GOSHEN MEDICAL CENTER, INC.

WEBSITE PRIVACY POLICY

Last Updated: February 27th, 2026

This Website Privacy Policy (“Policy”) describes how Goshen Medical Center, Inc. (“Goshen Medical,” “we,” “us,” or “our”) collects, uses, protects, and discloses information through goshenmedical.org (the “Site”).

Goshen Medical is a private, non-profit 501(c)(3) organization and Federally Qualified Health Center (FQHC) providing medical, dental, behavioral health, and related services in North Carolina.

This Policy applies only to information collected through this Site and related web-based tools. It does not replace our HIPAA Notice of Privacy Practices (“NPP”), which governs Protected Health Information (“PHI”) created or received in connection with healthcare services.

1. Categories of Individuals Covered

This Policy applies to:

  • Current Patients

  • Prospective Patients

  • Caregivers or authorized representatives

  • Visitors browsing the Site

  • Individuals accessing telehealth services

  • Individuals accessing the patient portal

  • Board Members enrolled in SMS notifications

2. Categories of Information Collected

We collect information in three primary ways: information you provide directly, information collected automatically, and information collected through integrated service platforms.

2.1 Information You Voluntarily Provide

A. Online New Patient Forms

When prospective patients complete online intake forms, we collect limited preliminary information, which may include:

  • Full name

  • Date of birth

  • Address

  • Email address

  • Telephone number

  • Preferred clinic location

  • Insurance type (if provided)

  • Preferred appointment dates/times

Online submissions are used solely to initiate scheduling contact. Complete medical history, financial documentation, and clinical information are collected separately through HIPAA-compliant systems.

Online forms are not intended for emergency or urgent medical communication.

B. Contact Forms

When you submit inquiries, we collect:

  • Name

  • Email address

  • Telephone number (if provided)

  • Message content

Contact forms should not include sensitive medical information. If PHI is submitted, it will be handled in accordance with applicable law.

C. Patient Portal Access

Patients may access secure portal services to:

  • View portions of their medical record

  • Review lab results

  • Send secure messages

  • Request appointments

  • Pay bills

Portal access requires authentication credentials. Information transmitted through the portal is encrypted in transit and stored within secure systems managed by vendors operating under HIPAA Business Associate Agreements (BAAs), where applicable.

D. Telehealth Services

Patients may participate in telehealth visits using integrated audiovisual technology platforms.

Telehealth services may involve:

  • Real-time audio/video communication

  • Electronic transmission of clinical documentation

  • Temporary storage of session metadata

Telehealth platforms are selected based on security capabilities, encryption standards, and vendor compliance commitments. While we take reasonable safeguards to protect electronic communications, no internet-based transmission can be guaranteed to be 100% secure.

E. Newsletter Subscriptions

If you subscribe to receive updates, we collect your email address. You may unsubscribe at any time.

F. Board Member SMS Notifications

Board Members who voluntarily opt in provide:

  • Mobile phone number

  • SMS consent documentation

SMS notifications are limited to board governance matters. Message frequency varies. Standard carrier rates apply. Members may opt out by replying STOP.

2.2 Information Collected Automatically

When you visit our Site, we may automatically collect:

  • IP address

  • Browser type and version

  • Device type and operating system

  • Pages viewed

  • Date and time of visit

  • Referring URL

  • Geographic region (generalized)

This information is used to:

  • Maintain system security

  • Monitor website performance

  • Detect suspicious or malicious activity

  • Improve user experience

We do not use website analytics to profile individuals for medical decision-making.

2.3 Cookies and Tracking Technologies

We use cookies and similar technologies to:

  • Enable core website functionality

  • Enhance navigation

  • Analyze aggregate traffic patterns

  • Protect against spam and automated abuse

Cookies may be first-party or third-party. Users may disable cookies in browser settings; however, certain features may not function properly.

2.4 Google reCAPTCHA

This Site uses Google reCAPTCHA to protect against spam and automated misuse. reCAPTCHA collects hardware and software information and sends it to Google for security analysis.

Use of reCAPTCHA is subject to Google’s Privacy Policy and Terms of Service.

3. How We Use Information

We use information collected through the Site to:

  • Respond to appointment requests and inquiries

  • Provide telehealth services

  • Provide patient portal functionality

  • Deliver newsletters (if subscribed)

  • Improve website performance and security

  • Monitor compliance with legal and regulatory requirements

  • Prevent fraud or misuse

We do not sell personal information.

4. HIPAA and Protected Health Information

Protected Health Information collected in connection with clinical care is governed by our HIPAA Notice of Privacy Practices.

When PHI is transmitted through:

  • Patient portal messaging

  • Telehealth platforms

  • Secure electronic forms

It is handled in accordance with:

  • The Health Insurance Portability and Accountability Act (HIPAA)

  • Applicable North Carolina privacy laws

  • Federal FQHC regulations

Website browsing activity alone does not typically constitute PHI unless combined with identifiable healthcare information.

5. Sharing of Information

We do not sell or rent personal information. We may disclose information in the following circumstances:

A. Business Associates and Service Providers

We engage third-party vendors for:

  • Website hosting

  • Electronic health record systems

  • Telehealth platforms

  • Portal services

  • Email and SMS communication delivery

  • IT and cybersecurity services

Where required by law, these vendors operate under written agreements requiring appropriate safeguards.

B. Legal and Regulatory Compliance

We may disclose information to:

  • Comply with court orders, subpoenas, or legal process

  • Respond to regulatory authorities

  • Protect the safety of patients, staff, or the public

  • Prevent fraud or illegal activity

C. Organizational Transactions

Information may be transferred in connection with a merger, restructuring, or asset transfer, subject to legal protections.

6. Web Analytics and Advertising Tools

We use analytics services such as:

  • Google Analytics

  • Google Ads

  • Google Search Console

These services collect aggregate traffic data to evaluate website effectiveness.

We do not use online tracking technologies to intentionally collect sensitive health condition information for advertising purposes.

Users may review Google’s privacy disclosures to understand how those services operate.

7. Data Retention

We retain information collected through the Site:

  • As long as necessary to fulfill the purpose for which it was collected

  • As required by applicable federal or state record retention laws

  • As needed for compliance, auditing, or security purposes

8. Data Security Measures

We implement administrative, technical, and physical safeguards, which may include:

  • Encrypted transmission (HTTPS/TLS)

  • Access controls and authentication measures

  • Role-based access to systems

  • Firewall and intrusion detection systems

  • Ongoing monitoring and vulnerability management

  • Workforce privacy and security training

Despite these safeguards, no system can guarantee absolute security.

9. Children’s Information

This Site is not directed to children under age 13. We do not knowingly collect personal information directly from children through the Site without appropriate parental or guardian involvement.

10. Your Rights and Choices

You may:

  • Opt out of marketing emails

  • Request updates to inaccurate contact information

  • Contact us regarding privacy concerns

  • Exercise applicable rights under state or federal law

HIPAA-related rights are described in our Notice of Privacy Practices.

11. Do Not Track

We do not currently respond to “Do Not Track” browser signals due to the absence of a uniform industry standard.

12. Changes to This Policy

We may update this Policy periodically. Changes will be posted with a revised “Last Updated” date. Continued use of the Site constitutes acceptance of the revised Policy.

13. Contact Information

For questions about this Website Privacy Policy, contact:

Goshen Medical Center, Inc.
412 SW Center Street
Faison, NC 28341-8820
Phone: 910-267-1942