Privacy

The portfolio has one form.

It sends me your name, your email and your message so I can reply. This site has no account, no newsletter and no sign-in of its own.

Page views are counted, not tracked.

I count visits myself, on my own infrastructure: the page address, the referring site and the date, added to a running total. No cookies, no identifiers, no profile, and nothing shared with anyone.

No ad tracking and no third-party analytics.

A message from this site is kept until you ask me to delete it.

Sign-in is via Google.

The portal receives your name and email address. It never sees or stores a password.

Case data, including patient records, travels only in the case channel.

Prescriptions, scans and records sent for design work stay inside the HIPAA-covered case channel. The portal is excluded from the visit counting described above.

Portal sessions are stored server-side and can be revoked.

A Business Associate Agreement is signed before any case carries patient records.

An AWS BAA covers the infrastructure. A BAA with your practice or laboratory is signed on request, and it covers the design work.

Patient data stays in the case channel.

Never on this public site, never in analytics, invoices or URLs. A case travels on its case ID.

Encrypted in transit and at rest.

US infrastructure: AWS, under a signed BAA.

Files move over the covered business channel, never through personal file-sharing accounts and never through offshore servers.

Standard hosting logs are kept for security and operations.

No patient identifiers in logs or URLs.

Data is not sold.

Case data is not used for anything beyond the engagement.

Previews, approvals, delivery and the case thread. Nothing else.

You can ask for access, correction or deletion at any time.

Deletion requests are honoured. Send privacy requests through the contact page and I answer within one business day.

Case files are kept for the duration of the engagement, and this site keeps no case files at all.