Privacy Policy

Effective Date: May 1, 2026

1. Introduction and Scope

Midlands Orthopaedics and Neurosurgery, P.A. (“the Practice,” “we,” “us,” or “our”) is committed to protecting the privacy of visitors to our website located at www.midorthoneuro.com (the “Site”). This Website Privacy Policy (“Policy”) describes the types of information we and our service providers collect when you visit the Site, how that information is used and shared, and the choices available to you.

This Policy applies solely to information collected through the Site and does not govern information you provide to us in connection with clinical care, appointment scheduling through our office, or any other offline interaction. Information related to your medical care is governed by our separately published Notice of Privacy Practices, which is available at our offices and on the Patient Resources page of the Site.

By accessing or using the Site, you are consenting to the data collection described in this Policy.

2. Important Notice Regarding HIPAA and Website Use

Our website is hosted on a server that is not a HIPAA-compliant hosting environment. Accordingly, you should not submit any protected health information (PHI) or individually identifiable health information through general website functions such as email links or browser-based activity on the Site.

Where we offer an opportunity to submit information that may be sensitive in nature — such as appointment requests — those functions are routed through HIPAA-secure platforms. Any standard email links displayed on the Site are not encrypted in transit and should not be used to transmit clinical or health information.

The Patient Portal accessible via the Site is operated by a separate third-party vendor and is governed by that vendor’s own privacy policy and terms of service. The Practice does not control the data practices of the Patient Portal vendor.

3. Information We Collect

3.1 Information You Provide Voluntarily

The Site does not include a general contact form. Visitors who choose to contact us may do so by:

Clicking an email address link displayed on the Site, which will open your personal email client. Any information you include in that email is transmitted directly to our staff, but is not encrypted.
Using HIPAA-secure Formstack intake forms where specifically provided, which are subject to Formstack’s privacy and security terms in addition to this Policy.

3.2 Information Collected Automatically

When you visit the Site, certain information is collected automatically by our hosting server and by third-party tracking technologies. This may include:

Your Internet Protocol (IP) address and general geographic location derived from it
Browser type, operating system, and device type
Pages visited, time spent on pages, and navigation path through the Site
Referring URL (the site from which you arrived)
Date and time of your visit
Actions taken on the Site, such as button clicks and page views, as well as interactions associated with marketing campaigns including click activity and engagement with advertising sources (see Section 4 for details)

This information is collected through server logs, cookies, pixel tags, click-tracking tools, and similar tracking technologies operated by our service providers. These technologies may also be used to associate user interactions with advertising campaigns, including paid search, social media, and other digital marketing efforts. Importantly, this data is collected at the browser level and is not linked to a specific patient record or clinical account.

3.3. Call Tracking

When you arrive at the Site through a paid search advertisement, the telephone number displayed to you may be a dynamic call-tracking number provisioned through Marchex, Inc. (“Marchex”), a third-party call analytics service. This number functions as a temporary replacement for our main phone number for the duration of your session originating from the paid search campaign.

Calls made to this tracking number may be recorded. Callers will hear an automated notice that the call may be recorded for quality purposes. Call recordings are stored on Marchex’s servers and are subject to Marchex’s privacy policy and security practices. The Practice uses call data solely to measure and optimize advertising campaign performance. Call records are not matched to patient records in our clinical systems.

Marchex’s privacy policy is available at: www.marchex.com/privacy-policy

4. Tracking Technologies and Third-Party Services

4.1 Cookies and Similar Technologies

Cookies are small text files placed on your device by websites you visit. The Site uses cookies and similar technologies for the following general purposes:

Analytics — to understand how visitors use the Site and improve its content and navigation
Advertising — to measure the effectiveness of our paid advertising campaigns and to serve relevant ads to users who have previously visited the Site
Campaign Attribution — to associate visits, clicks, and other interactions with specific advertising sources, including search campaigns, social media platforms, and other digital marketing channels

You may configure your browser to refuse cookies or to alert you when cookies are being sent. Please be aware that disabling cookies may affect the functionality of certain features of the Site.

4.2 Third-Party Tracking and Advertising Services

The Site currently incorporates tracking code or pixels from the following third-party services. Each service operates under its own privacy policy, which governs how it handles data collected through its technologies:

Advertising Platforms:

Google Ads, Google Tag Manager, Google Dynamic Remarketing, and DoubleClick — used for pay-per-click search advertising and remarketing. Google’s privacy policy is available at policies.google.com/privacy.
Microsoft Advertising (formerly Bing Ads) — used for pay-per-click search advertising. Microsoft’s privacy policy is available at privacy.microsoft.com.
Meta Platforms (Facebook and Instagram) — used for social media advertising campaigns. including the use of Meta Pixel technologies. Meta’s privacy policy is available at www.facebook.com/privacy/policy.

Programmatic Advertising and Third-Party Pixels:

The Practice may participate in programmatic advertising campaigns through third-party networks. These campaigns may include scheduled advertising placements and may utilize tracking pixels or similar technologies to measure advertisement performance, user engagement, and campaign effectiveness.

Certain third-party platforms may deploy and manage these technologies independently, and as a result, the Practice may not have direct control over all tracking mechanisms used by such third parties.

All tracking technologies implemented on the Site are intended to collect information at a general interaction level, such as page visits, clicks, and campaign attribution data. These technologies are not configured to collect Protected Health Information (PHI) and are not used to identify visitors as patients or to associate website activity with medical records.

Analytics Platforms:

Google Analytics — used for website traffic analysis. Google’s privacy policy applies.
Hotjar — used for behavioral analytics including heatmaps and session data. Hotjar’s privacy policy is available at www.hotjar.com/legal/policies/privacy.
Piwik PRO / Matomo — used for web analytics. Piwik PRO’s privacy policy is available at piwik.pro/privacy-policy.

Some of these third-party trackers may have been installed on the Site prior to the current hosting arrangement and the Practice is actively reviewing the full inventory of tracking technologies on the Site. We are committed to ensuring that all active trackers are disclosed in this Policy and serve a legitimate business purpose.

4.3 OTT/CTV Advertising

The Practice periodically runs over-the-top (OTT) and connected television (CTV) advertising campaigns. Tracking code associated with these campaigns may be placed on the Site to measure website visits and foot traffic attributable to those ads. This tracking does not collect PHI and does not link visitor identities to patient records.

5. How We Use Information Collected Through the Site

Information collected through the Site is used for the following purposes:

To operate and maintain the Site and ensure its technical performance
To understand how visitors navigate and use the Site so we may improve content and user experience
To measure the effectiveness of our paid advertising campaigns across search, social, and OTT/CTV platforms
To optimize advertising spend by allocating budget toward keywords, platforms, and campaigns that generate the most meaningful visitor interactions
To respond to inquiries submitted through Formstack or via email
To comply with applicable legal obligations

We do not use website-collected information to make clinical or treatment decisions, and we do not combine website analytics data with your medical records.

6. Sharing of Information

We do not sell, rent, or trade your personal information to third parties for their own marketing purposes. Information collected through the Site may be shared in the following limited circumstances:

Service Providers: We share data with Digital Tulip, our website hosting and digital marketing partner, and their authorized subcontractors (including Marchex for call tracking). Digital Tulip’s web developer has access to backend server data, which may include IP addresses and form submission metadata.

Advertising Platforms: Tracking pixels and tags on the Site transmit behavioral data (such as page visits and click activity, and campaign attribution data) to the advertising platforms listed in Section 4.2. This data is used to measure and optimize campaigns.

Legal Requirements: We may disclose information when required to do so by law, court order, or governmental authority, or when we believe disclosure is necessary to protect the rights or safety of any person.

Business Transfers: In the event of a merger, acquisition, or sale of all or a portion of the Practice’s assets, information collected through the Site may be transferred as part of that transaction.

7. Patient Portal & Direct Scheduling

A link to our Patient Portal is accessible through the Site. The Patient Portal is operated by athenaHealth, an independent third-party vendor, and functions as a separate application embedded within our domain. Our Direct Scheduling platform is operated by Assort Health, also an independent third-party vendor, and functions as a separate application embedded within our domain. Any information you submit through the Patient Portal or Direct Scheduling Platform — including login credentials, appointment requests, or health information — is collected and processed by those vendors and is governed by the vendor’s privacy policy and applicable HIPAA requirements. We encourage you to review the privacy policies of those vendors before submitting information.

Please note that the Patient Portal and Direct Scheduling Platform are HIPAA-regulated environments and are distinct from the general public-facing website described in this Policy.

8. Data Retention

Server logs containing visitor IP addresses and browsing activity are retained by Digital Tulip in accordance with their standard data retention practices. Call recordings made through the Marchex call-tracking system are stored on Marchex’s servers and retained pursuant to Marchex’s data retention and security policies.

Analytics and advertising data retained by third-party platforms (Google, Meta, Microsoft, Hotjar, Piwik PRO/Matomo) are governed by each platform’s respective data retention policies

9. Your Choices and Opt-Out Rights

9.1 Browser-Level Controls

Most web browsers allow you to control cookies through browser settings. You may choose to block or delete cookies; however, doing so may affect your experience on the Site.

9.2 Advertising Opt-Outs

You may opt out of interest-based advertising from participating companies through the following mechanisms:

Network Advertising Initiative (NAI) Opt-Out: optout.networkadvertising.org
Digital Advertising Alliance (DAA) Opt-Out: optout.aboutads.info
Google Ads Settings: adssettings.google.com
Meta Ad Preferences: www.facebook.com/ads/preferences

Please note that opting out of interest-based advertising does not mean you will stop seeing ads; it means those ads will no longer be tailored based on your browsing behavior.

9.3 Do Not Track

Some browsers include a “Do Not Track” (DNT) feature that signals to websites that you do not wish to be tracked. Because there is no uniform standard for how websites should respond to DNT signals, the Site does not currently alter its data collection practices in response to DNT signals.

10. Children’s Privacy

The Site is not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13. If you believe that a child under 13 has provided personal information through the Site, please contact us using the information in Section 12 and we will take appropriate steps to remove such information.

11. Security

We take reasonable administrative, technical, and physical measures to protect information collected through the Site from unauthorized access, disclosure, or loss. However, no method of transmission over the Internet or electronic storage is completely secure. Accordingly, we cannot guarantee the absolute security of information transmitted to or from the Site.

As noted in Section 2, the web hosting server used for the public-facing Site is not a HIPAA-compliant environment. You should not transmit PHI or sensitive clinical information through general Site functions such as standard email links.

12. Contact Us

If you have questions or concerns about this Policy, or wish to exercise any rights you may have with respect to information collected through the Site, please contact us at:

Midlands Orthopaedics and Neurosurgery, P.A.

Attn: Privacy Officer 1910 Blanding Street

Columbia, SC 29201

Website: www.midorthoneuro.com

13. Changes to This Policy

We reserve the right to update or modify this Policy at any time. When we make material changes, we will update the “Last Revised” date at the top of this page. Your continued use of the Site following the posting of changes constitutes your acceptance of those changes. We encourage you to review this Policy periodically.

This Website Privacy Policy does not constitute legal advice and does not replace the Notice of Privacy Practices governing your protected health information under HIPAA.