Privacy Policy

Last updated: September 25, 2026

This website is operated by Abigail Webster Scanlan DDS, PLLC, doing business as Scanlan Family Dentistry. This policy explains how we handle website information, patient inquiries, and communications. We protect identifiable patient information and do not permit its use or disclosure outside the purposes allowed by HIPAA and other applicable law.

This website policy supplements our HIPAA Notice of Privacy Practices, available on our Patient Forms page. That notice explains our patient privacy duties, permitted uses and disclosures, and your rights. Nothing in this website policy authorizes a disclosure prohibited by HIPAA or other applicable law or reduces your legal privacy rights.

Information We Collect

We collect information you provide when contacting us, requesting an appointment or promotion, coordinating a community program, or communicating with our team. This may include your name, contact details, communication preferences, patient status, and information about the request. Patient information submitted through our secure patient forms or practice communications may include health, dental, insurance, or payment information.

Information that identifies you, or could reasonably identify you, and relates to your health, care, or payment for care is protected health information (PHI). This can include demographic information and an identifiable appointment request, even before you become an established patient. Removing a name alone does not necessarily make information de-identified.

Website systems may also collect technical and usage information, such as browser and device information, IP addresses, referring pages, page interactions, and campaign information. We do not treat information as anonymous merely because it was collected online. Information that qualifies as PHI remains subject to HIPAA.

How We Use Information

We use patient information to respond to requests, coordinate and provide care, communicate with patients, process payments and insurance claims, and carry out healthcare operations as permitted by law. Community inquiry information is used to coordinate the requested program and respond to the organization. General website information is used to operate and secure the site, improve usability, and understand overall website and campaign performance, subject to the privacy restrictions below.

Patient Forms and Email

Our patient contact, appointment-request, and promotion forms use Paubox's HIPAA-compliant forms service embedded on our website. Submissions are encrypted and handled through Paubox's secure systems. Our practice email communications use Paubox's HIPAA-compliant encrypted email service, with Ironscales email-threat protection. Email sent by our practice is automatically encrypted through Paubox.

You may email info@scanlanfamilydentistry.com or call (919) 977-1870. We cannot control the security of your personal device, email account, or network. Forms and email are not monitored continuously and should not be used for emergencies. An appointment request is not confirmed until our office confirms it and does not by itself establish a dentist-patient relationship.

Patient Information Storage and Retention

We retain electronic patient information only in practice-approved systems used and maintained in accordance with HIPAA, including Open Dental, Lighthouse 360, and Paubox for secure forms and email. These protections apply to retained submissions, communications, records, and their backups or archives. We do not use advertising platforms or ordinary website contact-form storage as repositories for patient records.

Access is limited to authorized team members and authorized service providers according to their duties and the permitted purpose. Where a provider handles PHI on our behalf as a business associate, we require the applicable business associate agreement and safeguards. We retain records for the periods required by applicable law and our record-retention policies, then dispose of them securely when retention is no longer required.

Limits on Access and Disclosure

We do not sell or rent identifiable patient information, provide it to third parties for their marketing or promotional purposes, or share patient lists or identifiable patient details for advertising audiences or commercial profiling. General demographic reporting does not include the identities of the people represented.

Identifiable patient information is disclosed only for a purpose and to a recipient permitted or required by HIPAA and other applicable law, or under your valid authorization when authorization is required. This includes providing information to you or your legally authorized representative; coordinating treatment; processing payment or insurance claims; and carrying out permitted healthcare operations with authorized providers. A business associate may use information only within its lawful, contracted role, not for unrelated purposes.

We also comply with legally permitted or required disclosures, such as qualifying public-health reports, health oversight, and lawful legal processes, only when the applicable legal conditions are met. A request for information does not by itself establish a right to receive it. We verify the recipient's authority and apply HIPAA's minimum-necessary standard where it applies.

When a use or disclosure requires a HIPAA authorization, we obtain it separately. Browsing this website, accepting website terms or cookies, submitting a form, or consenting to SMS does not provide a blanket authorization to disclose PHI or waive your privacy rights.

Demographic Information and De-identified Reports

We collect general demographic information and may share aggregated summaries to understand the communities we serve and evaluate services or outreach. Patient-derived information is shared for these general reporting purposes only after it has been de-identified in accordance with HIPAA's Safe Harbor method or a documented Expert Determination. Aggregation alone is not sufficient if a person can still be identified.

These reports do not disclose who the information concerns. We do not share names, contact details, patient identifiers, or an identity key that links a report back to a person. We exclude or generalize identifying details and small groups as needed to meet the applicable de-identification standard. Data that does not meet that standard remains protected and is not shared as anonymous demographic information.

Community Program Forms

Our community program forms are exclusively for requesting educational programs for children or seniors, coordinating flyers and other materials for new-resident welcome packages, and requesting sponsorship or participation in public events. These activities are community outreach, not requests for healthcare. The forms request organizational contact, program, and event details; they do not request protected health information (PHI).

Do not submit protected health information (PHI) about yourself or anyone else through a community program form. This includes identifiable medical or dental records, diagnoses, treatment details, medication information, and patient insurance information. By submitting a community program form, you agree to provide only organizational contact and program information and not to include PHI. You are responsible for following this restriction under our Terms and Conditions. Use our secure patient form for patient-care inquiries.

We use community contact information to respond to and coordinate the inquiry, not for unrelated third-party marketing.

Text Messaging and SMS Privacy

When you choose to receive texts from Scanlan Family Dentistry, we use your mobile number, consent choice, related consent records, and messages exchanged with us to respond to inquiries, coordinate appointments, send confirmations and reminders, and provide updates about your requests.

We do not sell, rent, or share mobile phone numbers or SMS opt-in information with third parties or affiliates for their marketing or promotional purposes. SMS opt-in consent is not shared with third parties or affiliates for marketing purposes. This restriction applies throughout this policy. Providers supporting the delivery of messages may process the information only for the authorized service and subject to applicable confidentiality, security, and HIPAA requirements.

Website SMS consent is optional and requires an explicit opt-in choice that is not preselected and is separate from your preferred contact method. Submitting a form, providing a phone number, or choosing Text / SMS alone does not enroll you in texts. Consent is not required to purchase services, receive treatment, or request an appointment. This consent covers customer care messages, not promotional text campaigns, and is not a HIPAA authorization for unrelated uses or disclosures.

Message frequency varies. Message and data rates may apply. Reply STOP to unsubscribe or HELP for assistance. You may also call (919) 977-1870 or email info@scanlanfamilydentistry.com. After opting out, you may receive one final confirmation; further program texts will stop unless you opt in again. We may retain consent and opt-out records to document and honor your choices. Ordinary SMS is not a substitute for a secure patient form or encrypted email when sending detailed health information. See our SMS Terms and Conditions.

Cookies, Analytics, and Campaign Measurement

Website services may use cookies and similar technologies to support site functionality, security, and general traffic or campaign measurement. Our policy does not authorize advertising or analytics services to receive PHI. Patient identities, patient-form answers, records, and identifiable appointment or treatment details must not be sent to advertising pixels, audience lists, or general-purpose analytics services. We do not use patient information to build advertising profiles.

Patient-derived demographic reporting must meet the de-identification requirements described above before it is shared for general reporting. A cookie choice or acceptance of this website policy does not substitute for a HIPAA authorization or a required business associate agreement. Your browser may allow you to limit or delete cookies, although some website features may work differently afterward.

Third-Party Services and Links

We use service providers for practice software, secure communications, hosting, and security. Their access must be limited to the authorized service and applicable legal requirements. Listing a service category here does not grant it permission to receive patient information. Providers handling PHI on our behalf must meet the applicable HIPAA and business associate requirements.

Links to independent websites, such as maps, social networks, and patient resources, are governed by those websites' own privacy policies. Linking to a website does not authorize us to disclose your PHI to it or remove our responsibilities for providers acting on our behalf.

Your Privacy Rights and Choices

You may contact us about information you submitted, request a correction, or ask for a different communication method. Patient rights under HIPAA include applicable rights to access and obtain copies of records, request amendments or restrictions, request confidential communications, and obtain an accounting of certain disclosures. The HIPAA Notice of Privacy Practices explains these rights and their limits. Required retention obligations may prevent immediate deletion of healthcare records.

You may raise a privacy concern with our office or file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights. We will not retaliate against you for exercising a privacy right or filing a complaint.

Security

This website uses SSL and security services provided through WP Engine and Cloudflare. Patient forms and practice email use Paubox protection as described above. The office network uses SonicWall firewall protections managed in coordination with Darkhorse Tech. We use administrative, physical, and technical safeguards to protect patient information and limit access to authorized purposes.

No system can guarantee that an incident will never occur. That limitation does not waive our HIPAA obligations. If a breach requiring notification occurs, we provide the notifications required by applicable law.

Policy Changes

We may update this policy as our services and practices change. The latest revision date appears above. Changes do not authorize uses or disclosures prohibited by law or override a legally required authorization.

Contact Us

For privacy questions, requests, or complaints, contact Scanlan Family Dentistry at (919) 977-1870 or info@scanlanfamilydentistry.com. Ask to speak with the person responsible for patient privacy.