Privacy Policy

Information Collected by Our Website

Our Website is purely informational. It does not have accounts, forms, or checkout, and it does not collect your name, contact information, health information, or payment information.

If you choose to contact us using a link on our Website, that contact happens outside the Website itself: emailing us opens a message in your own email application, and calling or texting us connects you directly by phone. In either case, the Website does not collect or store the content of your message or call. We will, of course, receive and retain what you choose to send or tell us — including your phone number and anything you share during a call — and we handle that information in accordance with this Privacy Policy and our Notice of Privacy Practices.

Please do not include sensitive health information in an email, text, or voicemail. These are not secure channels. For anything involving your health or your care, use our patient portal or ask us to follow up securely.

Aside from the limited technical information described below, our Website collects no personal information.

Information Collected Through Our Patient Portal (Powered by Decoda)

When you create an account, complete our intake form, book a service, or communicate with your care team, you do so through our patient portal, powered by Decoda. Through the portal, we collect:

• Full name, date of birth, and contact information (phone number, email address)
• Home, office, hotel, or other service location address
• Health and medical information provided during intake and screening, including medical history, current medications, allergies, and relevant health conditions
• Payment information (processed securely through our payment processor — we do not store full card numbers)
• Membership preferences and service history
• Signatures collected during visit documentation
• Communications you send to us or to your care team through the patient portal. Sano Protocol requires that all clinical and appointment-related communication between you and your nurse take place through the patient portal or through Sano’s official channels, and not through a nurse’s personal phone, personal messaging account, or social media.

Decoda hosts and stores this information on our behalf as our contracted practice-management platform and Business Associate under HIPAA. Sano Protocol remains responsible for this information under this Privacy Policy and our Notice of Privacy Practices.

Information Collected Automatically

When you visit our Website or use our patient portal, we automatically collect certain technical information, including:

• Device type, operating system, and browser information
• IP address and approximate location
• Pages visited, features used, and time spent on the Platform
• Cookies and similar tracking technologies (see Section 6 below)

Information from Third Parties

We may receive information from our contracted medical clearance provider when they conduct your pre-service health review. This information is used solely for the purpose of authorizing your service and is handled in accordance with applicable HIPAA requirements.

We use the information we collect to:

• Create and manage your account
• Process service bookings and payments
• Coordinate nurse assignments and visit scheduling
• Facilitate your medical clearance review with our contracted clearance provider
• Administer your membership benefits
• Provide visit documentation and maintain clinical records
• Communicate with you about your appointments, account, and services
• Improve our Platform and services through analytics
• Comply with legal obligations including healthcare recordkeeping requirements
• Respond to your inquiries and provide customer support
• Send you service updates, appointment reminders, and promotional communications (you may opt out at any time)

We do not sell your personal information. We may share your information in the following limited circumstances:

Service Providers

We share information with trusted third-party vendors who help us operate our Platform and deliver services, including:

• Decoda Health (our practice-management platform, hosting our patient portal, booking, intake, and clinical documentation)
• Payment processors (to process transactions)
• Our contracted medical clearance provider (to conduct pre-service health reviews)
• Analytics providers to help us understand how our Platform is used, subject to the restrictions described in Section 6
• Cloud hosting and technology infrastructure providers
• SMS and communication service providers

All service providers are contractually required to protect your information and use it only for the purposes for which it was disclosed. Where required by HIPAA, we execute Business Associate Agreements with vendors who handle protected health information, including Decoda.

Legal Requirements

We may disclose your information if required to do so by law, court order, or government regulation, or if we believe disclosure is necessary to protect the rights, property, or safety of Sano Protocol, our clients, or the public.

Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of our assets, your information may be transferred as part of that transaction. We will notify you of any such change in ownership or control.

Certain information we collect through our patient portal, including health information gathered during intake and visit documentation, may constitute Protected Health Information (PHI) under the Health Insurance Portability and Accountability Act of 1996 (HIPAA). We handle PHI in accordance with our Notice of Privacy Practices, which is available separately on our Platform. Our Notice of Privacy Practices describes in detail your rights regarding your health information and how we may use and disclose it.

We retain your personal information for as long as your account is active and for a period of seven (7) years following the termination of your account or your last service, in compliance with Florida medical records retention requirements and applicable law. Health information and visit documentation are retained for a minimum of seven (7) years, whether stored by us or within our patient portal on Decoda’s systems. Payment records are retained as required by applicable financial regulations. You may request deletion of your non-health personal information by contacting us, subject to our legal retention obligations.

We use cookies and similar tracking technologies on our Website to enhance your experience. These include:

• Essential cookies — a small number of cookies may be set by our hosting and content-delivery infrastructure as necessary for the Website to load and operate securely.
• Privacy-focused analytics — we use Vercel Web Analytics to understand how visitors use our Website. Vercel Web Analytics does not use third-party cookies or persistent identifiers, and collects only aggregated, anonymized traffic data that cannot be tied to an individual visitor.
• Advertising and social media pixels — we do not currently use advertising or social media tracking pixels, including those from Meta (Facebook and Instagram), TikTok, or Google, on our Website. If we introduce any such technology in the future, we will update this Privacy Policy before doing so.

Our patient portal is operated by Decoda and may use cookies or similar technologies necessary to maintain your session and secure your account. You can control cookies through your browser settings; disabling certain cookies may affect Website functionality.

You have the following rights regarding your personal information:

• Access — you may request a copy of the personal information we hold about you
• Correction — you may request that we correct inaccurate personal information
• Deletion — you may request deletion of your personal information, subject to our legal retention obligations
• Opt-out of marketing — you may opt out of receiving promotional communications at any time by contacting us or using the unsubscribe link in any email we send
• Data portability — you may request your personal information in a portable format

To exercise any of these rights, contact us at sanohello@sanoprotocol.com. We will respond to your request within 30 days.

Our services are available to individuals who are at least 16 years of age. Clients between the ages of 16 and 17 must be accompanied by a parent or legal guardian at all times during service. We do not offer services to, or knowingly collect personal information from, individuals under the age of 16. If you believe we have inadvertently collected information from a child under 16, please contact us immediately so we can delete it.

We implement reasonable technical, administrative, and physical safeguards to protect your personal and health information from unauthorized access, disclosure, alteration, or destruction, and require our patient portal provider, Decoda, to do the same under our Business Associate Agreement. These safeguards include encrypted data transmission, access controls, and regular security assessments. No method of transmission over the internet or electronic storage is 100% secure, and we cannot guarantee absolute security. In the event of a breach of security affecting your personal information, we will notify you in accordance with the Florida Information Protection Act (FIPA) and any other applicable state or federal breach notification law.

Aside from our patient portal (powered by Decoda, as described above), our Website may contain links to other third-party websites or services. We are not responsible for the privacy practices of those unrelated third parties. We encourage you to review the privacy policies of any third-party sites you visit.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our Platform and updating the effective date. Your continued use of our Platform following the posting of changes constitutes your acceptance of the updated policy.

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us at: