Privacy Policy

1. Who We Are

ASK Southern Kentucky Health & Wellness (“ASK,” “we,” “us,” or “our”) operates the website asksouthernky.com and provides primary care, aesthetic, and mobile health services in Southern Kentucky. We are a covered entity under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”).

2. Information We Collect

We may collect the following categories of information:

• Appointment request information — name, email address, phone number, requested service, preferred date and time, and any notes you voluntarily provide when submitting a booking request through our website.
• Communications — messages you send to us by phone, email, or through our website.
• Usage data — standard server logs including IP address, browser type, and pages visited, collected automatically when you use our website.

We do not collect payment card information through this website. Payments are handled directly at the time of service or through secure third-party processors.

3. How We Use Your Information

Information you provide through our booking form is used solely to:

• Schedule and confirm your appointment.
• Send you appointment confirmation and status emails.
• Contact you if there is a change to your appointment.
• Respond to your questions or communications.

We do not sell, rent, or share your personal information with third parties for marketing purposes.

4. Protected Health Information (HIPAA)

Any health information we receive in connection with your care is protected health information (“PHI”) governed by HIPAA. We maintain appropriate administrative, physical, and technical safeguards to protect PHI.

A separate Notice of Privacy Practices — which describes your rights under HIPAA and how we may use and disclose your PHI — is provided at your first clinical visit and is available upon request by calling (270) 784-0331.

Online appointment request data (name, contact information, requested service) is scheduling information. It is stored securely and is not shared with third parties except as necessary to operate our scheduling system.

5. Data Storage and Security

Appointment request data is stored in a secured database hosted by Supabase (supabase.com), which maintains SOC 2 Type II compliance and encrypts data at rest and in transit. Access to this data is restricted to authorized ASK staff only.

Confirmation emails are delivered via encrypted SMTP. We do not store email content beyond what is needed to send the message.

6. Data Retention

We retain appointment request data for as long as necessary to fulfill the purposes described in this policy and to comply with applicable legal and regulatory requirements. You may request deletion of your data at any time by contacting us (see Section 9).

7. Cookies

Our website uses only essential cookies necessary for site functionality (for example, an authentication session cookie for administrative access). We do not use advertising or analytics cookies at this time.

8. Third-Party Services

Our website relies on the following third-party services:

• Supabase — database hosting for appointment requests.
• Vercel — website hosting and content delivery.
• Google Workspace — email delivery for appointment notifications.

Each of these providers maintains their own privacy and security practices. We do not share your data with these providers beyond what is required to operate the services described above.

9. Your Rights

You have the right to:

• Request access to the personal information we hold about you.
• Request correction of inaccurate information.
• Request deletion of your information, subject to legal retention requirements.
• Opt out of non-essential communications at any time.

To exercise any of these rights, please contact us using the information in Section 9.

10. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us:

11. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated “Last updated” date. Continued use of our website after changes are posted constitutes acceptance of the revised policy.