Privacy Policy

Effective Date: September 14, 2026. This Privacy Policy details how Kassis Salameh Plastic Surgery collects, utilizes, safeguards, and processes patient and website visitor information across our digital platforms and clinical intake systems.

01. Data Collection & LeadConnector Infrastructure

Kassis Salameh Plastic Surgery utilizes specialized clinical intake and communication software to streamline consultation scheduling, patient inquiries, and administrative workflows. When you submit inquiries via our digital contact forms, schedule consultations, or engage with our chat widgets, our systems collect identifying information including your full legal name, telephone number, email address, physical address, and general consultation interest.

02. Medical Information Handling & HIPAA Compliance

As a medical practice operating under the laws of the Commonwealth of Kentucky and federal healthcare standards, all Protected Health Information (PHI) is handled strictly pursuant to the Health Insurance Portability and Accountability Act (HIPAA). Preliminary web inquiries do not constitute a formal physician-patient relationship. Once an in-person or virtual consultation occurs, detailed medical history, surgical records, and clinical photography are preserved within our HIPAA-compliant Electronic Health Record (EHR) system, fully isolated from commercial marketing databases.

03. SMS Communication & Consent Protocols

By opting into SMS updates through our contact or booking modules, you grant express consent for Kassis Salameh Plastic Surgery to send appointment confirmations, pre-procedure directions, follow-up messages, and practice notifications. Mobile subscriber information and SMS opt-in data will never be sold, rented, leased, or shared with third parties or affiliates for promotional or marketing objectives. You may revoke SMS authorization at any time by replying STOP to any automated dispatch.

04. Structured Data Categories

Direct Identifiers
EXAMPLES COLLECTED: Full name, phone number, email address, residential zip code
PRIMARY PURPOSE: Consultation scheduling, inbound inquiry response, appointment logistics
LEGAL BASIS: Express Patient Consent

Medical Records (PHI)
EXAMPLES COLLECTED: Clinical questionnaires, health history, surgical records, consultation notes
PRIMARY PURPOSE: Medical evaluation, procedural planning, ongoing patient care
LEGAL BASIS: HIPAA / Healthcare Treatment

Technical Telemetry
EXAMPLES COLLECTED: IP address, browser specification, session duration, referral source
PRIMARY PURPOSE: Site security verification, system optimization, navigation analytics
LEGAL BASIS: Legitimate Practice Interests

SMS Communication Data
EXAMPLES COLLECTED: Opt-in timestamps, confirmation logs, message delivery status
PRIMARY PURPOSE: Delivery of transactional appointment alerts and care reminders
LEGAL BASIS: Direct SMS Opt-In Consent

05. Data Retention & Operational Verification

In accordance with Kentucky Administrative Regulations (KAR) regarding medical record retention, surgical and patient health records are maintained for a mandatory minimum term following the last clinical encounter. Routine web inquiries that do not result in clinical care are purged in accordance with our administrative data retention schedule.

06. Patient Rights & Contact Protocol

Patients and website visitors hold defined legal entitlements regarding their personal data, including the right to request an accounting of disclosures, inspect their medical records, request amendments to erroneous clinical documentation, and revoke commercial communication preferences. For all privacy inquiries, HIPAA compliance verification, or formal record requests, contact our designated privacy officer directly.