Great Heights Medical

Privacy Policy

Last updated: April 5, 2026

Great Heights Medical ("we," "us," or "our") is committed to protecting the privacy and security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, use our services, or interact with our practice.

By using our website or services, you consent to the practices described in this policy.

1. Information We Collect

Personal Information

We may collect the following personal information:

  • Contact information: name, email address, phone number, mailing address
  • Demographic information: date of birth, gender
  • Insurance information: insurance provider, policy number, group number
  • Health information: medical history, treatment records, body composition data (Styku scans), lab results, and vaccination records
  • Immigration-related information: data required for Form I-693 completion

Automatically Collected Information

When you visit our website, we may automatically collect:

  • IP address and browser type
  • Pages visited and time spent on pages
  • Referring website or source
  • Device type and operating system
  • Interaction data with calls-to-action (button clicks, form submissions, phone clicks) via Google Analytics (GA4)

2. How We Use Your Information

We use your information to:

  • Provide and manage your medical care and treatment plans
  • Process appointments, including scheduling via our third-party booking platform (Calendly)
  • Conduct diagnostic services including Styku 3D body composition scans and Digbi Health gut microbiome/DNA analysis
  • Complete USCIS Form I-693 immigration physical exams
  • Communicate with you about your care, appointments, and results
  • Process billing and insurance claims
  • Improve our website and services through anonymized analytics
  • Comply with legal and regulatory obligations

3. How We Share Your Information

We do not sell, rent, or trade your personal or health information. We may share information with:

  • Healthcare partners: Digbi Health (for microbiome/DNA analysis), laboratories, and referral providers — only as necessary for your care
  • Government agencies: USCIS (for immigration physicals) and public health authorities as required by law
  • Insurance companies: for billing and claims processing
  • Service providers: third-party platforms that support our operations (e.g., Calendly for scheduling, Google Analytics for website analytics) under contractual data protection obligations
  • Legal requirements: when required by law, court order, or to protect the safety of our patients or staff

4. Cookies and Tracking Technologies

Our website uses:

  • Essential cookies: required for website functionality
  • Analytics cookies: Google Analytics (GA4) to understand website usage patterns and improve user experience

You can control cookies through your browser settings. Disabling cookies may affect website functionality.

5. Data Security

We implement administrative, technical, and physical safeguards to protect your information, including:

  • Encrypted data transmission (SSL/TLS) on our website
  • Secure storage of electronic health records
  • Access controls limiting information to authorized personnel
  • Regular security assessments and staff training

For health information, we comply with HIPAA security standards. See our HIPAA Compliance Notice for details.

6. Your Rights

Under HIPAA

As a patient, you have the right to:

  • Access and obtain copies of your health records
  • Request corrections to your health information
  • Request restrictions on certain uses or disclosures
  • Receive an accounting of disclosures of your health information
  • File a complaint if you believe your privacy rights have been violated

Under GDPR (for EU/EEA visitors)

If you are located in the European Economic Area, you have the right to:

  • Access the personal data we hold about you
  • Rectify inaccurate or incomplete data
  • Erasure ("right to be forgotten") of your personal data
  • Restrict or object to processing of your data
  • Data portability — receive your data in a structured format
  • Withdraw consent at any time where processing is based on consent
  • Lodge a complaint with a supervisory authority

To exercise any of these rights, contact us using the details below.

7. Data Retention

We retain personal and health information for as long as required to provide your care and comply with legal obligations. Medical records are retained in accordance with Illinois state law and HIPAA requirements. Website analytics data is retained in anonymized form.

8. Children's Privacy

Our website is not directed to children under 13. We do not knowingly collect personal information from children under 13 through our website. Medical services for minors are provided with parental or guardian consent.

9. Third-Party Links

Our website may contain links to third-party websites (e.g., Calendly, Digbi Health). We are not responsible for the privacy practices of these external sites. We encourage you to review their privacy policies.

10. Changes to This Policy

We may update this Privacy Policy periodically. Changes will be posted on this page with an updated "Last updated" date. Continued use of our website or services after changes constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, contact us: