Privacy Policy

Last updated October 14, 2026

Who we are

Golden Leaf Health Center is the name used by two professional medical practices:

• Golden Leaf Naturopathic, PC cares for patients located in California.
• Golden Leaf Health, PC cares for patients located in the other states we serve.

In this policy, “we,” “us,” and “our” mean both practices. Our office is at 1902 Wright Pl., Suite 200, Carlsbad, CA 92008. You can reach us at (760) 542-8898 or [email protected].

What this policy covers

This policy explains how we handle personal information collected through our website, goldenleafhc.com. That includes our online booking system (together, the “Site”). It also covers emails and texts we send you about the Site.

Your medical information is covered separately. Once you become a patient, the health information in your medical record is protected health information under HIPAA. How we use and share it is described in our Notice of Privacy Practices, which takes priority over this policy for that information.

What the website itself loads. For a technical breakdown of what goldenleafhc.com loads and collects as you browse, see Privacy on this site.

Information we collect

Information you give us

• Booking a visit: your name, email address, phone number, the state you are in, and your appointment details.
• Paying: your card details go directly to our payment processor. We do not see or store your full card number.
• Contacting us: anything you include when you call, text, or email us.
• Marketing emails: your name and email address, if you sign up for our newsletter.
• Cancelling your membership online: your name, email address, and, if you choose to give one, your reason.

Information collected automatically

• Technical information. Our Site is delivered through Cloudflare. Like any website, it receives the technical details your browser sends with each request: your IP address, browser and device type, the pages you visit, the time, and the page that referred you. We use this to deliver and protect the Site, and to see overall traffic totals.

• Cookies.

  • Essential cookies keep booking working, for example your place in the booking steps.
  • Security cookies are set by Cloudflare to tell people from automated bots.
  • Browser storage. If you start your intake form, our booking page saves your first name and a resume code in your browser’s local storage, so you can come back to the form on the same device. It does not store your answers. We clear it when your intake is complete, and you can clear it yourself with the “Start over” button or in your browser settings.

  We do not use cookies for advertising.

Information from others

When you become a patient, we may receive information from labs, pharmacies, and other providers involved in your care. That information is part of your medical record and is covered by our Notice of Privacy Practices.

How we use information

We use personal information to:

• book, confirm, and remind you about visits;
• provide care, when you become a patient (see our Notice of Privacy Practices);
• take payments and manage your membership;
• answer your questions and provide support;
• send the emails and texts you have asked for, including appointment reminders and care-team check-ins;
• send our newsletter, if you have signed up (you can unsubscribe at any time using the link in any email);
• keep the Site secure, prevent fraud, and fix problems; and
• meet our legal obligations.

Health information and advertising

We do not sell your personal information. We do not share information about your health, your symptoms, or your visits with advertising platforms. We do not use advertising pixels or tracking tools on our booking pages or patient pages.

Who we share information with

We share personal information only with the service providers who help us run the Site and our practice. Each is contractually limited to using it for us. Where a service provider handles protected health information, we have a Business Associate Agreement with them as HIPAA requires.

Service provider	What they do for us
Cloudflare	Delivers and protects the Site
Zoho	Hosts our booking system, intake forms and appointment emails
Google Workspace	Video visits (Google Meet) and email
Our payment processor	Processes payments for visits and membership
CharmHealth	Patient portal and electronic health records
OhMD	Secure text messaging with your care team
Fullscript	Optional supplement ordering, if you choose to use it
Mailchimp	Marketing emails, only if you sign up. Mailchimp receives your name and email address, never your health information.

We may also disclose information when the law requires it, to protect the rights, property, or safety of our patients, staff, or others, or as part of a merger, sale, or transfer of our practice. In a transfer, the information stays protected by this policy.

Your privacy choices

• Marketing emails: unsubscribe using the link in any marketing email, or contact us. You are added to our marketing list only if you sign up. Being a patient doesn’t add you.
• Texts: reply STOP to any text to stop receiving texts. If you stop texts, your care team will call you for check-ins instead.
• Cookies and browser storage: you can block or delete cookies and site data in your browser settings. If you block essential cookies, booking may not work.
• Do Not Track and Global Privacy Control: we do not sell or share personal information for targeted advertising, so there is nothing to opt out of. Your browser signals are not needed to protect you on our Site.

Your rights

Depending on where you live, you may have the right to:

• know what personal information we hold about you and get a copy of it;
• correct information that is wrong;
• ask us to delete your information; and
• withdraw consent you have given us.

For the health information in your medical record, your rights (including access and amendment) are set out in our Notice of Privacy Practices. We may need to keep some information to meet legal or medical record-keeping requirements.

How to make a request. Email [email protected], call (760) 542-8898, or write to us at the address above. We will verify your identity before acting on a request, and respond within the time the law requires. If we deny your request, you can appeal by replying to our decision. We will respond to your appeal in writing.

We will not treat you differently for exercising your privacy rights.

Consumer health data (Washington, Nevada and Connecticut)

Some states protect “consumer health data”: information that identifies you and relates to your health, such as a record that you looked into or booked menopause care. This applies even before you become a patient. Once you are a patient, information in your medical record is covered by HIPAA and our Notice of Privacy Practices instead.

• What we collect: the booking and contact information described above, including that you booked a menopause-care visit, and the state you are in.
• Where it comes from: directly from you when you book or contact us.
• Why: to schedule and provide the visit you asked for, take payment, and contact you about it.
• Who we share it with: only the service providers listed above, for those purposes. We do not sell consumer health data, and we do not share it with advertising platforms.
• Your rights: you can confirm whether we collect your consumer health data, get a list of the third parties we shared it with, ask us to delete it, and withdraw your consent. Use the contact details above. You can appeal a decision as described under “Your rights.”

How long we keep information

We keep personal information only as long as we need it for the purposes above, or as long as the law requires. Medical records are kept for the periods state law requires for the state where you received care. Newsletter subscriptions are kept until you unsubscribe.

Security

We use administrative, technical, and physical safeguards to protect personal information, including the safeguards HIPAA requires for health information. No method of transmission over the internet or of electronic storage is completely secure, so we cannot guarantee absolute security.

Children

Our services are for adults. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us personal information, contact us and we will delete it.

Changes to this policy

We may update this policy. We will change the “Last updated” date above. For significant changes, we will also post a notice on the Site or email you before the change takes effect.

Contact us

Golden Leaf Health Center (Golden Leaf Naturopathic, PC and Golden Leaf Health, PC) 1902 Wright Pl., Suite 200 Carlsbad, CA 92008 (760) 542-8898 [email protected]