Privacy Policy

Last Updated

May 5, 2026

Applies to

The Delight Dental Group website only. Patient health records are governed separately by our Notice of Privacy Practices (HIPAA).

Contact

(916) 790-8755  ·  [email protected]  ·  1625 Creekside Dr. Suite 100, Folsom, CA 95630

Notice at Collection

Under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA, Cal. Civ. Code § 1798.100 et seq.), businesses are required to give consumers a Notice at Collection at or before the point at which personal information is collected. The following is a summary of that notice; full details appear in the sections below.

• Categories collected: Identifiers, customer records, internet / network activity, approximate geolocation, and inferences. See Section 2 for the complete list.
• Purposes: Schedule and confirm appointments, respond to inquiries, improve website performance, maintain security, and comply with applicable law.
• Retention: Varies by data type — see Section 8.
• Sale / sharing: We do not sell or share your personal information as those terms are defined under the CCPA/CPRA.
• Sensitive personal information: Not collected through this website.
• Your rights: California residents may request to know, delete, correct, or obtain a portable copy of their personal information, and may opt out of sale or sharing. See Section 14.

Categories of Personal Information We Collect

The following categories of personal information, as enumerated in Cal. Civ. Code § 1798.140(v), are collected through this website:

Category A — Identifiers

Name, email address, and phone number (when you submit a contact or appointment request form); IP address (collected automatically by our web server and analytics service on every page load).

Category B — Customer Records (Cal. Civ. Code § 1798.80(e))

Information you voluntarily enter into web forms — such as your name and phone number — that constitutes a "customer record." We do not collect payment card numbers, bank account numbers, Social Security numbers, or insurance policy numbers through this website.

Category F — Internet or Other Electronic Network Activity

Browsing behavior on our website (pages visited, links clicked, time spent on page), browser type and version, operating system, device type, and referring URL. Collected automatically by our web server logs and by Google Analytics 4.

Category G — Geolocation Data

Approximate geographic location at city/region level, derived from your IP address by Google Analytics. We do not collect or request precise GPS coordinates from your device.

Category K — Inferences

Aggregate inferences drawn from internet activity data to understand usage patterns and improve the website (e.g., which pages are most frequently visited, what devices are most common). These inferences are used solely for website analytics and do not relate to personal characteristics, preferences, or health.

Sensitive Personal Information

Sensitive personal information as defined in Cal. Civ. Code § 1798.140(ae) — including government-issued identification numbers, financial account credentials, precise geolocation, racial or ethnic origin, religious beliefs, union membership, contents of mail or email, genetic data, biometric information, health or medical information, and sexual orientation — is not collected through this website.

Patient health information, including all protected health information (PHI) as defined under HIPAA, is handled within the dental practice and is governed exclusively by our Notice of Privacy Practices. The CCPA/CPRA does not apply to HIPAA-regulated PHI.

Sources of Personal Information

We collect personal information from three sources:

• Directly from you — when you complete a contact form, appointment request form, or privacy rights request form on this website.
• Automatically from your device and browser — through web server logs, cookies, and analytics scripts that run when you visit any page of this website.
• Third-party service providers — Google Analytics (aggregated usage statistics), Google Maps (if you interact with the embedded map), and our patient portal / booking vendor (if you begin an appointment booking flow).

Business and Commercial Purposes for Collection

We collect and use personal information for the following purposes:

• To receive, route, and respond to appointment requests and general inquiries submitted through our website forms.
• To send appointment confirmations and reminders, if you have opted in to receive them.
• To measure website traffic, diagnose technical errors, and improve website content, structure, and navigation.
• To maintain the security and integrity of the website and our systems.
• To comply with applicable federal, state, or local law; respond to lawful legal process; and protect the rights, property, and safety of Delight Dental Group, our patients, and the public.
• To evaluate or complete a business transaction such as a merger, acquisition, or sale of assets, in which case the privacy commitments in this policy transfer to any successor entity.

We do not use personal information collected through this website for cross-context behavioral advertising, profiling for automated decision-making that produces legal or similarly significant effects, or for building consumer profiles for sale to third parties.

Categories of Third Parties to Whom We Disclose Personal Information

Service Providers and Contractors

We share personal information with vendors who assist us in operating the website, communicating with patients, and processing privacy rights requests. These vendors include Google (Analytics 4, Maps), our patient portal and appointment booking vendor, JotForm (Do Not Sell / privacy rights forms), and our web hosting and email service providers. Each provider processes personal information only on our behalf and under written contracts that prohibit them from using the data for their own commercial purposes beyond the scope of their service to us.

Government Authorities and Law Enforcement

We may disclose personal information when required by law, subpoena, court order, or valid legal process, or when we have a good-faith belief that disclosure is necessary to protect the safety, rights, or property of Delight Dental Group, our patients, or the public.

Professional Advisors

Attorneys, accountants, auditors, and insurance carriers who are bound by professional confidentiality obligations or written confidentiality agreements.

Successors in Interest

In connection with a merger, acquisition, financing due diligence, reorganization, bankruptcy, or sale of all or part of our assets, in which case the acquiring entity will be required to comply with the commitments made in this Privacy Policy.

Sale and Sharing of Personal Information

Although no sale or sharing occurs, California residents have the right under the CCPA/CPRA to opt out of any future sale or sharing. You may submit an opt-out request at any time through our Do Not Sell My Personal Information page, and we will honor every valid request within 15 business days.

Data Retention

We retain personal information only as long as necessary for the purposes described in this policy, unless a longer retention period is required or permitted by law:

• Contact and appointment request form submissions — 7 years from the date of submission, to align with California statute of limitations periods and practice record-keeping requirements.
• Web server access logs — 90 days, after which they are automatically purged.
• Google Analytics 4 data — 14 months, as configured in our GA4 property data-retention settings.
• Cookie consent preference records — Stored only on your own device as a browser cookie or in localStorage. We do not retain a server-side copy of your consent or refusal.
• Privacy rights request records — 24 months from the date of the request, as required by Cal. Civ. Code § 1798.105(d).

Cookies, Analytics, and Your Choices

We use cookies and similar tracking technologies to operate and improve this website. Cookies are small text files placed on your device by your browser. The following categories apply:

Strictly Necessary Cookies

Required for the website to function. They enable core features such as page navigation, form submission, and security. The website cannot operate properly without them, and they do not require consent. They cannot be switched off in our systems.

Analytics Cookies — Google Analytics 4

We use Google Analytics 4 (GA4) to understand how visitors interact with the website. We have configured GA4 with the following privacy protections:

• IP anonymization is enabled — the last octet of IPv4 addresses and the last 80 bits of IPv6 addresses are masked before any data is stored or processed.
• Google Signals is disabled — no cross-device tracking, demographic reporting, or identity-based audience building.
• Ad personalization is disabled — data collected through our property is not used for Google Ads targeting or remarketing.
• Data retention is set to 14 months.

GA4 cookies include _ga, _ga_[PROPERTY-ID], and _gid. They are first set on page load and persist for up to 2 years (_gid expires after 24 hours).

California opt-out: California residents may opt out of analytics data collection at any time through our Do Not Sell / Opt-Out page. We also honor the Global Privacy Control (GPC) signal: if your browser transmits a GPC opt-out header (Sec-GPC: 1), we treat it as a valid opt-out of sale and sharing under Cal. Civ. Code § 1798.135(e). You may also install the Google Analytics Opt-out Browser Add-on to block GA data collection across all websites.

California vs. EU/EEA model: Unlike the European Union and European Economic Area — where the GDPR and ePrivacy Directive require affirmative opt-in consent before analytics cookies may be set — California law uses an opt-out model. Analytics cookies are set on first page load; California residents may opt out at any time and the opt-out applies prospectively.

Marketing and Advertising Cookies

We currently use no marketing or advertising cookies and do not serve interest-based or retargeted advertising through this website.

Third-Party Services

The following third-party services process personal information in connection with this website. Each operates under its own privacy policy, which we encourage you to review.

• Google Analytics 4 — Website analytics. See above for privacy configuration details. Google's privacy policy: policies.google.com/privacy .
• Google Maps Embed — Interactive map displayed on our Contact and Location sections. Google may receive your IP address and set cookies when the map frame loads. Google's privacy policy: policies.google.com/privacy .
• Patient Portal / Online Booking Vendor — If you initiate an appointment booking through this website, you will interact with our booking vendor's interface. Their separate privacy policy governs all data collected during that flow.
• JotForm — Hosts the interactive form on our Do Not Sell page for submitting privacy rights requests. JotForm's privacy policy: jotform.com/privacy .
• Bill Payment Processor — If you make a payment through our website, your payment card data is processed directly by our payment processor. We do not receive, store, or transmit full payment card numbers. Their separate privacy and security policies govern payment data.

How We Keep Information Secure

We implement reasonable and appropriate administrative, technical, and physical safeguards designed to protect personal information from unauthorized access, use, alteration, and disclosure. Our measures include:

• All data transmitted between your browser and our server is encrypted via TLS (HTTPS). Our site does not serve any pages over unencrypted HTTP.
• Form submissions are transmitted via encrypted channels to our email server and practice management system.
• Access to collected data is restricted to staff who have a legitimate business need.
• Third-party service providers are vetted for security practices and bound by data-processing agreements.
• We review our security controls periodically and update them in response to new risks.

No method of internet transmission or electronic storage is completely secure. If you believe your personal information has been compromised, please contact us immediately at [email protected].

Children's Privacy

This website is not directed to children under 13 years of age, and we do not knowingly collect personal information from children under 13 through this website. If you believe we have inadvertently collected information from a child under 13, please contact us at [email protected] and we will promptly delete that information.

Minor patients of the dental practice must be accompanied by a parent or legal guardian. Health records for minor patients constitute HIPAA-protected PHI and are governed by our Notice of Privacy Practices, not this Privacy Policy.

Your California Privacy Rights

California residents have the following rights under the CCPA/CPRA (Cal. Civ. Code § 1798.100 et seq.):

1. 1 Right to Know — You may request disclosure of: the categories and specific pieces of personal information we have collected about you; the categories of sources; the business or commercial purposes for collecting it; and the categories of third parties to whom we have disclosed it.
2. 2 Right to Delete — You may request that we delete personal information we have collected about you, subject to exceptions such as information needed to complete a transaction, detect security incidents, comply with a legal obligation, or exercise free speech rights.
3. 3 Right to Correct — You may request that we correct inaccurate personal information we maintain about you, taking into account the nature and purposes for which it is processed.
4. 4 Right to a Portable Copy — You may request that we provide a copy of the personal information you provided to us in a portable, readily usable format that allows you to transmit it to another entity without hindrance, to the extent technically feasible.
5. 5 Right to Opt Out of Sale or Sharing — You may direct us not to sell or share your personal information. Although we do not currently sell or share personal information, you may submit an opt-out request at our Do Not Sell page. We will honor it within 15 business days.
6. 6 Right to Limit Use of Sensitive Personal Information — You may direct us to use and disclose your sensitive personal information only for purposes specifically enumerated in Cal. Civ. Code § 1798.121. As noted above, we do not collect sensitive personal information through this website. Health information is governed by HIPAA rather than this right.
7. 7 Right Not to Be Discriminated Against — We will not deny you services, charge a different price, or provide a different quality of service because you exercised any right described on this page.

How to Submit a Privacy Rights Request

To submit a request to know, delete, correct, obtain a portable copy, or opt out of sale / sharing, use any of the following methods:

• Online form (preferred): Do Not Sell / Privacy Rights Request
• Email: [email protected] with the subject line "California Privacy Request"
• Phone: (916) 790-8755
• Mail: Delight Dental Group, Attn: Privacy Officer, 1625 Creekside Dr. Suite 100, Folsom, CA 95630

How We Verify a Request

To protect your personal information from unauthorized access or deletion, we must verify your identity before processing any request to know specific pieces of information or to delete data. Our verification process:

• We match the name, email address, and phone number you provide against information already on file.
• For requests to know specific pieces of personal information or to delete data, we may ask you to provide a signed declaration under penalty of perjury stating that you are the consumer whose personal information is at issue.
• We will not require you to create an account as a condition of exercising any privacy right.
• If we cannot verify your identity with reasonable certainty, we will notify you and explain why we cannot fulfill the request.

Authorized Agents

A California resident may designate an authorized agent to submit a CCPA/CPRA privacy rights request on their behalf. To do so, please provide written authorization signed by you, authorizing the specific agent to act on your behalf. We may, as permitted by law, still require you to verify your own identity directly with us even when using an authorized agent, in order to protect against fraudulent requests.

Response Time

Upon receiving a verifiable consumer request, we will:

• Confirm receipt within 10 business days, describing how we will process the request.
• Respond substantively within 45 calendar days of receipt.
• If we need additional time, we will notify you within the initial 45-day period and provide a reason for the extension. Responses may be extended up to a total of 90 calendar days from the date of the original request.

Responses are provided free of charge unless a request is excessive, repetitive, or manifestly unfounded — in which case we may charge a reasonable fee or decline to respond, with a written explanation of our reasons.

Information Governed by HIPAA, Not CCPA/CPRA

This Privacy Policy covers only personal information collected through this website. It does not cover protected health information (PHI) created, received, maintained, or transmitted by Delight Dental Group in connection with providing dental care services.

PHI is governed exclusively by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and our separate Notice of Privacy Practices. Under HIPAA, PHI is exempt from the CCPA/CPRA (Cal. Civ. Code § 1798.145(c)(1)). To understand your rights regarding your dental health records, please review:

Download Notice of Privacy Practices (PDF)

Text-Message (SMS) Communications

If you provide your mobile number and consent to receive SMS messages from us (for example, appointment reminders or recall notifications), the following terms apply:

• Reply STOP at any time to unsubscribe. We will send a single confirmation text and will not send further messages.
• Reply HELP for assistance. You may also contact us by phone or email using the information in this policy.
• Message and data rates may apply. Message frequency varies.
• We do not share your mobile phone number with third parties for their own marketing or promotional purposes.
• SMS consent obtained at the time you provide your number is not shared with any third party except as required by law.

Links to Other Websites

This website contains links to third-party websites, including our patient portal, financing partners, insurance carriers, and review platforms. Once you navigate away from our website, this Privacy Policy no longer governs. We encourage you to review the privacy policy of any third-party website you visit. We are not responsible for the privacy practices or content of linked websites.

Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will update the "Last Updated" date at the top of this page and note the nature of changes prominently. We encourage you to review this policy from time to time. Your continued use of the website after an updated policy is posted constitutes acceptance of the changes.

Contact Us

For questions, concerns, or requests about this Privacy Policy or your personal information, contact our Privacy Officer: