HIPAA and your Arclo website
A practice website isn't an EHR, but it touches protected information the moment someone types their name into a form. This page says exactly what Arclo does with that, and what it never does.
We sign a BAA with every practice, on every plan
Before your site goes live, Arclo signs a Business Associate Agreement with your practice. It is included with Run and Grow; there is no add-on, tier or upcharge for it.
The BAA covers what Arclo actually handles: the website, the new-patient request form on it, the text and email notifications that carry those requests to you, and the lead inbox where they are stored so we can report new versus returning inquiries.
The request form collects four things
Name, phone, email and preferred time. That is the whole form. It does not ask for symptoms, diagnoses, insurance, date of birth or a free-text reason for the visit, because a website does not need any of that to get someone on your calendar.
If you want an additional field, we will talk through whether it belongs on a public website before adding it.
Where an inquiry goes
It is sent to the phone number and email address you choose, and stored in your Arclo lead inbox so you and your team can see who reached out, whether you called back, and whether they booked.
Inquiries are never sold, shared with advertisers, or used to train anything. They exist to get a person to your practice and to show you, in the monthly report, where they came from.
No advertising pixels on appointment or contact pages
Meta, Google Ads, TikTok and similar pixels are never placed on the pages where someone asks for care. Federal guidance on tracking technologies treats a visit to an appointment page as potentially identifying, and we agree.
Site analytics are configured so that form contents are never sent to any analytics tool.
What Arclo never touches
Your scheduling system, your EHR or practice-management software, your clinical notes and your patient records. The "Book online" button on your site points to the scheduling page you already use; the booking itself happens there, under that vendor's own BAA with you.
Arclo has no login to any of those systems and does not ask for one.
Transport and storage
Every page is served over HTTPS. Form submissions travel encrypted from the visitor's browser to Arclo and on to you.
Inquiry records are kept only as long as you are a customer plus the retention period in the BAA, and are deleted or returned to you when you leave.
Your side of it
A BAA is two-way. Three things keep the whole arrangement clean:
- Keep your own BAAs with your scheduler, EHR and phone or email providers in place; Arclo's BAA covers Arclo, not them.
- Don't paste patient details into page content, blog drafts or the change requests you send us.
- Tell us if you add a form field, a chat widget or a pixel yourself so we can check it against this page.