What this website collects, and what it does not.

The short version

1. Who we are

MedSpañol is a medical clinic at 425 Estudillo Avenue, Unit A, San Leandro, California 94577, phone (510) 292-3297. In this notice, “we” means MedSpañol, and “the site” means medspañol.org (also written xn--medspaol-i3a.org), including its checkout pages at /checkout and /care.

2. What the site collects, and why

Every visit

Like any website, the servers that deliver these pages receive your IP address, your browser type, the page you asked for, and the page that linked you here. Our hosting providers, Vercel (which runs the site) and Hostinger (which serves the domain), keep these request logs for a limited time under their own settings. We use them only to deliver the site, keep it secure, and fix problems. Apart from Google on eight pages (section 3), the site’s pages set no cookies and store nothing in your browser.

Eight pages with Google Analytics

The pages our ads link to measure visits, and our Google ads, with Google Analytics. Section 3 says exactly what it records.

The rest of the site

No other page loads Google Analytics or any other analytics, advertising, or tracking tool. The site’s own script reads the web address only to carry a campaign code and a topic onto its links (section 4). It stores nothing in your browser and sets no cookie.

Buttons with a price on the Services page

A button with a price opens the MedSpañol app with your choice ready. To do that, it sends the app only the catalog codes of what you tapped: no price, name, cookie, or anything else.

Paying on the site instead of in the app

If you pay at /checkout or /care, the page sends our server only your choice (the plan or service, and a referral code if you have one) and your agreement to the terms. Our server asks Stripe to open a secure payment page. You enter your name, email, billing address, and card on Stripe’s page, not on ours. Stripe processes the payment, sends your receipt, and gives the clinic a record of the purchase, including your name, email, and billing address. The clinic keeps your name, email, and what you bought in its patient system, so our staff can match the payment to your care. We never see your full card number. Stripe’s own privacy policy applies to what you give Stripe.

Calling or emailing the clinic

If you tap the clinic’s phone number or email address, your own phone or email app contacts the clinic, and the clinic receives what you share, such as your number, your address, and your message. We use it to answer you and, if you ask, to help you book. Email is not a secure way to send health information; for anything about your care, call the clinic or use the app.

Donations

The Donate page’s button opens the page of MEDSPANOL, a nonprofit, on Every.org, a separate giving platform. Every.org collects what you give it under its own privacy policy. If you choose there to share your name and email with the nonprofit, Every.org passes them to MEDSPANOL. The site itself receives nothing.

3. Google Analytics on eight pages

Google Analytics runs on exactly eight pages: /hormone-optimization and /metabolic-optimization, their Spanish editions /optimizacion-hormonal and /optimizacion-metabolica, and the four scheduling steps they lead to, /start-consultation, /start-metabolic-consultation, /agendar-consulta and /agendar-consulta-metabolica. On those pages it records:

• the page you view, its web address (including any campaign code or ad click code an ad adds to it), its title, and the page that sent you;
• taps on the clinic’s phone number and on links that leave the site, and when you continue to scheduling;
• how far down the page you scroll, and how long the page stays open;
• your device, browser, screen size, and language;
• your approximate location (city, region, and country), which Google works out from your IP address.

It keeps this under a random identifier stored in two cookies, _ga and _ga_0K2J73R2LQ. These pages ask for nothing, so Google Analytics does not receive your name, email, or phone number. It does see which page you opened, and these pages are about health services.

The same Google tag also measures our Google ads. If you arrive from a Google ad, the web address carries Google’s ad click code. Google stores it for 90 days in a cookie named _gcl_aw (or _gcl_ag), with a companion cookie named _gcl_gs, and in a matching entry in your browser’s storage named _gcl_ls. When you reach a scheduling step, Google may set a cookie named _gcl_au and report the visit to Google Ads as a scheduling step, matched to the ad click that led to it. We use all of this only to count visits and to see which ads lead people to call the clinic or start scheduling.

Google signals and ad personalization are both turned off, and every measurement the site sends is marked for non-personalized ads; what it reports to Google Ads is also marked for restricted data processing. With Google signals off, Google Analytics does not link these visits to Google accounts in our reports, and with ad personalization off, Google does not use them to personalize ads. The measurements go to Google’s own web addresses, so your browser may also send Google the cookies Google keeps for itself. Google explains its own use of this information in How Google uses information from sites or apps that use its services.

Google Analytics deletes the visit-by-visit data tied to its cookie identifier no more than 14 months after it is collected, and its record of the identifier itself no more than 14 months after your most recent visit to these pages. Totals that identify no one, such as how many people viewed a page, stay in our reports. Google Ads keeps its record of an ad click and a scheduling step under Google’s own retention rules. The _ga and _ga_0K2J73R2LQ cookies last up to two years, and _gcl_aw, _gcl_ag, _gcl_gs, _gcl_au and the _gcl_ls entry last 90 days, unless you delete them sooner. Some browsers shorten these periods, in some cases to 7 days or less.

4. What the site passes to the app

Links from the site into the MedSpañol app (medspanol.app) can carry two short codes in their web address: the topic of the button you chose (one of six, such as “hormone-balance” or “weight-management”) and the campaign code of the ad that brought you, when the site recognizes it. The app uses them to start its questions on the right topic and to record which ad brought you. Apart from the catalog codes a price button sends (section 2), nothing else is passed. What the app does next is described in the app’s own privacy policy (section 10).

5. Categories, purposes, and how long

These are the categories of personal information the site collects, named as California law names them, with where each comes from, why we collect it, who receives it, and how long it is kept.

The site does not ask for health information, and your card details go only to Stripe. Two things can still relate to your health: which of the eight health-service pages you visit, which Google sees (section 3), and what you buy at /checkout or /care. We use the first only to count visits and measure our ads, never to infer anything about your health, and the second only to provide, bill for, and keep records of your care.

6. No selling or sharing

We do not sell personal information, including that of anyone under 16. We do not share it for cross-context behavioral advertising, which means letting advertising companies use it to target you with ads based on what you do on other websites. We do not give personal information to other companies for their own marketing. Every measurement the eight pages send to Google is marked for non-personalized ads and for restricted data processing, which limits how Google may use it under California law. What Google itself may do with Google Analytics data also depends on our account’s data-sharing settings and on Google’s policies.

7. Your choices: Global Privacy Control, Do Not Track, cookies

Global Privacy Control

Global Privacy Control is a setting in some browsers and extensions that tells websites not to sell or share your information. If your browser sends it, the eight pages above do not load Google Analytics at all: nothing is requested from Google and no Google cookie is set, and the bottom of each page says so: “Global Privacy Control detected: opt-out request honored.” on the English pages, and “Se detectó Global Privacy Control: se respetó su solicitud de exclusión.” on the Spanish pages. You do not need to do anything else. Learn about Global Privacy Control.

Do Not Track

The older Do Not Track setting has no agreed standard, and the site does not change what it does when a browser sends it. Global Privacy Control is the signal the site honors.

Cookies

You can block or delete cookies in your browser’s settings, and every page of the site still works without them. Google offers a browser add-on that stops Google Analytics on every website: Google Analytics opt-out add-on.

Other companies and your activity over time

Google may collect information about your visits to the eight pages over time and across other websites that use Google’s services. With Google signals and ad personalization off, Google may use it to measure our site and our ads, but not to personalize ads for you. Apart from Google on those eight pages, the site lets no other company collect information about your activity over time or across websites. If you open the site inside another app’s built-in browser, such as TikTok’s or Instagram’s, that app may collect what you do there under its own privacy policy; the site does not control that.

8. Your rights, and how to use them

California law gives California residents rights over the personal information a business holds about them. We honor these requests from any visitor:

• Know and access: what personal information we have collected about you, where it came from, why, and who received it, and a copy of it.
• Correct information that is inaccurate.
• Delete information we hold, except what the law allows or requires us to keep, such as payment records.
• Opt out of selling or sharing. We do neither, and we treat a Global Privacy Control signal as this request.
• Limit the use of sensitive personal information. We use what you buy only to provide, bill for, and keep records of your care, and which pages you visit only to measure our ads, never to infer anything about your health.
• Equal treatment: using any of these rights never changes your price, your service, or its quality.

How to ask. Call (510) 292-3297, email Sonia@Medspanol.org, or write to MedSpañol, 425 Estudillo Avenue, Unit A, San Leandro, California 94577. We confirm we received your request within 10 business days and answer within 45 days. If we need more time, we tell you why, and we take no more than 45 more days.

Checking it is you. To protect you, we confirm a request comes from you by matching details we already hold, such as the email on a purchase, and we ask for no more than we need. Much of what the site collects, such as Google Analytics data, is not linked to a name or email, so we cannot find it from them; we will tell you when that is the case.

Someone acting for you. You may have an authorized agent make a request for you. We may ask for your signed permission and ask you to confirm your identity with us directly.

9. Children

The site is meant for adults. It is not directed to children under 16, and we do not knowingly collect personal information from children under 16. If you believe a child has given us information through the site, contact us and we will delete it.

10. The app and your medical record

This notice covers only this website. The MedSpañol patient app at medspanol.app, where you schedule, sign in, answer health questions, and order, has its own privacy policy, and the clinic’s notice of privacy practices, which describes your rights over your medical record, is published there. Each shows its status and effective date at its top; while either is marked as a draft, it is not in force. For any question about your medical record, call the clinic at (510) 292-3297.

• App privacy policy
• Notice of privacy practices

11. Links to other websites

The site links to other websites, including the MedSpañol app, Stripe, Every.org, Rupa Health (a separate laboratory company), Google Maps, and the Google and Global Privacy Control pages above. When you leave the site, that website’s own privacy policy applies.

12. Security

The site is served over HTTPS, and plain HTTP requests are redirected to it. It has no visitor accounts and no forms that collect personal information, and card details go only to Stripe. No website or internet connection is completely secure, so we cannot promise absolute security.

13. Changes to this notice

When we change this notice, we post the new version on this page and update its effective date. If a change is material, for example a new kind of information or a new company receiving it, we also say so at the top of this page when the change takes effect.

14. Contact us

Questions about this notice or your information: call (510) 292-3297, email Sonia@Medspanol.org, or write to MedSpañol, 425 Estudillo Avenue, Unit A, San Leandro, California 94577.