Privacy Policy & Notice of Privacy Practices

Who we are

Miami Skin Center, PLLC ("Miami Skin Center," "we," "our," or "us") is a dermatology and Mohs surgery practice located at 299 Alhambra Circle, Suite 211, Coral Gables, FL 33134. This Privacy Policy explains how we collect, use, share, and protect information when you visit miamiskincenters.com, contact us through our website, message us on Instagram or Facebook, or interact with our practice in person.

This document also serves as our HIPAA Notice of Privacy Practices for Protected Health Information (PHI). We are committed to safeguarding patient information in accordance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and Florida law.

Information we collect

We only collect the minimum information needed to communicate with you, schedule care, and operate our practice. Depending on how you interact with us, this may include:

• Contact information you provide on our website (name, email address, phone number, language preference, the message you send us, and the page you submitted from).
• Messages and metadata exchanged with us through Instagram Direct Messages, Facebook Messenger, or comments on our Instagram or Facebook posts — including the social handle, profile name, profile picture, the conversation thread, and timestamps. We receive this information from Meta when you message or comment on our verified business accounts.
• Appointment, treatment, billing, and clinical information collected during in-office or telehealth visits.
• Limited technical information automatically collected when you visit our website: IP address, browser type, device type, referring URL, pages viewed, and time on page. We use Google Analytics for aggregate site analytics only after you accept cookies.
• Optional information you choose to send us, such as photographs of a skin concern, that you attach to a website inquiry or social-media message.

How we use your information

We use the information described above only for the following purposes:

• To respond to your messages, schedule appointments, follow up after visits, and provide the dermatologic care you request.
• To triage and route patient inquiries received on Instagram and Facebook to the correct member of our practice team. Inbound and outbound messages may be reviewed and drafted with the help of internal AI tooling (see "AI-assisted communication" below).
• To bill for services rendered, work with your insurance carrier, and comply with our healthcare obligations.
• To send appointment confirmations, reminders, recovery instructions, or general clinic announcements you have opted in to.
• To improve the safety, performance, and accuracy of our website and internal practice tools.
• To comply with applicable federal, state, and professional-licensing law.

AI-assisted communication

To answer patient questions promptly, our internal practice-management dashboard uses Anthropic's Claude large language model to help draft replies to inbound messages on Instagram, Facebook, email, and our website contact form. AI-drafted replies are reviewed by a member of our team before they are sent unless you have explicitly opted in to automated replies. Conversation content sent to Anthropic is processed under a business agreement that prohibits training on our data and prohibits storage beyond what is required to generate the response. We do not share photographs or clinical records with any third-party AI system. We never sell your data and never share it with advertisers.

When we share information

We do not sell or rent your information. We share it only when one of the following applies:

• With members of our care team, our billing service, and other healthcare providers involved in your treatment, as permitted by HIPAA.
• With service providers that help us operate (for example: secure cloud hosting on Microsoft Azure in the United States, HIPAA-compliant email delivery, scheduling, payment processing, telephony, and Anthropic for AI-assisted message drafting). These providers are bound by written agreements that limit their use of your information to providing the service.
• With Meta Platforms, Inc., only to the extent necessary to receive and respond to your Instagram or Facebook messages. We do not share patient information with Meta beyond what Instagram or Facebook already has from your interaction with our business profiles.
• When required by law, subpoena, or court order, or to protect the safety of patients, staff, or the public.

Where and how your data is stored

Patient communication, contact information, and conversation history are stored in an encrypted Azure PostgreSQL database located in the United States. All data is encrypted both in transit (TLS 1.2+) and at rest (AES-256). Access is restricted to authorized members of the Miami Skin Center practice team and is protected by multi-factor authentication. We do not host our database outside of the United States.

How long we keep your data

• General website inquiries and social-media conversations: up to 36 months after the last interaction, unless you ask us to delete them sooner.
• Patient medical records: retained for the period required by Florida law (currently a minimum of 5 years after the last patient encounter for adult patients; longer for minors). Medical records cannot be deleted on request — see "Right to deletion" below.
• Marketing analytics: aggregated and anonymized after 14 months.

Your rights

You have the right to:

• Ask us what information we have about you and request a copy.
• Ask us to correct information that is inaccurate.
• Ask us to delete non-medical information we hold about you (see the data deletion page for details).
• Withdraw consent to non-essential cookies at any time by clearing cookies in your browser.
• Restrict the way we use certain information.
• File a complaint with us, with the U.S. Department of Health and Human Services Office for Civil Rights, or with the Florida Department of Health.

These rights apply to most non-medical data. Records covered by HIPAA may have additional protections and exceptions — for example, we are required by Florida law to retain medical records for a minimum period and cannot fully delete them on request.

Right to deletion

To request deletion of the data we hold about you — including conversation history from Instagram, Facebook, email, or our website contact form — please visit our data deletion page or email info@miamiskincenters.com with the subject line "Data Deletion Request." We respond to all valid requests within 30 days.

Children's privacy

Our website is not directed at children under 13, and we do not knowingly collect personal information from children under 13 through our website or social-media channels without parental consent. Pediatric patients treated at the practice are handled in accordance with HIPAA and applicable Florida law.

Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last reviewed" date at the top of this page. Material changes will be highlighted on our website and, where required by HIPAA, communicated to active patients.

How to contact us

If you have questions about this Privacy Policy, want to exercise a right above, or want to file a complaint, please contact our HIPAA Privacy Officer:

info@miamiskincenters.com(305) 615-5504299 Alhambra Circle, Suite 211, Coral Gables, FL 33134

You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights at hhs.gov/ocr/complaints.