Website privacy and medical privacy
This policy describes DoctorsBeyond Inc.’s handling of information in its website and connected care services. It also explains how to reach the clinician or practice responsible for your health record. A treating provider’s Notice of Privacy Practices describes that provider’s HIPAA responsibilities and must be made available when applicable. This website policy does not substitute for an entity-specific provider notice.
A business associate and a covered entity are different roles under HIPAA. When DoctorsBeyond handles protected health information on a covered provider’s behalf, its use is subject to the applicable business-associate agreement and law. The clinician or practice remains responsible for its own clinical and privacy obligations. Agreeing to website terms or acknowledging a privacy notice is not a blanket authorization for marketing, sale of information or other disclosures requiring separate permission.
Information used by the service
- Account and contact: name, date of birth, contact details, residence, login credentials and communication preferences.
- Care: the selected patient and concern, history, allergies, medications, surgeries, assessments, measurements, appointment details, messages, clinical notes and uploaded records, including PDFs and images.
- Identity and representation: profile images, information needed to verify identity or a representative’s authority, and verification outcomes. Providing an ID for verification is not permission to publish it.
- Coverage and payment: insurance details and required card images, payment status, transaction references, membership and billing records. Card-entry data is handled through the designated payment flow, not ordinary messages.
- Technical information: device/browser details, IP address, session identifiers, pages requested, errors and security logs. Hosting and asset providers can receive technical connection data when a page loads.
Only provide information about another person when you are authorized. Use secure patient workflows for health records; the public support form and ordinary email are not appropriate places for medical details.
Purposes and service providers
Information supports authentication, patient selection, scheduling, clinician review, clinical communication, records, prescription workflows, coverage checks, billing, fraud prevention and operation of the service. Access is based on role and purpose. Relevant information may be processed by clinicians, authorized staff, hosting and communications vendors, electronic-prescribing services, pharmacies, insurers/eligibility services and payment processors as permitted by law and applicable agreements.
A third party’s independent service may also have its own privacy notice.
Cookies, communications and your choices
Session cookies and similar necessary storage keep you signed in, protect forms and remember selections during a visit flow. For example, an unfinished care selection is held in the server session for up to two hours; it is not put in the authentication return URL. Blocking essential cookies may prevent sign-in or intake from working. Browser/device settings control cookie storage and optional camera, microphone and location permissions. Refusing an optional permission may limit that feature, not authorize another use of your information.
Optional promotional email is separate from account and care notifications. You may unsubscribe from marketing without canceling care. A marketing opt-in does not authorize disclosure of clinical information for advertising. We do not sell personal information. Optional public-website measurement is described below and requires your separate choice. It is not a condition of receiving care.
Audio/video recording is not enabled by default. If recording or another optional use is proposed, it must be explained and any required permission obtained before it occurs. Clinical messages and clinical documentation can be part of the record even when a visit is not recorded.
Optional public-website measurement
On selected public marketing pages, visitors who are not signed in can choose website analytics and advertising measurement separately. Both are off until you opt in. Necessary-only choices keep both off. We honor browser Global Privacy Control and Do Not Track signals for this optional measurement.
Website analytics: with your choice, we use our own aggregate page and button counts and, where enabled and named in your consent choices, Google Analytics to understand use of public pages, general Get Care Now links and app-store links. Advertising measurement: with a separate choice, the Meta Pixel records a general public page view. Vendors may receive cookie identifiers, IP address and browser/device connection information. Google and Meta process this information under their privacy notices. Google privacy notice · Meta privacy notice.
These integrations are excluded from signed-in sessions, patient and provider portals, booking, intake, clinical records, payments, support forms, journal and condition-specific pages. We do not send names, contact information, form entries, symptoms, diagnoses, prescriptions, insurance details, patient identifiers or completed appointments as measurement events. Automatic form capture, automatic identity matching and session recording are not enabled by this integration.
Use Cookie preferences in the footer of the homepage or other participating public marketing pages to change or withdraw your choice. Choices are stored for up to 180 days. Withdrawal stops future optional collection and clears the optional measurement cookies we can control; it does not undo information already received by a vendor. Newly added vendors require a new choice. Blocking scripts or refusing optional cookies does not prevent booking care.
Health information and your rights
For information subject to HIPAA, contact the responsible provider, or ask Support to route your request. Depending on applicable rules, you can:
- Request electronic or paper records and an amendment to inaccurate or incomplete information.
- Request confidential communication and restrictions on use or disclosure. Some restrictions must be honored, including qualifying requests about fully self-paid care sent to a health plan.
- Request an accounting of disclosures and a paper copy of the provider’s privacy notice.
- Use an authorized personal representative, subject to verification and applicable limits.
- Complain to the provider or to HHS Office for Civil Rights without retaliation.
Access, exceptions, permitted fees and response deadlines follow applicable law. Record corrections may appear as addenda; a request does not automatically erase a signed note. A provider’s notice explains its permitted treatment, payment and healthcare-operations disclosures and duties. An unpaid bill or ended membership does not by itself eliminate a legal right to records.
Additional protection for sensitive records
Some records have protections beyond ordinary HIPAA rules. These may include psychotherapy notes, substance-use-disorder records and records protected by state confidentiality law. An ordinary mental-health visit note is not automatically a separately maintained psychotherapy note. When an authorization is required, it is separate, describes its purpose and can generally be revoked prospectively, subject to action already taken in reliance on it.
If we receive substance-use-disorder records protected by 42 CFR Part 2, those records cannot be used or disclosed in civil, criminal, administrative or legislative investigations or proceedings against you without the required specific written consent or a qualifying court order and subpoena, as applicable. General site consent does not waive that protection. The revised federal notice requirements applicable from February 16, 2026 must be reflected in the responsible provider’s notice; this statement does not imply that DoctorsBeyond is itself a Part 2 treatment program.
Legal requests and other disclosures
A legal demand is reviewed under the rules that apply to the particular information. Information may be disclosed for public-health or safety duties, mandated reporting, lawful oversight, valid legal process or other purposes only where the relevant law permits or requires it. A general suspicion of misconduct, receipt of a request, or acceptance of these terms is not unlimited authority to release a medical record. More protective state or federal rules still apply.
Personal information may be processed in a corporate transaction only subject to applicable privacy duties and restrictions; a transaction does not itself authorize an incompatible use of protected health information. De-identified information must meet applicable standards before being treated as de-identified.
Children, dependents and representatives
Accounts are intended for adults. An authorized adult can arrange a child’s care and provide relevant information through the dependent workflow. Access depends on legal authority and the nature of the service, not simply who pays or owns the account. Some minors can consent to particular care and have confidentiality rights under state law. Support and the treating provider must review those situations; a family subscription does not override them. An adult family member’s information is not made available merely because another adult bought a plan.
Security, retention and international access
Administrative, technical and physical safeguards, including authenticated access and protected transmission where configured, reduce risk; no internet service can guarantee absolute security. Protect your device and login, use a private setting and report suspected compromise. Required breach notices will follow applicable law. This policy does not shift the service’s statutory security duties to you.
Retention depends on clinical, billing, security and legal requirements, the record category, the patient’s age and pending obligations. Deleting a profile or canceling a subscription does not necessarily delete a medical record. Ask Support about an access, correction or deletion request; we will explain applicable retention limits. Service data may be processed in the United States and other locations used by authorized providers, subject to applicable safeguards. International account registration is not a guarantee of international care or a waiver of privacy rights.
Questions, requests and policy updates
Contact DoctorsBeyond Support for account, billing, accessibility or document requests. For a privacy request, use admin@doctorsbeyond.com with the subject “Privacy request,” or write to DoctorsBeyond Inc., Attn: Privacy / Member Support, 388 Bullsboro Drive, Suite 354, Newnan, GA 30263. Do not include medical details, identification documents or payment card numbers in ordinary email; ask for a secure way to provide them.
We may need to verify identity and authority before acting on a request. You may ask for accessible or confidential communication. Revisions are dated, and additional notice or permission will be provided where required. The same privacy choices apply regardless of whether a requested medication is prescribed.