What this site collects, and what it doesn’t

This policy covers TallBunnyMD.com, the studio’s own website. It is written for the people who visit: doctors, practice managers, and their teams. It is short because the site collects very little, and plain because a policy you cannot read protects nobody.

Three things, and only when they happen:

• The contact form. If you submit it, we receive what you typed: your name, how to reach you, and whatever you choose to tell us about your practice. Nothing is sent until you press send.
• Hosting logs. Like nearly every website, the servers that host this site record technical basics for each request: the IP address it came from, the page asked for, the browser used, and the time. We use these to keep the site secure and running.
• One saved preference. If you switch between the light and dark themes, that choice is stored in your browser so the site can remember it. It stays on your device and identifies no one.

That is the complete list. This site runs no advertising trackers, no cross-site pixels, and no analytics that follow you to other websites. It also loads no third-party hosts at all: the fonts, the images, and the scripts all come from this domain, which you can check in your browser’s network panel. There is no cookie banner here because there are no tracking cookies to ask you about.

We use what you send to answer you: to respond to the inquiry, to prepare for a discovery call if you ask for one, and to keep an honest record of our correspondence.

We do not sell personal information. We do not rent it or trade it, and we do not add you to marketing lists you did not ask for.

TallBunnyMD works for practices on their growth, not on patient care, and this website is not a patient portal. Please do not include patient information in the contact form; a conversation about marketing never needs it. If a submission arrives containing patient details, we delete it and ask you to resend without them.

That is why this form is designed the way it is. There is no symptom box and no clinical field on it, because the field nobody builds is the field that cannot leak.

The rest of this page is about this website. This section is about the systems we build for a practice, which is the question doctors ask first, and it is worth answering in the same plain language.

The organizing principle is that attribution needs a source and an outcome, and it does not need a person. In practice that means:

• We design measurement that never asks for a patient’s name, condition, or record, so there is nothing sensitive inside it to protect.
• We do not place advertising or analytics code inside patient portals or logged-in scheduling.
• We do not build advertising audiences from people who read about a condition, and we do not upload patient lists to advertising platforms.
• We do not touch a practice’s phone system in any way.
• We record where an inquiry came from and whether it became an appointment. There is no field anywhere in that record for a patient’s name, and no column in the database that could hold one.
• Every tracking script on a practice’s site is inventoried in writing, with what it sends and where it goes, alongside the list of what we deliberately do not collect.
• Where a vendor would handle information on a practice’s behalf that could identify a patient, that vendor signs a business associate agreement or we do not use it.

The limits, stated plainly, because a vendor who will not state them is the one to worry about. There is no HIPAA certification for software or for agencies, so we do not claim one. We cannot make a practice compliant, and no vendor can; compliance is an attribute of a whole operation, not of a website. We are not attorneys and nothing here is legal advice. Your counsel or privacy officer should review anything that touches patient data, and we will hand them the written record they need to do it properly.

The longer version, with the reasoning behind each choice, is on the compliance page.

[CLIENT LEGAL TO CONFIRM] Confirm how this section should describe the studio’s status in client engagements, and whether any practice-facing notice is required alongside the engagement agreement.

This site is hosted, and our email is delivered, by service providers that process data on our behalf so those services can work. They are not permitted to use it for their own purposes. Beyond that, we disclose personal information only if the law requires it.

None of those providers receives patient information, because none of it belongs in this website in the first place. Where a practice engagement involves a vendor that would, the business associate agreement described above is the condition of using it.

[CLIENT LEGAL TO CONFIRM] Name the current hosting and email providers here with links to their data terms, and confirm the legal-disclosure wording.

We keep inquiries and correspondence for as long as we need them to respond and to maintain honest records of the studio’s work. Hosting logs rotate on the provider’s standard schedule.

[CLIENT LEGAL TO CONFIRM] Confirm exact retention periods once the provider stack is final.

You can ask what we hold about you, ask us to correct it, or ask us to delete it. Email contact@tallbunny.com and a person will handle it. There is no form to hunt for and no account to close.

[CLIENT LEGAL TO CONFIRM] Residents of some states, California among them, have additional statutory privacy rights. Confirm the state-specific disclosures required for where the studio does business.

This site is written for medical professionals and their teams. It is not directed to children, and we do not knowingly collect information about them.

If our practices change, this page changes with them and the date at the top moves. We do not edit it silently.

Questions about this policy, or about anything this site does, reach a person, not a queue.

• Email contact@tallbunny.com
• Call 864-606-2712