 Compliance: (386) 454-0698

To file a privacy complaint, you may contact our EVP of Clinical Compliance at (386) 454-0698, or file a complaint with the Secretary of the U.S. Department of Health and Human Services, Office for Civil Rights. You will not be penalized or retaliated against for filing a complaint.

Website accessibility. Palms Medical Group is committed to ensuring our website is accessible to everyone. If you have difficulty accessing information on this Site, or wish to file a formal grievance under Section 504 or Title II, please call (888) 730-2374.

Palms Medical Group is a Health Center Program grantee under 42 U.S.C. § 254b and a deemed Public Health Service employee under 42 U.S.C. § 233(g)–(n). This institution is an equal opportunity provider and employer.

Updated July 31, 2025