Privacy Policy

Romanat Clinic, Inc. (“Romanat Clinic,” “we,” “us,” or “our”) operates this website. This Privacy Policy describes how we collect, use, share, and protect information when you browse this site, request an appointment, send us a message, or apply for a job.

This policy does not cover the medical records we keep once you become a patient. How we use and disclose your protected health information (PHI) is described in our Notice of Privacy Practices, which controls wherever the two documents overlap.

• Appointment requests. Name, email, phone number, date of birth, whether you are a new patient, reason for visit, insurance carrier, and any notes you add. We use this to hold your requested slot and to call you back to confirm — a request is not a booked appointment until we do.
• Contact form messages. Name, email, optional phone number, subject, and your message. The form asks you not to include medical, health, or insurance details, since messages sent this way are handled as general inquiries, not as part of a medical record.
• Job applications. Name, email, phone, location, employment type, experience level, desired start date, an optional portfolio link and message, and the resume file you upload.

• Standard request data. Like most websites, our server logs technical details of each request — IP address, browser/device information, and timestamps — to keep the site secure and working correctly.
• Approximate location. For staff sign-ins, and for the visit-counter cookie described below, we resolve an approximate country and city from the IP address using an offline database we host ourselves, purely to populate our internal security log and internal visitor counts. We do not send visitor IP addresses to a third-party geolocation service to do this.
• Cookies. This site sets one small, first-party cookie (clinic_visitor) the first time you visit, so we can count visits to our public pages internally without counting the same browser twice. It contains only a randomly generated identifier, is never linked to your name, email, or anything you submit through a form, and is not used for advertising. Submitting the appointment, contact, or career forms does not set any additional cookie. Our staff portal separately sets a session cookie (necessary for sign-in) that is set to HTTP-only, marked Secure in production, and scoped to this site — it cannot be read by scripts or sent to other sites. We do not run third-party analytics or advertising trackers on this site.

• To respond to appointment requests, and to confirm, reschedule, or cancel appointments.
• To send the confirmation email and personal reschedule/cancel link tied to your request.
• To respond to messages sent through the contact form.
• To evaluate job applications and get in touch about them.
• To secure the site and our staff portal — for example, detecting suspicious login activity, enforcing account lockouts after repeated failed sign-ins, and keeping an internal security audit trail of account activity and appointment requests (including the IP address and device type a request was made from).

We do not sell personal information, and we do not use it for advertising or behavioral profiling.

• Clinic staff who need it to respond to your request — for example, front desk staff verifying insurance before confirming a visit.
• Our email delivery provider. Confirmation emails, staff notifications, and reschedule links are sent through the outbound mail server we have configured; that provider processes the message contents solely to deliver it.
• Google Maps. Our Contact page embeds a Google Maps view of our location. Loading that page loads content from Google, which may collect information from your browser under Google's own privacy policy.
• As required by law, such as in response to a valid subpoena or court order.

We do not sell or rent your personal information to third parties.

We keep appointment records, contact messages, and job applications for as long as needed for clinic operations and applicable legal and record-keeping requirements. Resumes are stored outside the public website and can only be downloaded by authenticated staff.

Staff account passwords are stored as salted hashes, never in plain text. Sensitive configuration secrets are encrypted at rest. Staff sessions expire automatically, can be revoked immediately if an account is suspended, and staff may enable two-factor authentication for an additional layer of protection.

• Fields not marked as required on our forms are optional — you can leave them blank.
• You can ask us to correct or delete contact-form or job-application information you submitted by contacting us below, subject to any records we are required to keep.
• For rights specific to your health information — access, amendment, an accounting of disclosures, and more — see our Notice of Privacy Practices.

This website is intended for use by adults on their own behalf or on behalf of a patient in their care. If you are submitting a form for a minor, we assume you are their parent or legal guardian.

We may update this policy from time to time. The version posted here is always the current one; material changes will update the effective date above.

Questions about this policy, or requests about information you submitted through this website, can be sent to:

Romanat Clinic, Inc.
11275 E Mississippi Ave #2E2, Aurora, CO 80012
303-364-1422