The information we collect from and about you.

Depending on how you interact with us, Apex Heart & Vascular Care may collect the following categories of information. We only collect what we need to provide safe, effective, and lawful care, and to operate our practice.

Protected Health Information (PHI)

Under the Health Insurance Portability and Accountability Act (HIPAA), we collect PHI necessary for your medical care:

• Identifiers. Full legal name, date of birth, Social Security number (only when required), address, phone, email, emergency contact.
• Medical & clinical data. Symptoms, diagnoses, imaging results (echocardiograms, ABIs, ultrasounds), procedure records, prescriptions, allergies, vital signs, family and social history.
• Insurance & payment. Policy numbers, group IDs, billing addresses, payment methods, prior authorization data, claims correspondence.
• Communication records. Phone call logs, text message consent records, appointment confirmations, patient portal messages.

Website & digital data

• Form submissions. Name, phone, email, ZIP code, symptoms/reason for visit, preferred location — from apexheartandvascular.com and any landing page we operate.
• Automatically collected. IP address, browser type, device type, pages viewed, time on site, referring URL, and interaction events (button clicks, form submissions).
• Advertising responses. Data submitted through Facebook, Instagram, and Google lead forms — typically name, phone, email, and preferred contact time.

How we use your health information.

HIPAA permits us to use and disclose your Protected Health Information for three primary purposes without your specific written authorization: treatment, payment, and healthcare operations.

For treatment

Our providers, nurses, technicians, and support staff use your PHI to coordinate and deliver care. This includes reviewing your history before a visit, sharing information with a colleague for a second opinion, sending referrals to specialists outside Apex (such as a hospital, imaging center, or surgeon), and communicating with your primary care physician about the results of your cardiovascular workup.

For payment

We use your PHI to bill and collect payment from you, your insurance carrier, or a responsible third party. This includes verifying eligibility, obtaining prior authorizations, submitting claims, appealing denials, and coordinating benefits between multiple insurers.

For healthcare operations

We use your PHI to run the practice safely and lawfully — quality assessment, credentialing our providers, training staff, business planning, legal reviews, accreditation activities (AAASF, IAC), and compliance auditing. When possible, this information is de-identified before use.

Appointment reminders & care communications

We may contact you by phone, text (only with your consent — see our Text Messaging Consent), email, or mail to remind you of upcoming appointments, confirm bookings, share care instructions, notify you of lab or imaging results, and coordinate follow-up.

When we may share information without your authorization.

Federal and state law permit or require us to disclose PHI in certain circumstances without your specific written authorization. These disclosures are limited to the minimum necessary information.

• Public health activities. Reporting communicable diseases, births, deaths, adverse drug or device events to the FDA, and other required public health reports.
• Health oversight. Audits, investigations, inspections, and licensure activities by government agencies overseeing the healthcare system.
• Legal proceedings. In response to a court order, subpoena, or discovery request — with notice to you where required by law.
• Law enforcement. To locate a suspect or missing person, report gunshot or stab wounds, or comply with a valid warrant.
• Serious threat to health or safety. To prevent or lessen an imminent threat to a person or the public, disclosed only to someone reasonably able to prevent the harm.
• Coroners, funeral directors, organ procurement. To identify a decedent, determine cause of death, or facilitate donation.
• Workers’ compensation. As required by New Jersey workers’ compensation laws.
• Military, national security, and correctional institutions. Limited disclosures as authorized by federal law.
• Business associates. To vendors who provide services to us (billing companies, IT support, SMS delivery like Twilio) — each is contractually required under a HIPAA Business Associate Agreement to protect your information at the same level we do.

Uses that require your written authorization.

For any purpose not covered above, we will not use or disclose your PHI without your written authorization. This includes:

• Marketing communications beyond appointment reminders and treatment-related messages — such as promotional emails or texts about new services or events.
• Sale of your PHI. We do not and will not sell your health information. Period.
• Most uses of psychotherapy notes, if any exist in your file.
• Sharing with family, friends, or others not directly involved in your care.

You can revoke any authorization you’ve given us at any time, in writing, except to the extent we’ve already relied on it. To revoke, contact our Privacy Officer using the details at the bottom of this page.

Your rights over your health information.

Under HIPAA and applicable state law, you have the following rights regarding your PHI held by Apex Heart & Vascular Care:

How we handle website and digital data.

Beyond your health records, this section covers how we handle information collected through apexheartandvascular.com, our landing pages, patient portal, and other digital touchpoints.

Cookies & tracking technologies

Our website uses cookies and similar technologies (pixels, tags, local storage) to remember your preferences, keep you signed in, measure how our pages perform, and understand how visitors find and use our site. Most browsers let you refuse cookies or delete them; refusing may affect certain site features.

• Essential cookies. Required for the site to function — session management, security, and remembering your form entries.
• Analytics cookies. Google Analytics collects aggregate data on page views, traffic sources, and user flow. This data is de-identified and used to improve site performance.
• Advertising cookies. Meta (Facebook) Pixel and Google Ads tags help us understand which ads brought visitors to our site and let us show relevant ads to people who’ve visited. These are only set when you interact with our ads or landing pages.

Analytics & performance monitoring

We use industry-standard analytics tools to understand how our website is used. These tools do not collect your name or health information — they collect aggregate patterns like which pages get the most views, where visitors come from, and how long they stay. This helps us fix broken pages, improve navigation, and design better patient resources.

Patient portal

Our patient portal is hosted by our electronic health record vendor and is protected by encryption, multi-factor authentication (where enabled), and HIPAA-compliant access controls. Portal messages exchanged with your provider are treated as PHI and handled per Sections 01–05 above.

Advertising, lead forms & social media.

Apex Heart & Vascular Care runs advertising campaigns on platforms including Facebook, Instagram, and Google. When you fill out a form on one of these platforms or on our website, here’s what happens with your data:

• Data collected on lead forms. Typically your name, phone number, email, ZIP code, and reason for interest (e.g., “leg pain,” “cardiac consultation”). This is used to contact you about the specific service you inquired about.
• Where it goes. Lead form submissions are automatically routed to our internal customer relationship management (CRM) system. Only authorized Apex staff (marketing, front-desk, providers) have access. Data is not shared back with the advertising platform beyond aggregated conversion metrics required to measure ad performance.
• How we contact you. A member of our team will typically call or text you (only if you consented via checkbox) within 1–2 business days. If you don’t want to be contacted, reply STOP to any text or ask verbally.
• Retention. Lead form data is kept for a maximum of 4 years for TCPA record-keeping compliance. If you do not become a patient, we do not use your data for further marketing beyond initial follow-up unless you explicitly opted in.
• Custom audiences. We may upload de-identified or hashed lead data to Facebook and Google to build “lookalike audiences” — groups of people with similar demographics who might benefit from our services. This does not expose your identity to the platforms.

How we protect and how long we keep your information.

Security safeguards

We implement administrative, physical, and technical safeguards required by HIPAA and best-practice cybersecurity standards:

• Encryption. PHI is encrypted at rest (on our servers) and in transit (when sent between systems) using industry-standard encryption.
• Access controls. Only authorized workforce members can access PHI, and only for the specific purpose their role requires. All access is logged and audited.
• Training. All Apex employees complete annual HIPAA privacy and security training and sign confidentiality agreements.
• Physical safeguards. Paper records are kept in locked storage. Workstations are secured, and screens are positioned to prevent unauthorized viewing.
• Incident response. We maintain a documented breach response plan and will notify affected patients and regulators within legally required timeframes if a breach occurs.

Data retention

• Medical records. Retained for a minimum of 7 years after the last patient encounter, per New Jersey state law. Records for minors are retained until the patient’s 23rd birthday.
• Billing records. Retained for 7 years for tax, audit, and compliance purposes.
• Text messaging & consent logs. Retained for 4 years per TCPA record-keeping requirements.
• Website analytics. Aggregate, de-identified data retained for up to 3 years. Individual session data purged within 26 months per Google Analytics defaults.
• Lead form data. If you do not become a patient, retained for 4 years for TCPA compliance and then purged.

Children under 18.

Apex Heart & Vascular Care primarily provides care to adults. Our website and marketing materials are not directed at children under 13, and we do not knowingly collect personal information from children under 13 without verifiable parental consent. If we learn that we have collected such information without consent, we will delete it promptly.

For minor patients (under 18) receiving care at our practice, a parent or legal guardian must provide consent for treatment and generally has access to the minor’s medical records, subject to certain exceptions under New Jersey law (e.g., reproductive health services, mental health, substance use treatment for older minors).

How we notify you of changes.

We reserve the right to change this Notice of Privacy Practices at any time, and to make the revised notice effective for all PHI we already have, in addition to any information we receive in the future.

When we make material changes, we will:

• Post the updated notice on this page with a new “Last updated” date.
• Make paper copies available at all 21 Apex office locations at least 60 days before the effective date.
• Notify patients via email or text (only those who’ve opted in to communications) for changes that significantly affect your rights.

You may request a copy of the most current version at any time from our Privacy Officer.

How to file a privacy complaint.

If you believe your privacy rights have been violated by Apex Heart & Vascular Care, you can file a complaint with us or directly with the federal government. You will not be retaliated against for filing a complaint.

With Apex Heart & Vascular Care

Submit your complaint in writing to our Privacy Officer using the contact details in Section 12. We will investigate and respond within 30 days.

With the U.S. Department of Health and Human Services

File a complaint with the Office for Civil Rights (OCR):

• Online: hhs.gov/hipaa/filing-a-complaint
• By mail: Office for Civil Rights, U.S. Department of Health and Human Services, 200 Independence Avenue SW, Room 509F HHH Building, Washington, DC 20201
• By phone: 1-800-368-1019 (TDD: 1-800-537-7697)
• By email: OCRComplaint@hhs.gov

With the New Jersey Department of Health

New Jersey residents may also file a complaint with the state licensing authority. Visit nj.gov/health for details.