Privacy Policy

The Delightful MD website is owned by Kristine Tsai, MD, which is a data controller of your personal data.

We have adopted this Privacy Policy, which determines how we are processing the information collected by The Delightful MD, which also provides the reasons why we must collect certain personal data about you. Therefore, you must read this Privacy Policy before using The Delightful MD website.

We take care of your personal data and undertake to guarantee its confidentiality and security.

Personal information we collect:

When you visit The Delightful MD, we automatically collect certain technical information about your device, including details about your web browser, IP address, time zone, and standard functional cookies required to keep our site secure. As you browse the Site, we also collect information about the individual web pages or retail products you view, what websites or search terms referred you to us, and how you interact with the Site. We refer to this automatically-collected data as “Device Information.”

Additionally, we collect personal data depending on how you interact with our services:

• Retail Purchases: If you purchase a physical book on our Site, we collect the personal data you voluntarily provide to fulfill your order. This includes your Name, Surname, Shipping Address, Billing Address, and Payment Token Information (processed securely via our third-party merchant processor; we do not store raw credit card numbers on our servers).

• Secure Medical Consulting Intake: If you utilize our one-time medical organizer consulting services, your personal details, contact information, demographics, medical histories, medication lists, lab results, and any sensitive health records you choose to provide are collected exclusively through our separate, secure, HIPAA-compliant FormHippo intake link. This health data is strictly firewalled from our standard retail store infrastructure.

• Online Appointment Scheduling: If you book a consultation or DPC appointment using our embedded calendar, we collect your Name, Contact Information, Appointment Date/Time, and Reason for Visit. This data is entered directly into CharmHealth’s secure infrastructure and does not touch our website host servers.

• Inquiries and Communication: If you contact us directly via email (info@thedelightfulmd.com) or a general website contact box, we collect your Email Address, Name, and any text you provide. We explicitly discourage the submission of sensitive personal or clinical context through these unencrypted channels. General inquiries are strictly limited to administrative questions (such as pricing, availability, or technical help), and any clinical details accidentally submitted are handled in accordance with our internal data minimization and security protocols.

How do we process your data?

Our priority is data security and transparency. How we process your data depends entirely on how you interact with The Delightful MD:

• Website Browsing: Information collected automatically from casual visitors is used strictly to identify potential security threats, prevent abuse, and compile anonymous website performance statistics.

• Retail Purchases (Blank Organizer Books): If you purchase a product from our shop, we process your name, shipping address, and payment information solely to fulfill your order and ship your book.

• Healthcare and Consulting Inquiries: If you contact us via email (info@thedelightfulmd.com), we use your details strictly to respond to your request. If you utilize our medical organizer consulting services, your comprehensive health data is processed entirely off-site via our secure, HIPAA-compliant FormHippo pipeline.

You can choose not to provide personal data, but you will not be able to purchase products, use our record organization services, book appointments or contact us directly.

Your Privacy Rights (US & State Law)

We protect consumer privacy in accordance with applicable United States state and federal laws. Because we facilitate medical record organization and medical consulting, any Protected Health Information (PHI) you submit to us through our secure partner channels is strictly governed and protected by the Health Insurance Portability and Accountability Act (HIPAA) and our clinical Notice of Privacy Practices (NPP), rather than standard e-commerce privacy rules.

Information Security & HIPAA Compliance

We maintain rigorous administrative, technical, and physical safeguards to protect your personal and medical information. All sensitive clinical data and files are explicitly isolated from our public website servers.

Our record consulting pipeline relies entirely on end-to-end encrypted networks covered under formal Business Associate Agreements (BAAs) with our vendors (FormHippo and Microsoft OneDrive). While standard internet transmissions carry inherent baseline risks, we deploy industry-standard healthcare-grade encryption (AES-256 bit at rest and HTTPS in transit) to protect your health records from unauthorized access.

Online Appointment Scheduling

We use an embedded calendar provided by CharmHealth to allow you to schedule appointments directly through our website.

• Data Collection & Privacy: When you use this scheduling tool, you are entering your information directly into CharmHealth’s secure, encrypted system. Your health information and personal data are transmitted directly to CharmHealth's secure servers; our website host (Hostinger) does not view, collect, or store your Protected Health Information (PHI).

• Cookie Management: To protect your digital privacy, our website hard-blocks the scheduling framework from running or dropping background session cookies until you explicitly grant permission by clicking the calendar's unlock button.

External Links and Third-Party Platforms

Our Website provides informational text links, file-drop targets, and booking gateways to external digital frameworks to facilitate various levels of retail fulfillment, virtual care, and medical record management.

• Secure Record Intake (FormHippo): For our one-time medical organizer consulting services, we collect client intake information and sensitive medical history files exclusively through a secure, encrypted browser link powered by FormHippo. FormHippo uses strictly necessary session cookies required to safely transmit data. Once submitted, these records are moved to our protected internal storage (Microsoft OneDrive covered by a Business Associate Agreement) and are cleared from the temporary intake gateway history queue.

• Sesame Care: For episodic, on-demand virtual care visits, you may be redirected via an external link to Sesame Care. The Delightful MD operates on the Sesame Care platform strictly as an independent clinical contractor. Sesame Care acts as an independent entity and operates under its own distinct privacy policies. We do not manage, control, or receive data from the tracking pixels, analytical tools, or device cookies deployed by Sesame Care on its proprietary platform.

• CharmHealth: For other Virtual Care consulting patients, additional clinical charting and secure messaging may occur via CharmHealth. Once you navigate away from our informational site to the CharmHealth patient portal page, your data interactions are governed by the CharmHealth Privacy Policy and our formal clinical Notice of Privacy Practices (NPP).

• Book Purchases & Order Fulfillment (Amazon KDP): To purchase our physical or digital blank organizer books, you may be redirected via an external affiliate or product link to the Amazon marketplace. Amazon handles all order processing, payment collection, and shipping under the Amazon Privacy Notice. We do not have access to your financial data, billing details, or Amazon account information.

• Data Firewall Guarantee: No browsing cookies, device information, or retail transaction data collected on this website from our store are ever transferred to, shared with, or mixed with your protected medical files hosted inside FormHippo, Sesame Care, or CharmHealth.

Use of Cookies and Tracking Technologies

Our website uses standard browser 'cookies' and similar session tokens to ensure essential site functionality, security, and a smooth user experience.

• No Protected Health Information (PHI) Tracking: We do not employ third-party marketing trackers, advertising pixels, or analytics behaviors that tie your web-browsing activities to your personal medical records or specific medical conditions.

• Strictly Necessary / Functional Cookies: The cookies used on this website are strictly limited to necessary administrative purposes (such as site navigation, protecting our website from digital attacks, and loading form elements).

• Third-Party Secure Intake Forms: When you click our link to upload medical records, you are utilizing a secure pipeline hosted by our HIPAA-compliant vendor, FormHippo. FormHippo deposits temporary browser session cookies strictly required to securely process your document drop, verify security tokens, and maintain encrypted data transmission. These structural cookies do not follow you across the internet or track you for marketing purposes.

Legal Disclosure

We will disclose any information we collect, use or receive if required or permitted by law, such as to comply with a subpoena or similar legal process, and when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request.

Use of Contact Information

If you would like to contact us to understand more about this Policy or wish to contact us concerning any matter relating to individual rights and your Personal Information, you may send an email to info@thedelightfulmd.com.