Privacy Policy

1 Introduction & Scope

North Valley Medical Group LLC, doing business as North Valley Specialty Group ("we," "us," or "our"), is a mobile wound care company located at 10860 Gold Center Dr #255, Rancho Cordova, CA 95670. We provide professional wound care services to skilled nursing facilities, assisted living communities, and private patients throughout the Sacramento region and surrounding areas.

This Privacy Policy explains how we collect, use, disclose, and safeguard information obtained through our website (nvsgmobilewoundcare.org) and through our clinical intake and referral processes. It applies to all visitors, patients, caregivers, healthcare facility partners, and referring providers who interact with us online or in person.

By accessing our website or submitting information through any of our forms, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any terms herein, please refrain from submitting personal or health information through our website.

2 Information We Collect

We collect information you voluntarily provide when you submit a referral request, contact form, or otherwise communicate with us. The categories of information we may collect include:

• Patient / Facility Name — the name of the patient or the facility submitting the referral
• Phone Number — a contact number for follow-up regarding care coordination
• Email Address — for correspondence and appointment or service confirmation
• Organization / Facility Name — the name of the referring skilled nursing facility, assisted living facility, home health agency, or other healthcare organization
• Type of Referral — the category of care setting (e.g., SNF, ALF, home health, self-referral)
• Wound Type / Clinical Notes — a brief description of the wound, its location, or any relevant clinical information necessary to prepare appropriate care

We do not collect payment card information, Social Security numbers, or government identification numbers through our website. Sensitive billing and insurance information is collected separately through our clinical intake process.

3 How We Use Your Information

Information collected through our website is used solely for the following purposes:

• Care Coordination — to contact the referring provider or facility and schedule an appropriate wound care visit
• Clinical Preparation — to ensure our clinicians arrive equipped with the proper supplies and treatment protocols for the reported wound type
• Communication — to respond to inquiries, confirm appointments, and provide updates regarding the status of a referral or visit
• Service Improvement — in aggregate and de-identified form, to understand demand for services and improve our clinical workflows
• Legal and Regulatory Compliance — to fulfill obligations under HIPAA, California law, and other applicable regulations

We will not use your information for unsolicited marketing communications or sell, rent, or trade your personal information to any third party for commercial purposes.

4 HIPAA Compliance & Protected Health Information

North Valley Medical Group LLC is a covered entity under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its implementing regulations, including the HIPAA Privacy Rule (45 CFR Part 164) and the HIPAA Security Rule.

Any individually identifiable health information submitted to us — including wound type, clinical notes, and associated patient identifiers — constitutes Protected Health Information (PHI) and is handled in accordance with all HIPAA requirements.

We maintain a formal Notice of Privacy Practices (NPP), which is provided to patients upon initiation of care and is available upon request. The NPP describes in greater detail how we may use and disclose your PHI, your rights with respect to your PHI, and our legal duties and privacy practices.

All staff with access to PHI receive regular HIPAA compliance training. We conduct periodic risk assessments and have implemented administrative, physical, and technical safeguards to maintain the confidentiality, integrity, and availability of PHI.

5 How We Protect Your Information

We take the security of your information seriously and implement reasonable and appropriate safeguards, including:

• Encryption in Transit — our website uses HTTPS (TLS encryption) to protect data transmitted between your browser and our servers
• HIPAA-Compliant Form Processing — referral and contact form submissions are processed through Jotform's HIPAA-compliant platform, which includes encryption at rest and in transit, access controls, and signed Business Associate Agreements (BAA)
• Access Controls — access to submitted information is limited to authorized personnel on a need-to-know basis
• Staff Training — all employees and contractors who handle PHI receive HIPAA privacy and security training
• Incident Response — we maintain policies and procedures for detecting, reporting, and responding to data security incidents and breaches in accordance with the HIPAA Breach Notification Rule

While we implement strong security measures, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security; however, we are committed to protecting your information to the best of our ability.

6 Sharing of Information

We do not sell, rent, trade, or otherwise transfer your personal information or PHI to third parties for commercial purposes.

We may share information only in the following limited circumstances:

• Treatment, Payment, and Healthcare Operations — as permitted under HIPAA, we may share PHI with other treating providers, health plans, or healthcare clearinghouses as necessary for care coordination and billing
• Business Associates — we work with service providers (including Jotform, Inc.) who access PHI on our behalf. Each such provider is required to sign a HIPAA-compliant Business Associate Agreement (BAA) and is contractually bound to protect PHI
• Legal Requirements — we may disclose information if required by law, court order, subpoena, or government regulation, or to protect the rights, property, or safety of our patients, staff, or the public
• With Your Authorization — we may share your information for any other purpose with your express written authorization, which you may revoke at any time

7 Your Rights Under HIPAA

As a patient or prospective patient, you have the following rights with respect to your Protected Health Information:

To exercise any of these rights, please contact our Privacy Officer using the information provided in Section 11. We will respond to your request within the timeframes required by applicable law.

You also have the right to file a complaint with the U.S. Department of Health and Human Services (HHS) Office for Civil Rights if you believe your privacy rights have been violated. Filing a complaint will not result in any retaliation by North Valley Medical Group LLC.

8 Cookies & Website Analytics

Our website may use standard web technologies, such as cookies and similar tracking tools, to improve functionality and understand how visitors interact with our site. This may include:

• Session Cookies — temporary cookies that expire when you close your browser, used to maintain basic website functionality
• Analytics — aggregated, anonymized data about website usage patterns (such as page views and navigation flows) to help us improve user experience

Cookies used on this website do not collect personally identifiable health information. You may configure your browser to refuse cookies or alert you when cookies are being sent; however, some parts of the site may not function correctly without cookies enabled.

We do not use cookies to track your health information or link your browsing behavior to any PHI you submit through our forms.

9 Third-Party Services

Our website uses the following third-party services to deliver functionality:

• Jotform, Inc. — We use Jotform to process referral and contact form submissions. Jotform is a HIPAA-eligible form platform. We have executed a Business Associate Agreement (BAA) with Jotform, and all form data is stored on Jotform's HIPAA-compliant infrastructure with encryption at rest and in transit. Jotform's privacy policy is available at www.jotform.com/privacy.
• Google Fonts — We use Google Fonts to load website typography. Google may collect limited technical data (such as IP address) when fonts are loaded. No PHI is transmitted to Google. See Google's Privacy Policy for details.
• Vercel — Our website is hosted on Vercel's cloud platform. Vercel may collect server logs including IP addresses for security and performance purposes. No PHI is stored on Vercel's infrastructure.

We are not responsible for the privacy practices of third-party services. We encourage you to review the privacy policies of any third-party services you interact with.

10 Changes to This Policy

We reserve the right to update or modify this Privacy Policy at any time. When we make material changes, we will update the "Last Updated" date at the top of this page. We encourage you to review this policy periodically to stay informed about how we protect your information.

Your continued use of our website following the posting of any changes constitutes your acceptance of those changes. If any change is unacceptable to you, please discontinue use of our website and contact us to address your concerns.

For patients under active care, material changes to our Notice of Privacy Practices will be communicated directly in accordance with HIPAA requirements.

11 Contact Our Privacy Officer

If you have questions, concerns, or requests related to this Privacy Policy or your rights under HIPAA, please contact our designated Privacy Officer: