PRIVACY POLICY
Effective Date: 01/01/2022
Service Provider: Rook Consulting LLC (“Rook Consulting,” “we,” “us,” or “our”)
This Privacy Policy explains how Rook Consulting may collect, process, protect, and disclose personal information and health-related information submitted through online marketing, intake, scheduling, pre-screening, appointment request, and lead-generation systems that we manage or support on behalf of healthcare and medical service providers.
Rook Consulting is not a medical provider and does not provide diagnosis, treatment, clinical advice, or medical decision-making. Any health information submitted through a Rook-managed form, landing page, website, automation, or intake workflow is collected solely to support the healthcare provider’s authorized intake, scheduling, evaluation, communication, and patient acquisition process.
This Privacy Policy does not replace the healthcare provider’s full Notice of Privacy Practices, consent for treatment, financial policy, or any other patient-facing clinical documentation provided by the healthcare provider.
Rook Consulting may collect or process only the information reasonably necessary to support appointment scheduling, intake review, patient communication, marketing attribution, or operational follow-up on behalf of the healthcare provider. This may include:
Contact information, such as name, phone number, email address, and preferred method of contact
Appointment request information, such as requested service, location, availability, or provider preference
Health or symptom information voluntarily submitted through an intake, screening, or appointment request form
Diagnostic, imaging, referral, insurance, or treatment-status information, if voluntarily submitted and requested by the healthcare provider
Payment reservation information, if an optional prepaid appointment or deposit feature is offered
Technical information related to website performance, attribution, and security, such as IP address, browser type, device type, timestamp, and general page activity
Rook Consulting does not collect unnecessary health information, does not sell patient or prospective patient information, and does not use protected health information for unauthorized advertising, retargeting, audience building, profiling, or resale.
Information submitted through Rook-managed systems may be used only for authorized healthcare-provider purposes, including:
Appointment scheduling
Preliminary intake or suitability review by the healthcare provider
Secure routing or transfer into the healthcare provider’s approved intake system, CRM, EHR, EMR, or practice management system
Patient or prospective patient follow-up communications
Lead tracking, workflow management, and campaign performance review using non-PHI data whenever possible
Payment processing, if an optional payment or appointment reservation feature is offered
Compliance, security, troubleshooting, and recordkeeping as required or permitted by law
By submitting information through an online form, you acknowledge that you are voluntarily providing the information for the limited purposes described in this Privacy Policy and any related consent language displayed on the form.
No health information submitted through an intake form is used for unauthorized audience targeting, remarketing, lookalike audience creation, profiling, third-party advertising optimization, list resale, or unrelated marketing purposes.
Rook Consulting may provide marketing strategy, website or landing page support, CRM support, campaign management, automation, intake workflow support, reporting, and related operational services to healthcare providers.
To the extent Rook Consulting creates, receives, maintains, transmits, accesses, or processes protected health information on behalf of a HIPAA-covered healthcare provider, Rook Consulting will perform such services under an applicable Business Associate Agreement and in accordance with the provider’s authorized instructions, privacy protocols, and approved systems.
Rook Consulting’s access to health information is limited to the minimum necessary to perform the authorized service. Rook Consulting does not independently determine clinical use of patient information and does not make medical eligibility, diagnosis, treatment, or care decisions.
Rook Consulting uses reasonable administrative, technical, and operational safeguards designed to protect personal information and health-related information handled through supported systems.
Depending on the client-approved workflow, information may be processed through secure intake systems, CRM platforms, EHR/EMR systems, payment processors, or other approved vendors. Where protected health information is involved, Rook Consulting uses systems and workflows intended to support HIPAA-aligned handling and, where required, Business Associate Agreement coverage.
Where applicable:
Form submissions involving health information are routed through approved intake or CRM systems
Data is encrypted in transit where supported by the system
Access is limited to authorized personnel or approved client representatives
PHI is not intentionally stored on public landing pages or unsecured website environments
PHI is not intentionally transmitted to advertising platforms such as Meta, Google, TikTok, LinkedIn, or similar platforms
PHI is transferred, routed, or made available only through client-approved systems and workflows
Rook Consulting does not guarantee that any third-party platform is HIPAA-compliant unless the healthcare provider has selected the appropriate version, executed any required agreements, and approved the configuration for use with health information.
For U.S. healthcare providers subject to HIPAA, health information collected through Rook-supported intake, scheduling, or pre-screening workflows may be protected health information when it is created, received, maintained, or transmitted on behalf of the healthcare provider.
Where HIPAA applies, Rook Consulting supports privacy-conscious workflows designed to limit PHI collection, reduce unnecessary disclosure, avoid improper tracking, and route health information only through approved systems.
Patients and prospective patients may have rights under HIPAA and other applicable laws, including rights related to access, amendment, restriction, confidential communications, accounting of disclosures, and complaint procedures. These rights are typically administered by the healthcare provider, not Rook Consulting directly.
For users located in Canada, Rook Consulting will support the healthcare provider’s handling of personal information in a manner intended to align with PIPEDA and applicable provincial privacy or health privacy laws, where applicable.
If information is transferred to or processed in the United States, such transfer will be limited to the authorized healthcare, intake, scheduling, operational, or provider-approved purpose. Rook Consulting does not disclose Canadian users’ personal health information to advertising platforms for targeting, profiling, remarketing, or resale.
Rook Consulting does not retain protected health information longer than necessary to perform the authorized service, unless retention is required by the healthcare provider, required by law, or maintained within a provider-approved system.
Where applicable:
PHI submitted through online forms is routed into the healthcare provider’s approved system
PHI is not retained on public landing pages after transfer when the workflow permits
Intake data for individuals who do not become patients is not reused for unrelated marketing or sales purposes
Health information is not retained for advertising, retargeting, profiling, lookalike audience creation, or resale
Retention periods may vary depending on the healthcare provider’s policies, applicable law, platform settings, and the systems used for intake, scheduling, CRM, EHR, EMR, or reporting.
Rook Consulting does not sell or share personal health information with third parties for commercial advertising, profiling, or resale.
Information may be disclosed only as authorized, necessary, or legally permitted, including:
To the healthcare provider or authorized clinic staff
To approved service providers, vendors, or subcontractors operating under appropriate privacy, security, confidentiality, or Business Associate Agreement terms where required
To payment processors for approved payment or reservation transactions
To comply with legal obligations, subpoenas, court orders, regulatory requests, or law enforcement requirements
To protect the security, integrity, or lawful operation of Rook Consulting’s systems or the healthcare provider’s systems
Rook Consulting may use website-level analytics to understand general traffic, campaign performance, page performance, and visitor behavior. These analytics are intended to use non-medical, non-PHI data whenever possible.
No cookie, pixel, analytics script, advertising tag, or tracking tool is permitted to intentionally collect, transmit, or store protected health information, medical intake responses, diagnostic information, symptoms, treatment history, appointment reason, or other health-specific form data.
Tracking tools should not be placed on pages, forms, or workflows where they may collect or infer health information unless the healthcare provider has approved the configuration and determined that the use is legally permissible.
10A. Use of Advertising and Analytics Platforms
Rook Consulting may use advertising or analytics tools such as Meta, Google, LinkedIn, TikTok, or similar platforms to measure the performance of online advertising campaigns, website traffic, and conversion activity.
These tools may collect limited technical or event-level metadata, such as:
IP address
Device type
Browser type
Timestamp of page visit
General traffic source
Generic pageview or conversion event data
No personal health information, medical intake responses, diagnostic details, treatment history, symptoms, uploaded records, form-field values, or health-specific submission data are intentionally transmitted to advertising platforms.
All advertising and analytics tools should be configured to prevent the transmission of PHI or data that could reasonably identify or infer a specific individual’s health condition, diagnosis, treatment interest, or patient status.
10B. Meta Tracking Limitation Notice
When Meta tracking is used, it is limited to non-medical campaign measurement and attribution purposes.
Rook Consulting does not intentionally transmit the following to Meta:
Medical history
Symptoms
Diagnosis information
Treatment interest tied to an identifiable person
Intake form responses
Uploaded diagnostic records
Appointment notes
Patient status
Health-related form field values
Meta is not treated as a HIPAA Business Associate for Rook Consulting or the healthcare provider. Therefore, no PHI should be sent to Meta under any circumstances.
Rook Consulting does not use Meta to create retargeting audiences, lookalike audiences, custom audiences, or ad optimization events based on medical form submissions, patient status, health conditions, appointment requests, or treatment interest.
10C. Google Tracking Limitation Notice
Google Analytics, Google Ads, Google Tag Manager, or similar Google tools may be used only for non-medical traffic analysis, campaign attribution, and aggregate reporting.
Rook Consulting does not intentionally transmit the following to Google:
Medical intake responses
Health condition identifiers
Symptoms
Diagnosis information
Treatment history
Uploaded records
Patient status
Health-specific form submissions
Personally identifiable PHI
Where Google tools are used, they should be configured to restrict sensitive data transmission, avoid form-field capture, avoid health-specific URL capture where possible, and prevent PHI from being linked to advertising or analytics accounts.
10D. No PHI Shared With Advertising Platforms
For clarity:
Rook Consulting does not send PHI to Meta, Google, TikTok, LinkedIn, or third-party advertising platforms
Rook Consulting does not allow ad platforms to collect health-related fields or medical form data
Rook Consulting does not build advertising audiences using health data, appointment activity, diagnosis, symptoms, treatment interest, or patient status
Rook Consulting does not share or sell patient or prospective patient data for marketing, profiling, or resale
Rook Consulting does not authorize advertising platforms to re-identify website visitors based on medical information
All PHI should remain within the healthcare provider’s approved intake, CRM, EHR, EMR, or other authorized system.
If an optional payment, appointment reservation, consultation deposit, or prepaid service is offered:
Payment is processed through a PCI-DSS compliant payment processor
Rook Consulting does not store full credit card numbers on public websites or landing pages
Payment information is not intentionally linked to medical intake responses unless required by the healthcare provider’s approved workflow
Cardholder data is encrypted and handled by the payment processor
Rook Consulting does not use payment information for unrelated advertising, profiling, or resale
Submission of an online form constitutes consent for the healthcare provider and its authorized service providers, including Rook Consulting where applicable, to use the submitted information for the limited purposes of intake, scheduling, evaluation, routing, communication, and secure transfer into approved provider systems.
A separate consent for treatment, financial policy, HIPAA Notice of Privacy Practices, or other clinical documentation may be provided directly by the healthcare provider before or during care.
To request access, correction, amendment, restriction, deletion where legally available, or other privacy-related action regarding information submitted through a Rook-supported healthcare workflow, please contact the healthcare provider directly:
Privacy Officer
Christiana Clancy
SMS Terms & Conditions
By opting in to Rook Consulting’s SMS program, you agree to receive text messages from Rook Consulting at the mobile number provided.
Rook Consulting’s SMS program may include promotional and marketing messages, such as offers, service updates, promotional content, and educational information. It may also include transactional and alert messages, such as scheduling updates, intake follow-up, account notices, requested-service updates, and other service-related communications.
Message frequency may vary. Message and data rates may apply.
To opt out of SMS messages, reply STOP, END, CANCEL, UNSUBSCRIBE, or QUIT at any time. After opting out, you may receive one final confirmation message confirming that you have been unsubscribed.
For help, reply HELP or contact Rook Consulting at christiana@rookconsulting.us.
Wireless carriers are not liable for delayed or undelivered messages.
You must be 18 years of age or older to use Rook Consulting’s SMS program.
Your consent to receive SMS messages is not required as a condition of purchasing any goods or services.
SMS Opt-In and No-Sharing Policy
Rook Consulting LLC may collect mobile phone numbers and SMS consent through online forms, scheduling pages, intake workflows, or other opt-in methods. SMS consent is optional and is not required as a condition of purchasing any goods or services.
Users may opt in to receive promotional and marketing text messages, including offers, service updates, promotional content, and educational information. Users may also opt in to receive transactional and alert text messages, including scheduling updates, intake follow-up, account notices, requested-service updates, and other service-related communications.
Message frequency varies. Message and data rates may apply. Users may reply HELP for help or STOP to opt out at any time.
No mobile information will be shared with third parties/affiliates for marketing/promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties.
Rook Consulting may assist the healthcare provider in responding to privacy requests when required and authorized by the provider. Requests will be handled in accordance with HIPAA, applicable federal law, state law, and, where applicable, Canadian privacy law.
Rook Consulting reserves the right to update this Privacy Policy as laws, technologies, services, workflows, and provider requirements change. Updates will be posted with a revised effective date.
United States:
You may file a privacy complaint with the healthcare provider directly or with the Office for Civil Rights, U.S. Department of Health & Human Services.
Canada:
You may file a privacy complaint with the healthcare provider directly or, where applicable, with the Office of the Privacy Commissioner of Canada or the appropriate provincial privacy authority.
You will not be penalized for filing a privacy complaint.
By submitting information through a Rook-supported website, landing page, intake form, scheduling form, or pre-screening system, you acknowledge that:
You are voluntarily providing personal information or health-related information
The information may be used by the healthcare provider and its authorized service providers for intake, scheduling, evaluation, routing, communication, and follow-up
Rook Consulting is not a medical provider and does not provide diagnosis, treatment, or medical advice
No PHI is used for unauthorized advertising, retargeting, profiling, audience creation, or resale
You may withdraw consent or request privacy-related action as permitted by law
The healthcare provider’s Notice of Privacy Practices and clinical consent documents may provide additional rights and information
Copyright © 2026 Rook Consulting LLC-All Rights Reserved