Privacy Policy

01Introduction

Carte Clinics Inc. (doing business as “Carte” or “Carte Medical”) and its affiliated physicians (collectively, “Carte,” “we,” “our,” or “us”) provide independent physician advisory services. This Privacy Policy describes how we collect, use, and share information about you through our website at www.cartemedical.com (our “Site”) and any other online services that link to this Privacy Policy, through email, text messages, phone calls, and other electronic and offline communications between you and us (collectively, the “Services”).

Please read this Privacy Policy carefully. If you do not understand any aspect of it, please contact us using the information at the end of this document. This Privacy Policy is not a contract and does not create any contractual rights or obligations.

We may update this Privacy Policy from time to time. Unless we state otherwise, changes will be effective upon the “Last updated” date at the top. If we make material changes, we will make reasonable attempts to notify you. Your continued use of the Services after changes to this Privacy Policy means you accept the changes.

02Information We Collect

Information You Provide to Us

We collect information you provide when you submit our inquiry form, sign up to receive our guides, schedule a call with us, contact us via email or phone, engage us to provide services, or otherwise communicate with us. This information may include:

• Contact information: name, email address, phone number, and (where relevant) mailing address
• Medical situation information: information you share about your medical situation, prior physicians involved in your care, treatments you are considering, diagnoses, symptoms, and other information relevant to the advisory work you are asking us to do
• Demographic information: age or date of birth (where relevant), and location
• Professional information (for wealth advisors and partner firms): firm name, role, business email, and information about your practice or clients you may refer
• Referral information: how you heard about Carte, who referred you, and (where applicable) the identity of the person on whose behalf you are inquiring
• Any additional information you choose to provide through our inquiry forms, correspondence, or during a call

Information We Collect Automatically

When you interact with our Site, we automatically receive and record information from your browser or device. This may include:

• IP address
• Approximate geolocation (city or region — not precise)
• Device type, operating system, and browser
• Pages viewed and time spent
• Referral source (the site or search engine that brought you to us)
• Interaction data (form starts, form completions, clicks, scroll behavior)

We use this information to understand how our Site is used, to improve it, and (in the case of the inquiry form) to route inbound requests appropriately.

Information About Others That You Provide

If you provide information about another person to us, (for example, if you are inquiring on behalf of a parent, spouse, adult child, or other family member) we assume you have that person’s consent to share their information with us. We handle information about that person under the same terms as information about you.

03How We Use Your Information

We use your information to:

• Respond to your inquiries and provide the Services you have requested
• Schedule and coordinate calls between you and our physicians
• Deliver the guides and other resources you request
• Communicate with you about your inquiry or engagement, including via text message and phone call at the number you provide
• Improve our Site, understand how it is used, and diagnose technical issues
• Comply with our legal, regulatory, and professional obligations
• Detect, prevent, and respond to fraud, abuse, or security issues
• Send you marketing and educational content about Carte, subject to your right to opt out at any time

04How We Share Your Information

We may share your information in the following circumstances.

With Third-Party Vendors and Service Providers

We use third-party vendors and service providers to help operate our business. These vendors receive information only to the extent needed to provide services to us. Vendors that may receive protected health information on our behalf operate under signed Business Associate Agreements. The specific vendors we use are described in the next section.

With Physicians Working on Your Case

If you engage Carte, information about your medical situation will be shared with the specific physicians, both Carte-employed lead physicians and independent consulting specialists we bring in, who are working on your case, as necessary to provide advisory services. We share only what is needed for each specialist to contribute meaningfully to your engagement. Consulting specialists are engaged under professional-services agreements that include confidentiality obligations, and, where applicable under HIPAA, Business Associate Agreements or the equivalent.

With Your Consent

We will share your information with third parties when you have provided consent for us to do so, for example, if you consent to publication of a case study or the use of a testimonial.

For Legal Reasons

We may share information when we have a good-faith belief that access, use, preservation, or disclosure is reasonably necessary to:

• Comply with applicable law, regulation, subpoena, legal process, or enforceable government request
• Enforce applicable contracts, terms, or policies, including investigating potential violations
• Detect, prevent, or address fraud, security, or technical issues
• Protect against harm to the rights, property, or safety of Carte, our clients, our team, or the public, as required or permitted by law

In the Event of a Business Change

If our ownership changes, for example, through a merger, acquisition, financing, or sale of assets, your information may transfer to the new owner. In such a case, your information would continue to be handled subject to the promises made in the applicable privacy policy.

05Third-Party Services We Use

We use the following third-party services in the operation of our business:

• Google Workspace (email, calendar, storage, forms, sheets, docs) — hosts our operational infrastructure, including our inquiry form. Information you submit through our inquiry form is stored on our Google Workspace instance, which is covered by a signed Business Associate Agreement with Google.
• ConvertKit — delivers our email newsletters and lead-magnet fulfillment. If you request one of our guides, your name and email are stored in ConvertKit. ConvertKit is not authorized to receive protected health information; we do not send protected health information through this channel.
• Cloudflare — hosts our website through its Workers static-asset platform. Our hosting provider does not receive inquiry-form submissions or other protected health information; all such information is delivered directly to our Google Workspace instance.
• RingCentral — powers phone calls related to your inquiry and, when you select the optional text-message permission, automated text messaging. RingCentral has signed a Business Associate Agreement with Carte and is authorized to transmit communications that may reference your protected health information.
• Google Analytics 4 and Google Tag Manager — provide website analytics. We use these to understand traffic patterns, page performance, and general engagement. No protected health information is sent to Google Analytics.
• Microsoft Clarity — provides session recording and heatmap analysis on our website. Clarity is configured not to record content typed into form fields on our inquiry form.
• Substack — hosts our essay publication at thephysicianadvisor.substack.com. If you subscribe to our essays, Substack’s own privacy policy governs your subscription.
• QuickBooks Payments — processes payment for services rendered under Carte engagements. Most invoices are paid by bank transfer through QuickBooks; clients who prefer to pay by credit card do so through QuickBooks as well. Payment information is provided directly to QuickBooks and is not stored on our Site.

If we add, remove, or substantially change vendors that handle sensitive information, we will update this list.

06Cookies and Similar Technologies

Our Site uses cookies and similar technologies to help operate the Site and understand how it is used.

Cookies

A cookie is a small file placed on your computer or device that collects and stores information about your browsing patterns. We use cookies to analyze web traffic, remember preferences, and improve the Site’s performance.

Web Beacons and Pixels

Web beacons (also called clear gifs, pixel tags, or single-pixel gifs) are transparent images embedded in web pages that let us count how many users visited a page and gather related usage statistics.

Types of Cookies We Use

• Strictly necessary cookies — required for the Site to function
• Analytics cookies — from Google Analytics 4 and Google Tag Manager
• Session-recording and heatmap cookies — from Microsoft Clarity
• Consent-management cookies — remember your consent choices

We do not use advertising cookies, retargeting pixels, or third-party ad-network trackers.

Managing Cookies

Most browsers let you manage cookies through settings. You can block or delete cookies, and you can decline non-essential cookies via our cookie consent banner. Note that blocking strictly necessary cookies may prevent the Site from working properly.

Global Privacy Control

We honor Global Privacy Control (GPC) signals sent by browsers. When you send us a GPC signal, we treat it as a valid opt-out of any sharing of your personal information for targeted advertising (though, as noted above, we do not share personal information for targeted advertising in the first place).

Do Not Track

Our Site does not respond to browser Do Not Track (DNT) signals separately from the GPC treatment described above, because industry practice for DNT is not standardized. If we begin honoring DNT specifically, we will update this Privacy Policy.

07Your Choices and Rights

Reviewing, Correcting, and Deleting Your Personal Information

You may request access to, correction of, or deletion of the personal information we hold about you by emailing us at privacy@cartemedical.com. To protect the security of your information, we may need to verify your identity before completing your request. We will comply with reasonable requests to the extent required by applicable law.

Marketing Communications

You may opt out of receiving marketing emails at any time by clicking the unsubscribe link in any marketing email or by contacting us. Once you opt out, we may still send you administrative or transactional communications relating to Services you have requested.

Cookie Preferences

You can manage cookie preferences through our cookie consent banner or your browser settings.

State-Specific Rights

If you are a resident of California, Virginia, Colorado, Connecticut, or another U.S. state with a comprehensive privacy law, you may have additional rights. See the state-specific notices at the end of this Privacy Policy.

08Text Messages and Phone Communication

Our inquiry form includes an optional, unchecked text-message permission box. If you select it, you consent to receiving informational text messages from Carte or those acting on our behalf at the number you provide regarding your inquiry. Your separate call-timing selection tells us when you would like Carte to call about the inquiry and does not depend on whether you permit text messages. Consent to text messages is not a condition of purchasing services.

• Confirmation of your inquiry and follow-up to coordinate a call with a Carte physician
• Scheduling messages directly related to the physician conversation you requested

We do not use this permission to solicit you about unrelated matters, and we do not sell your data to third parties. Automated inquiry text messages do not include the medical details you provide in the form. Standard message and data rates from your mobile carrier may apply.

You can opt out of text messages at any time by texting STOP in response to any text message. After you opt out, you will receive no further text messages from that number other than any confirmation needed to process the request. You may reply HELP for support or contact us through the information in this Privacy Policy.

09Marketing Communications

You may receive marketing and educational emails from Carte if you subscribe via our website, request one of our guides, or ask to be added to our contact list. You can opt out at any time via the unsubscribe link in any email or by contacting us. Opting out of marketing does not affect service-related emails you receive as a client.

10Artificial Intelligence and Automated Processing

We use large language models and other artificial-intelligence tools to support internal workflows, including summarization of inquiry submissions to help our physicians prepare for calls with you. Any AI vendors used to process sensitive medical information do so under appropriate contractual protections. We do not use client information to train third-party AI models.

We do not use automated decision-making or profiling to make decisions that produce legal or similarly significant effects on you. All decisions about whether and how Carte can assist with your situation are made by our physicians.

11Data Retention

We retain personal information for as long as needed to fulfill the purposes for which it was collected and to comply with our legal, regulatory, and professional obligations. Specifically:

• Inquiry submissions — retained for as long as needed to respond to your inquiry and, if you subsequently engage us, for the duration of the engagement plus any required record-retention period
• Client records — retained per applicable state and federal record-retention requirements for the type of records held
• Marketing communications data — retained until you opt out, plus a reasonable period for suppression-list maintenance
• Analytics data — retained per the default retention window in Google Analytics 4 (currently 14 months)

If a law requires us to retain your information for a longer period, we will comply with that law.

12Data Security

As a health-care provider, Carte maintains administrative, physical, and technical safeguards designed to comply with the requirements of the HIPAA Security Rule and to protect against unauthorized access, use, modification, or disclosure of your information. These include:

• Encryption of protected health information in transit and at rest
• Access controls that limit who at Carte can view what information
• Business Associate Agreements with vendors, including Google Workspace and RingCentral, that receive protected health information on our behalf
• Professional-services agreements with independent consulting specialists that impose confidentiality obligations before any information is shared
• Regular review of our security practices and vendor relationships

No system can be guaranteed to be 100% secure. While we take significant measures to protect your information, we cannot warrant the security of information you transmit to us.

13HIPAA and the Notice of Privacy Practices

Carte operates as a health-care provider through professional corporations organized in Maryland, Virginia, and California. In that capacity, we are subject to the Health Insurance Portability and Accountability Act (HIPAA) and its implementing regulations.

This Privacy Policy governs information collected through our website and through general marketing communications. A separate document, our Notice of Privacy Practices, governs how we collect, use, and disclose your protected health information (PHI) in the course of the advisory relationship, and describes your specific rights under HIPAA.

If you engage Carte as a client, we will provide you with our Notice of Privacy Practices at the start of the engagement. A copy is also available at any time by emailing privacy@cartemedical.com.

14Children’s Privacy

Our Services are intended for adults. We do not knowingly collect personal information from children under the age of 13, as defined by the Children’s Online Privacy Protection Act (COPPA).

If a parent or legal guardian is seeking advisory services on behalf of a minor child, the parent or guardian may submit an inquiry on the child’s behalf. In such cases, information about the minor is provided by the adult, not collected directly from the minor, and is used solely for the purpose of the advisory engagement.

If you are a parent or guardian and believe your child under 13 has provided personal information to us directly, please contact us. We will delete such information promptly.

15International Users

Our Services are intended for use only in the United States. If you access the Services from outside the United States:

• Any information you provide to us, and any information we automatically collect from you, will be transferred to and processed in the United States
• By using our Services, you consent to this transfer

16Third-Party Links

Our Site may contain links to external websites — including our Substack publication, external articles, and referenced source material. When you click through to those sites, their own privacy policies govern your interaction with them.

17Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date at the top of the document. If we make material changes, we will make reasonable attempts to notify you. Your continued use of the Services after changes take effect means you accept the changes.

18Contact Us

If you have questions, comments, or concerns about this Privacy Policy, or if you would like to exercise any of your rights, please contact us:

19Notice for California Residents

This section describes how Carte handles personal information of California residents and the rights afforded to California residents under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). For purposes of this section, “Personal Information” has the meaning given in California law.

Categories of Personal Information We Collect

In the preceding 12 months, we have collected the following categories of Personal Information:

• Identifiers — name, email address, phone number, IP address
• Contact information — mailing address (where provided)
• Protected class information — age; health status; medical conditions (where you share these with us)
• Professional information — for wealth advisors and partner firms
• Commercial information — services requested and provided
• Device and internet activity information — IP address, device type, browser type, pages viewed, time on Site
• Approximate geolocation — city or region (not precise)
• Sensitive personal information — health and medical information you share with us relating to advisory work

Sources of Personal Information

We collect Personal Information directly from you (through our inquiry form, correspondence, calls, and engagement), from your interaction with our Site (automatically), and (where applicable) from wealth advisors or family offices who refer you to us.

How We Use Personal Information

We use Personal Information for the purposes described in “How We Use Your Information” above.

How We Share Personal Information

We share Personal Information with the third-party vendors and service providers described in “Third-Party Services We Use,” with physicians working on your case, with your consent, and for legal reasons as described above.

Sales and Sharing of Personal Information

Sensitive Personal Information

We use and disclose sensitive personal information — including health information you share with us — only for the purposes of providing our Services and as otherwise permitted or required by law. We do not use sensitive personal information to infer characteristics about you.

Your California Privacy Rights

Subject to certain exceptions, you have the right to:

• Know what Personal Information we have collected about you, the categories of sources, the purposes for collection, and the categories of third parties with whom we share it
• Delete Personal Information we have collected from you
• Correct inaccurate Personal Information we hold about you
• Opt out of the sale or sharing of your Personal Information for targeted advertising (though, as noted, we do not sell or share for these purposes)
• Limit our use of sensitive Personal Information (though, as noted, we use sensitive information only for providing Services)
• Not be discriminated against for exercising your rights

To exercise these rights, please contact us at privacy@cartemedical.com. We will verify your identity before responding. You may also use a browser preference signal (such as Global Privacy Control) to indicate an opt-out, which we will treat as valid.

You may use an authorized agent to submit a request on your behalf. When we receive a request from an agent, we may verify both your identity and the agent’s authority.

You have the right to appeal a denial of a rights request. To appeal, contact us at privacy@cartemedical.com.

Shine the Light

California residents may request information about the categories of Personal Information Carte has disclosed to third parties for those third parties’ direct marketing purposes in the preceding calendar year. To request this information, please contact us at privacy@cartemedical.com.

20Notice for Virginia Residents

This section describes rights afforded to Virginia residents under the Virginia Consumer Data Protection Act (VCDPA).

You have the right to:

• Confirm whether we process your personal data and access the personal data we hold about you
• Correct inaccurate personal data we hold about you
• Delete the personal data we hold about you
• Receive a portable copy of your personal data
• Opt out of the processing of your personal data for purposes of targeted advertising, sale, or profiling in furtherance of decisions that produce legal or similarly significant effects (though we do not engage in these activities)

To exercise these rights, please contact us at privacy@cartemedical.com. We will verify your identity before responding.

You have the right to appeal a denial of a rights request. To appeal, contact us at privacy@cartemedical.com. If we do not resolve your appeal to your satisfaction, you may contact the Virginia Attorney General.

21Notice for Other U.S. State Residents

If you are a resident of Colorado, Connecticut, Utah, Iowa, Indiana, Tennessee, Texas, Oregon, Delaware, Montana, or another U.S. state with a comprehensive consumer privacy law, you may have similar rights under your state’s law. Those may include:

• The right to know or access your personal information
• The right to correct inaccurate personal information
• The right to delete your personal information
• The right to receive a copy of your personal information in a portable format
• The right to opt in or opt out of certain types of processing, including targeted advertising, sale of personal information, or automated decision-making that produces legal or significant effects
• The right to appeal a denial of a rights request

To exercise these rights, please contact us at privacy@cartemedical.com. We will verify your identity before responding. If we deny your request, you may appeal by contacting us at the same address.

We do not engage in targeted advertising, sale of personal information, or automated decision-making that produces legal or similarly significant effects on you.