Privacy Policy

Westchester Podiatric Medicine — Dr. John C. Marzano, DPM. 700 White Plains Rd, Suite 308, Scarsdale, NY 10583. Phone: (914) 423-0600. Email: info@westchesterpodiatric.com. We are a solo podiatry practice, and we run this website ourselves. There is no parent company and no third party that we sell information to.

The appointment request form on our contact page

This form has two boxes: your full name and your phone number. That is all it collects and all we store from it. It does not ask for your email address, your date of birth, your insurance, or a description of your problem, and there is no box for a message. We use it to call you back and book your visit.

Along with your name and phone number, our system records how you arrived at the site (see the next section) and the date and time you sent the form.

The review form

When you leave a review, we store what you type:

• your first name and last initial
• your star rating, from one to five
• your review, in your own words
• the name of your primary care doctor, if you choose to fill that box in — it is optional, and it is never shown on the website

Please read “Reviews are published on this website” below before you send one.

When you call, email, or come in

If you telephone the office or email us, we receive whatever you choose to tell us — which may include your email address, your insurance plan and member number, and details about your symptoms. That information is not collected by this website; it comes to us directly, and once we hold it in connection with your care it is protected health information under HIPAA.

Our new-patient registration forms are a different matter. They are PDFs that you download from Google Drive, print, and fill in by hand. Nothing you write on them is submitted through this website — you bring the completed form to your appointment. Google may record that the file was downloaded.

Please do not send medical details through a web form or by email. Ordinary email and web forms are not secure, private channels, and we cannot promise a message sent that way stays private on its way to us. Give us your phone number and we will call you.

How you found us (advertising attribution)

When you arrive from an advertisement or from another website, our own code saves a small record of that visit in your browser: the page you landed on, the address of the website that sent you, and any tracking codes in the link you clicked. Those codes are the ones advertising systems add, and they are named utm_source, utm_medium, utm_campaign, utm_content, utm_term, gclid, gbraid, wbraid, fbclid and msclkid.

This record is kept in two places on your own device: your browser's local storage, and two cookies named westchester_first_touch and westchester_last_touch, which last 90 days. We keep both your first visit and your most recent one, so that we can tell which advertising actually reaches patients rather than only counting the last click.

This record is sent to us only when you submit the appointment request form, and it is stored next to that request. It is not sent with a review, and it is not sent if you simply browse the site. It contains no name, no phone number, and nothing you have typed.

Google Analytics and Google Ads

Every page of this site loads Google Tag Manager, which in turn loads Google Analytics 4 (property G-H9CK8FTH35) and Google Ads (account AW-17603447113). Through these, Google sets cookies and receives:

• the pages you view on this site, and the address of each page
• clicks on our phone number and on our “book an appointment” buttons
• the fact that an appointment form was started, sent successfully, or failed — along with the page you sent it from
• your device, browser and language, your approximate location, and your IP address
• an advertising identifier that lets Google match your visit to an ad you clicked

We also use Google's call measurement so we can tell which advertising leads to phone calls. If you reach the site through a Google advertisement, Google may show a forwarding telephone number in place of our own and record that the call took place. The call still rings in our office.

We never send Google your name, your phone number, your email address, your insurance details, or anything you type into a form. Google's own terms forbid it, and so does the law that applies to us.

Maps

Our contact page shows a Google map of the office. Loading that map tells Google you were on the page, the same as visiting Google Maps directly.

Security and server records

Vercel, the company that serves this website, records the IP address and the time of each request in its logs. We also count form submissions per IP address for a minute at a time to stop automated spam, and each of our forms carries a hidden field that bots fill in and people do not. If saving your request fails, we log an error code only — never your name or your number.

If you send us a review, we may publish it on this website for anyone to read.

A published review appears on our testimonials page showing the first name and last initial you typed, your star rating, your review in your own words, and the date. Search engines can find it, and other people may copy or quote it once it is public.

Our staff reads every review before it goes up, and nothing appears automatically. The name of your primary care doctor is never published; we keep it only so we know who to thank for the referral.

Because a review is public, please do not describe your diagnosis, your treatment, or anything else you would not want a stranger to read. If you would rather your name not appear, use only an initial. And if you have already sent a review and want it taken down, call (914) 423-0600 and we will remove it.

A cookie is a small file a website stores in your browser. This site uses cookies for three things: remembering how you found us, measuring how the site is used, and measuring which advertisements lead to appointments. None of them are needed to read the site or to send the appointment form — the form works with every cookie blocked.

Whether tracking is on when you arrive

We want to be straight with you about this. This site does not show a cookie banner. If you are visiting from the United States, the analytics and advertising cookies described above are switched on when you arrive, and you turn them off yourself using the options below. If you are visiting from the European Economic Area, the United Kingdom or Switzerland, those cookies are switched off and stay off. Google still receives a small, cookie-free note of the visit: your browser type, the page address, the page that sent you, and the time. Google uses that to estimate overall trends. We do not link it to who you are.

How to turn it off

• Block Google Analytics everywhere. Google publishes a free browser add-on that stops Google Analytics on every website you visit: tools.google.com/dlpage/gaoptout.
• Turn off personalized advertising from Google. Use Google's own controls at myadcenter.google.com.
• Block or delete cookies in your browser. Every browser has this in its settings, usually under Privacy. Deleting cookies also clears the record of how you found us.
• Read what Google does with it. Google explains how it uses information from sites that use its services at policies.google.com/technologies/partner-sites, and its privacy policy is at policies.google.com/privacy.

If you turn these off, nothing on this site stops working. We simply lose the ability to tell which pages and which advertisements brought you here.

Westchester Podiatric Medicine is a covered entity under HIPAA, the federal health privacy law. That means two different documents apply to you, and they do different jobs.

• This privacy policy is about the website. It tells you what this site collects from visitors and what happens to it.
• Our Notice of Privacy Practices is the document HIPAA requires us to give you as a patient. It explains how we may use and share your health information — to treat you, to get paid, and to run the practice. It also sets out your rights. You can see your record and get a copy of it. You can ask us to correct it. You can ask for a list of certain disclosures we have made. You can ask us to contact you a particular way. And you can complain, to us or to the federal government, without being penalized for it.

The two overlap. Information you send us as a member of the public — the name and phone number on an appointment request, for instance — is not yet a medical record when it arrives. But as soon as we hold it in order to arrange your care, it becomes protected health information, and from that point our Notice of Privacy Practices and HIPAA govern it, not this page.

To get our Notice of Privacy Practices, ask at the front desk, call (914) 423-0600, or email info@westchesterpodiatric.com, and we will give you a copy. You may ask for it at any time, whether or not you are a patient here.

One thing we will not tell you is that this website is “HIPAA compliant.” That is a marketing phrase, not a legal status, and no website can earn it. What we can tell you is what this site collects, which is set out above, and what we do to keep health information out of the advertising tools, which is set out next.

Federal regulators have warned medical practices to be careful with analytics and advertising tags. The reason is simple. Those tools are run by companies that have not agreed to protect health information the way a medical practice must. Google will not sign the agreement that would let us treat Google Analytics or Google Ads as a partner handling protected health information. So we work on one rule: Google must never receive any.

What that means in practice:

• Nothing you type into a form is ever sent to Google.
• We do not have a patient portal, a symptom checker, or a login on this site, so there is nothing here that identifies you as a patient of this practice.
• We do not build advertising audiences out of the health topics people read about here, and Google's own advertising rules forbid targeting people by health condition.
• We do not sell, rent or trade information about you, and we do not share it with data brokers or social networks.

Being honest about the limit: our pages have plain addresses that describe what they are about, such as the page about diabetic foot ulcer care. When Google Analytics records that a page was viewed, it records that address. So Google does learn that a particular browser looked at a particular topic on our site, in the same way it would for any website. It does not learn your name from us, and reading a page here does not tell anyone that you have the condition it describes.

If you would rather Google saw none of it, use the opt-outs in the section above, or simply call the office at (914) 423-0600 instead of using the site.

• To call you back and book your visit. That is the only reason the appointment form exists.
• To publish the reviews patients choose to send us, after our staff has read them.
• To work out which pages and which advertisements actually bring patients to the practice.
• To keep the site running, and to block spam and abusive traffic.
• To meet our legal and professional record-keeping obligations as a medical practice.

We do not use what you send through this site to advertise to you. Filling in the appointment form gets you a phone call about your appointment; it does not add you to a mailing list, and this site does not send you text messages.

We do not sell your information, and we do not share it except with the companies that run parts of this website for us, and where the law requires it.

• Supabase stores the database of appointment requests and reviews.
• Vercel hosts the website and keeps the server logs.
• Google receives the analytics and advertising information described above, under Google's own privacy policy. It does not receive anything you type.

Inside the practice, appointment requests and reviews are seen by Dr. Marzano and by the staff who schedule patients and answer the phone, using a private dashboard that is not part of this website.

We may also disclose information if we are required to by law, by a court, or by a health authority, or where it is necessary to protect someone from harm.

New York's SHIELD Act requires a business holding a New York resident's private information to keep reasonable safeguards around it, sized to the business. As a medical practice we are also bound by the HIPAA Security Rule, which is the stricter of the two. What we do here:

• The whole website is served over an encrypted connection, and so is every form submission.
• Appointment requests and reviews go to a database that requires credentials to read.
• Our error logs record an error code and nothing else, so a failure never writes your name or number into a log file.
• Only Dr. Marzano and the staff who need it can see submitted requests.
• Our forms are rate-limited and screened for automated spam.

No website can promise perfect security, and we will not pretend otherwise. If information about you is ever exposed in a way that the law says you must be told about, we will notify you, and the authorities, within the time the law allows.

• Appointment requests. We keep these while we follow up with you, and afterwards so that we can find our earlier contact with you if you call again. If you have not become a patient and you ask us to delete your request, we will.
• Reviews. We keep a review for as long as it is published, or until you ask us to remove it.
• Analytics and advertising records. These are held by Google for the period set on our Google Analytics property. The advertising cookies this site sets in your browser last 90 days, and you can delete them at any time.
• Server logs. Kept for a short period by our hosting provider for security purposes.
• Your medical record, once you are a patient. New York requires a physician to keep an adult patient's record for at least six years after the last treatment. Children's records are kept for six years and until at least one year after the child turns eighteen. These rules override the shorter periods above, and they are why we may not be able to delete everything you ask us to.

You can ask us what we hold about you, ask us to correct it, or ask us to delete it — including taking down a review you sent. You do not need to give a reason, and asking will never affect the care you receive.

• Phone: (914) 423-0600 — the fastest way
• Email: info@westchesterpodiatric.com
• Mail: 700 White Plains Rd, Suite 308, Scarsdale, NY 10583

Please tell us what you would like removed. We will reply within 30 days. If we have to keep something — because it is part of a medical record we are required to retain, or because we need it to resolve a billing or legal matter — we will tell you plainly which part and why.

If you are a patient and your question is about your medical record rather than this website, ask for our Notice of Privacy Practices, which explains how to see, copy or amend your record and how to complain. You may also complain directly to the U.S. Department of Health and Human Services, Office for Civil Rights, at hhs.gov/hipaa/filing-a-complaint. We will not retaliate against anyone for making a complaint.

New York does not have a general consumer privacy law of the kind California and some other states have passed. So we are not going to list rights we do not owe you and could not honor. What New York does give you is the SHIELD Act. It requires us to protect your information, and to tell you if there is a breach. New York's health privacy rules also sit alongside HIPAA and give you access to your own medical record.

Practically, it makes no difference where you live. If you write to us and ask what we hold about you, or ask us to delete it, we will do the same thing for everyone: answer you, and act on it wherever the law lets us.

This website is meant for adults. We do treat children in the office, but the forms on this site should be filled in by a parent or guardian, and we do not knowingly collect information from a child through this website. If you believe your child has sent us something through this site, call (914) 423-0600 and we will delete it.

If we change what we collect, or who receives it, we will update this page and change the date at the top. This page always shows the version that applies now.