top of page

Privacy Policy and Data Handling

Paula Petrone | OMT of New York

Effective date: October 15, 2026

This policy explains how we collect, use, share, protect, and retain information related to paulapetroneomt.com and requests for orofacial myofunctional therapy services. It should be read together with the HIPAA Notice of Privacy Practices and applicable clinical consents.

  • The practice identified in the consent documents as OMT of New York, represented by Paula Petrone, orofacial myologist, administers data processed through the website and associated services.

    Mailing address: 127 South Street, Oyster Bay, NY 11771, United States. For privacy questions, rights requests, or complaints, use the website contact form or this mailing address. The practice will respond within the time required by applicable law.

  • We collect only the information needed to respond to, coordinate, provide, bill for, and document requested services.

    ​

    • Identification and contact information: name, email address, telephone number, address, and alternate contact details.

    • Health information: history, symptoms, evaluations, diagnosis, treatment records, photographs or documents shared with us, and other information needed for care.

    • Appointment and communication information: requests, messages, contact preferences, reminders, call notes, and authorizations to leave voicemail messages.

    • Payment information: information needed to process charges, receipts, and account status. The practice does not intend to retain the full card number when payment is processed through a secure third-party provider.

    • Technical information: IP address, device type, browser, pages visited, access date and time, security logs, and cookie preferences, depending on the features enabled on the website.

     

    Do not submit urgent clinical information, full card details, or credentials through the public website form. Email, text, and telephone communications may not be completely secure.

  • We may use information to:

    ​

    • answer questions and contact requests;

    • schedule, confirm, change, or cancel appointments;

    • perform evaluations and provide orofacial myofunctional therapy;

    • send treatment plans, progress reports, reminders, and essential communications;

    • process payments, session packages, and authorized late-cancellation charges;

    • coordinate telehealth visits and maintain clinical records;

    • meet legal, professional, accounting, and security obligations;

    • detect, investigate, and prevent fraud, abuse, incidents, and unauthorized access; and

    • improve website functionality, accessibility, and security according to cookie preferences.

     

    Health information is used and disclosed in accordance with HIPAA when HIPAA applies, the authorizations provided, and applicable state and federal law. A contact request alone does not create a professional relationship or guarantee an appointment.

  • The practice may use email, text messaging, telephone, and voicemail for scheduling, treatment plans, progress reports, and other essential communications when the person has provided that information or authorized those methods.

    ​

    A person may request another contact method, limit message content, or withdraw a written authorization. Preferences recorded in a consent form remain effective until changed or revoked in writing, unless a legal obligation requires the information to be retained or communicated.

    ​

    Communication channels are not emergency services. In an emergency, call 911. Do not use email, text messaging, or the website for urgent care.

  • We may share the minimum information necessary with providers that perform services for the practice and must protect it under their contractual and legal obligations. The source documents identify the following services:

    Provider
    Function
    Website providers

    Hosting, security, maintenance, analytics, or cookies, only if those features are enabled.

    Stripe

    Card payment processing through SimplePractice.

    SimplePractice

    Appointment management, records, communications, and telehealth, depending on the service contracted.

    We do not sell personal information or health information. We do not share information for health-information-based targeted advertising without authorization required by law. We may also disclose information when required by law, court order, audit, regulatory authority, or security situation.

  • Telehealth visits may be provided through Telehealth by SimplePractice. Participation is voluntary and may be discontinued. The technology may involve interruptions, technical difficulties, or unauthorized access. Do not share the appointment link with unauthorized people, and try to conduct the visit in a private location.

    SimplePractice facilitates videoconferencing and does not itself provide medical or emergency services. The terms of the telehealth consent, including its limitations and risks, apply to each applicable service.

  • When information is protected health information, the practice may use or disclose it for treatment, payment, and health care operations, or when a valid authorization exists. Disclosures to a spouse, parent, guardian, referring physician, or another person will be limited to the options authorized by the individual or legal representative, except where an applicable legal exception applies.

    The practice will make the HIPAA Notice of Privacy Practices available. That notice explains specific rights concerning access, correction, confidential communications, restrictions, an accounting of disclosures, copies of the notice, and complaints.

  • Depending on the information and applicable law, a person may request:

    ​

    • access to or a copy of records and data;

    • correction of inaccurate or incomplete information;

    • confidential communications through an alternate method or address;

    • restriction of certain uses or disclosures;

    • information about certain disclosures;

    • withdrawal of consents or communication preferences when possible;

    • deletion of data that we are not required to retain by law, contract, security needs, or claims defense; and

    • submission of a complaint to the practice or appropriate authority without retaliation.

     

    To exercise a right, send a written request with your name, contact information, requested right, and scope of the request. We may request reasonable information to verify identity. Some requests may be limited by clinical, legal, or record-retention obligations.

  • For clients under 18, a parent or legal representative may have access to certain information, subject to applicable law and professional judgment concerning confidentiality and safety. A representative request must establish authority to act for the minor.

  • When a charge is authorized, OMT of New York may process it through Stripe via SimplePractice. Card authorization remains in effect until revoked in writing, without affecting charges already authorized or payment obligations. Charges, fees, cancellations, and refunds are governed by the payment authorization and practice policies, not this website policy.

  • The website may use cookies necessary for operation, security, and preferences. If analytics, marketing, pixels, or other non-essential technologies are enabled, the website must disclose their purpose, provider, duration, and opt-out option before activation when required by law. The practice must not configure analytics or advertising tools to send identifiable clinical information.

    Cookie controls may depend on the browser and the website technical configuration. The practice will update this section when installed tools change.

  • We apply reasonable administrative, technical, and physical safeguards to protect information against loss, misuse, unauthorized access, alteration, or disclosure. No system, email, text message, or internet transmission can guarantee absolute security.

    If an incident affecting protected information is confirmed, the practice will assess it and make notifications required by HIPAA, state law, or another applicable rule. Incidents involving providers will be managed according to their notification obligations and applicable contract.

  • We retain data for as long as necessary to provide services, maintain clinical and accounting records, resolve disputes, meet legal obligations, and protect our rights. Retention periods depend on the type of data and applicable law. When data is no longer needed, it will be deleted, anonymized, or destroyed through reasonable procedures.

  • We may update this policy to reflect changes in practices, providers, technologies, or legal requirements. We will publish the current version on the website and state its effective date. Material changes will be communicated through the method required by law.

  • For questions, rights requests, or privacy complaints, contact the practice through the paulapetroneomt.com contact form or by mail at 127 South Street, Oyster Bay, NY 11771, United States. You may also file a complaint with the Office for Civil Rights of the U.S. Department of Health and Human Services if you believe your HIPAA rights have been violated. The practice will not retaliate for filing a complaint.

bottom of page