Who we are and what this covers
This website, ivyleaguepediatrics.com (the "Site"), is operated by Ivy League Pediatrics, Inc., a Georgia corporation ("Ivy League Pediatrics," "we," "us" or "our"), located at 603 Old Norcross Rd, Ste A, Lawrenceville, GA 30046. We are a pediatric primary care practice.
This Privacy Policy covers information collected through the Site. It does not cover the medical information you give us as a patient or a parent or guardian of a patient. That information is protected health information under the Health Insurance Portability and Accountability Act (HIPAA), and how we use and protect it is described in our Notice of Privacy Practices. If you are reading this because you want to know how your child's medical records are handled, that is the document you want.
By using the Site you agree to this Privacy Policy and to our Terms of Use. If you do not agree, please do not use the Site. You can still reach us by phone at 678-407-4489.
Information we collect
The Site is an informational website. It has no user accounts, no on-site forms, and takes no payments. Here is what does reach us.
Information you give us directly
If you email us at info@ivyleaguepediatrics.com or call us, we receive whatever you choose to include, such as your name, contact details and the content of your message. Please do not send urgent clinical questions by email. If your message concerns your child's care, we treat it as part of the patient record and it is covered by our Notice of Privacy Practices.
Information you give to our booking tools
New-patient registration and existing-patient booking happen on separate services that we use, not on the Site itself. The "Book your first visit" buttons open our registration form, hosted by Jotform. The "Book in the portal" buttons open our patient portal, run by our electronic health record vendor, PCC. Information you enter there, such as your child's name, date of birth, insurance details or a reason for the visit, is health information that we receive as your child's provider. It is protected under HIPAA and handled under our Notice of Privacy Practices and our agreements with those vendors. See Booking tools and other third-party services below.
Information collected automatically
When you visit the Site, the following is collected automatically:
- Server logs. The Site is hosted by Cloudflare. Like any web host, Cloudflare records standard request data, such as your IP address, browser type, the pages you request, the referring page and the date and time, so the Site can be served securely and reliably and so abusive traffic can be blocked.
- Aggregate analytics. We use Cloudflare Web Analytics to understand how many people visit and which pages they read. Cloudflare states that this tool does not use cookies or local storage and does not fingerprint visitors by IP address, user agent or any other data. We see aggregate counts, not individual visitors.
- Referral tags. Some pages let you share a link to the Site by text message or by copying it. Those links carry a short tag (for example
?ref=text) that tells us which sharing channel was used. The tag identifies a channel, not a person. It is not stored by us and it says nothing about who sent or received the link.
What we do not collect through the Site
- We do not use Google Analytics, advertising pixels or any cross-site tracking.
- We do not set cookies of our own, and we do not use cookies for advertising.
- We do not sell personal information, and we do not share it for targeted advertising.
- We do not collect payment information through the Site.
How we use information
We use the information described above to:
- serve the Site to you securely and keep it working;
- respond to messages and calls, and follow up on registration requests;
- understand, in aggregate, which pages are useful so we can improve them;
- detect, prevent and investigate abuse, fraud and security incidents; and
- comply with legal obligations and enforce our Terms of Use.
Where the law asks us to name a legal basis for processing, we rely on our legitimate interests in running, securing and improving the Site; on your consent where you choose to contact us or share a link; and on our legal obligations. Health information that reaches us through the booking tools is used to provide care and is governed by HIPAA and our Notice of Privacy Practices, not by this section.
Booking tools and other third-party services
Buttons and links on the Site take you to services we do not operate. Each has its own privacy policy, which applies once you are on their site.
- New-patient registration (Jotform). "Book your first visit" opens our registration form at form.jotform.com. We use a HIPAA-enabled Jotform account under a business associate agreement, so the information you enter is protected as health information. Jotform's own privacy policy is at jotform.com/privacy.
- Patient portal (PCC). "Book in the portal" opens our patient portal at ivy.pcc.com, run by PCC, our electronic health record vendor and a HIPAA business associate. The portal requires a login and sets its own session cookies. We do not receive your portal password. PCC's privacy policy is at pcc.com/privacy-policy.
- Google Maps and Google Search. The "Open in maps" link on our contact page and the reviews link on our home page open Google. Google's privacy policy applies there.
- Insurance companies. We list the plans we accept, but we do not link your visit to the Site to any insurer.
We are not responsible for the privacy practices of sites we do not operate.
Email, phone and text
Email you send us. Our general inbox, info@ivyleaguepediatrics.com, is read during opening hours. Standard email is not encrypted end to end, so please do not email detailed medical information. Call us instead.
Marketing email. We do not run a newsletter or marketing email list from the Site. If that ever changes, we will only email people who have asked to hear from us, every message will include an unsubscribe link, and we will update this policy.
Sharing by text. The "Send by text" buttons on the Site open the messaging app on your own device with a pre-written message and a link. The message is sent by you, from your phone, to whoever you choose. We do not send it, see it, or learn who you sent it to.
Appointment reminders and patient communications are sent through our practice systems, not the Site, and are covered by our Notice of Privacy Practices.
Children's privacy
We are a pediatric practice, so our patients are children. The Site, however, is written for parents and guardians and is not directed at children. We do not knowingly collect personal information through the Site from anyone under 13, and there is nothing on the Site for a child to fill in. If you believe a child has sent us information through the Site, email us at info@ivyleaguepediatrics.com and we will delete it.
Health information about a child that we receive as their provider, including through the registration form and the portal, is protected health information. It is provided by, and accessible to, the child's parent or legal guardian as described in our Notice of Privacy Practices.
How long we keep information
- Emails and messages are kept for as long as needed to respond and to keep a record of the exchange, and then in line with our records policies.
- Server logs are retained by Cloudflare for a limited period for security and troubleshooting, under Cloudflare's retention practices.
- Analytics are held only in aggregate form.
- Medical records are retained as required by Georgia law and HIPAA, which is longer than most website data. Our Notice of Privacy Practices applies.
Security
The Site is served over HTTPS, sends security headers that limit how it can be embedded or misused, and is protected by Cloudflare's network. Our booking tools are run by vendors that hold themselves out as HIPAA-compliant and are bound to us by business associate agreements. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we take reasonable steps to protect the information we hold.
Your privacy rights
Wherever you live, you can ask us what personal information we hold about you from your use of the Site, ask us to correct it, or ask us to delete it. Email info@ivyleaguepediatrics.com with "Privacy request" in the subject line, or write to us at the address at the bottom of this page. We may need to verify your identity before acting on a request, and we will respond within the time the applicable law allows, or within 45 days if no law sets a shorter period. We will not treat you differently for making a request.
Requests about medical records, including access, copies, corrections and restrictions, follow a different process with specific legal timelines. Please use the steps in our Notice of Privacy Practices for those.
US state privacy rights
Several states, including California, give residents rights over their personal information, such as the right to know what is collected, to delete it, to correct it, and to opt out of the sale of personal information or its sharing for targeted advertising. We are a small local practice and may not meet the thresholds at which those laws apply. We honor those rights voluntarily for everyone, regardless of where you live.
- We do not sell your personal information and we do not share it for targeted advertising. There is therefore nothing to opt out of, and no "Do Not Sell or Share" setting is needed. If that ever changes, we will add one.
- We do not collect sensitive personal information through the Site. Health information collected through our booking tools is governed by HIPAA rather than state consumer privacy laws.
- You may authorize someone to make a request on your behalf. We will ask for proof of that authorization.
- You will not be discriminated against for exercising any of these rights.
Georgia residents: the practice is based in Georgia. Georgia does not currently have a comprehensive consumer privacy statute, but the rights above are available to you all the same.
Visitors outside the United States
We are a local practice serving families in and around Gwinnett County, Georgia. We do not market to, or offer services in, the European Economic Area, the United Kingdom or Canada. The Site and our vendors are located in the United States, so any information you send us is processed there.
If you visit from a country with its own data protection law, you may have rights to access, correct, delete, restrict or object to processing of your personal information, to withdraw consent, to data portability, and to complain to your local supervisory authority. You can exercise the rights that apply to you by contacting us as described under Your privacy rights.
Do Not Track and Global Privacy Control
Some browsers send a "Do Not Track" or "Global Privacy Control" signal. Because the Site does not track visitors across sites, does not sell personal information and does not use advertising cookies, there is nothing on the Site for these signals to switch off. We treat any such signal as a request not to be tracked, which is already how the Site behaves for everyone.
Changes to this policy
We will update this page if what the Site does changes, for example if we add a form, a new tool or analytics that set cookies. The "Last updated" date at the top shows when the current version took effect. Material changes will be flagged on this page. Continued use of the Site after a change means you accept the updated policy.
Contact us
Questions about this policy, or a privacy request, can be sent to:
Ivy League Pediatrics, Inc.
Attn: Privacy
603 Old Norcross Rd, Ste A
Lawrenceville, GA 30046
info@ivyleaguepediatrics.com
678-407-4489
For questions about your child's medical information, including how to get copies of records, see our Notice of Privacy Practices.