Privacy Policy

Information you provide directly:

• Name, email address, phone number, and mailing address
• Date of birth and gender
• Emergency contact information
• Appointment reason and health history (when provided)
• Payment information (processed by Stripe — we do not store card numbers)
• Account credentials (passwords are hashed and never stored in plain text)

Information collected automatically:

• IP address and browser/device type (for security and fraud prevention)
• Pages visited and actions taken on our site (via server logs)
• Session cookies required for authentication

Measuring our public pages:

On our public pages only (never in the patient portal, the staff portal, sign-in pages, our online health-history and consent forms, or our in-clinic check-in kiosk), we use two measurement tools:

• Umami, a privacy-focused analytics service, counts page visits. It does not use cookies and does not identify you.
• Google Ads conversion measurement tells us whether our ads lead to bookings. Google's tag may set a cookie in your browser. It records only that a booking happened, without your name, contact details, appointment details, or health information. We remove the appointment details from the page address before anything is sent, and ad personalization is turned off.

We do not use Google Analytics, and we do not share patient lists or contact details with Google or any other advertiser.

• Schedule and manage your chiropractic appointments
• Send appointment confirmations, reminders, and billing communications
• Process membership subscriptions and visit payments via Stripe
• Maintain your patient record and clinical history
• Respond to your questions and support requests
• Detect and prevent fraud, unauthorized access, and abuse
• Comply with legal and regulatory obligations, including HIPAA

We do not sell your personal information. We do not use your information for advertising or marketing to third parties.

We use SMS (text messaging) to send appointment reminders, care follow-ups, and direct communications from your provider. Message frequency varies. Standard message and data rates may apply.

How we obtain consent: You provide your mobile phone number when booking an appointment at chiroshack.com or in person at one of our clinics. By providing your phone number, you consent to receive SMS messages from Chiro Shack related to your care and appointments.

Opt-out: You may opt out of SMS messages at any time by replying STOP to any message. You will receive a single confirmation message and no further SMS will be sent. To re-enable SMS, reply START.

Help: Reply HELP to any message for assistance, or contact us at (208) 248-9017.

We do not share your mobile number with third parties for their marketing purposes. SMS consent is not a condition of receiving care or purchasing services.

We share your information only in the following limited circumstances:

• Service Providers: We use Stripe for payment processing; Amazon Web Services for email, secure data storage, and our AI assistant, Ari; Twilio for text messages and phone calls; and, on our public pages only, Umami for visit counts and Google for ad conversion measurement (see Section 1). These providers access only the information necessary to perform their services and are bound by confidentiality obligations.
• Legal Requirements: We may disclose information when required by law, subpoena, or court order, or to protect the safety of our patients and staff.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, patient information may be transferred as part of that transaction, subject to HIPAA requirements.

We retain patient records and appointment history as required by Idaho state law and HIPAA regulations (generally a minimum of 7 years for adult patients, longer for minors). Account credentials and session data are retained while your account is active. You may request deletion of your account and non-clinical data at any time (see Section 7).

We take reasonable technical and organizational measures to protect your information, including:

• HTTPS encryption for all data in transit
• Bcrypt password hashing
• Account lockout after repeated failed login attempts
• Role-based access control limiting staff access to patient data
• HIPAA-compliant audit logging of all access to patient records

No system is completely secure. If you believe your account has been compromised, please contact us immediately at (208) 248-9017.

We use strictly necessary session cookies for authentication and security. On our public pages, Google's ads tag may also set a measurement cookie, as described in Section 1; it is never set in the patient portal. Our analytics (Umami) uses no cookies. You may block or clear cookies in your browser. Blocking Google's cookie has no effect on your care or your account, but disabling all cookies will prevent you from logging in to your patient account.

You have the right to:

• Access a copy of the personal information we hold about you
• Correct inaccurate or incomplete information via your profile settings
• Delete your account and associated non-clinical personal data (clinical records are retained as required by law)
• Opt out of non-essential SMS and email communications in your account settings
• Request a copy of your health information under HIPAA (see our HIPAA Notice)

To exercise these rights, log in to your account at apertahealth.com/account/profile or contact us at info@chiroshack.com.

Our services are not directed to children under 13. For patients under 18, a parent or legal guardian must provide consent and may manage the account. If you believe we have inadvertently collected information from a child under 13, please contact us immediately.

We may update this Privacy Policy from time to time. We will post the updated policy on this page with a new “Last updated” date. Continued use of our services after such changes constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy, please contact us: