DoorStep Urgent Care

Patient Portal Privacy Policy

Effective date: June 1, 2023
Last updated: October 1, 2026
Legal entity: DoorStep Enterprises Inc., doing business as DoorStep Urgent Care

In this policy

1. About this policy

2. Your portal account

3. Information we collect

4. How we use information

5. How we share information

6. Text messages and video calls

7. Cookies and information on your device

8. How we protect information

9. How long we keep information

10.  Your health information rights

11. Children and access to their information

12. Changes to this policy

13. Contact us

​

1. About this policy

DoorStep Urgent Care ("DoorStep," "we," "us," or "our") respects your privacy. This policy explains how we collect, use, share, and protect information through our patient portal at https://patient.doorstepuc.com and related appointment communications.

 

The portal is used by patients and by parents, legal guardians, and caregivers authorized to access a patient’s information. This policy covers your contact and account information and patient information available through the portal. It does not describe the privacy practices of our public website or unrelated third-party websites.

 

Health information held by DoorStep is also protected by the Health Insurance Portability and Accountability Act (HIPAA) and applicable law. This portal policy summarizes certain privacy rights but does not replace our separate HIPAA Notice of Privacy Practices. Contact our Privacy Officer to request that notice.

 

2. Your portal account

DoorStep staff create your contact record when arranging care. This record includes your name, mobile phone number, and, if provided, email address. You verify control of the phone number on file to access your account. There is no public account registration.

 

You may choose to link an available Google, Facebook, or Microsoft account to help you sign in. Linking an account is optional. We receive basic account information, such as an account identifier, email address, and display name. We do not store the password or access and refresh tokens for that outside account. A one-time code sent to your phone is still required. You may disconnect a linked account in the portal.

Please tell us promptly if your phone number changes or you no longer control it.

 

3. Information we collect

Contact and patient information. We collect names, contact details, dates of birth, service addresses, insurance information, and your relationship to patients whose records you are authorized to access.

Appointment and care information. We collect appointment details and status, location information needed to route our mobile clinic, symptoms, tests, results, clinical notes, and care outcomes.

 

Clinical images and recordings. During an examination, clinicians may capture photographs, audio, or video to document findings and support physician review. These may include examination videos, ear images, and heart or lung sounds. These materials form part of the patient’s care record.

 

Communications. We retain appointment text messages and information about care-related calls, including participants, call times, duration, and clinician notes. We do not record the audio or video of live pre- or post-appointment portal calls. Clinical recordings made during an examination are different from live portal calls.

 

Technical and security information. We collect information such as your IP address, browser type, sign-in activity, and records of access to the portal to operate the service, protect information, and investigate security issues.

 

4. How we use information

We use information to arrange and deliver care; route our mobile clinic; communicate about appointments; support clinical review and follow-up; verify your identity; process insurance and payment; operate, maintain, and improve our service; and meet legal and regulatory obligations.

 

We do not sell information collected through the patient portal, share it for advertising, or use it for marketing. We do not use advertising networks, marketing pixels, third-party analytics, or session-replay tools in the patient portal, and we do not track portal users across other websites.

 

5. How we share information

Care teams and authorized contacts. DoorStep clinical and scheduling staff access information according to their responsibilities. Other contacts authorized for the same patient or appointment may see relevant patient information and the identities of other associated contacts. Being listed as a caregiver does not automatically give someone all of a patient’s legal privacy rights.

 

Service providers. We use service providers for text messaging, maps and routing, hosting, file storage, and optional account sign-in. Our providers include Twilio, Google Maps Platform, Google Cloud Platform, Microsoft, and Meta (Facebook). We share information needed for the service being provided. When a provider acts as a business associate handling protected health information, HIPAA requires appropriate contractual protections.

 

Optional account providers receive information associated with the sign-in process. Their handling of information is also governed by their own privacy policies.

 

Other permitted disclosures. We may use or share health information for treatment, payment, and health care operations as permitted by law. We may also disclose information when legally required or permitted, including for public health reporting, reporting suspected abuse or neglect, responding to qualifying legal process, or addressing a serious and imminent threat to health or safety. Additional details and limits are described in our HIPAA Notice of Privacy Practices.

 

When your written authorization is required, we will obtain it before using or disclosing your health information. You may revoke an authorization in writing, except to the extent we have already relied on it.

If our business is transferred or reorganized, information may be transferred as permitted by law and remains subject to applicable privacy protections.

 

6. Text messages and video calls

We send text messages about appointments and portal access. Messages may identify DoorStep Urgent Care and direct you to open the portal. Text messages travel through mobile networks outside our control and may be visible on your phone’s lock screen or to others who can access your device.

 

Live portal video and audio calls use encrypted connections. We retain call activity and clinician notes, but do not store recordings of these live calls. Contact us if you need a different way to receive communications.

 

7. Cookies and information on your device

The portal uses a necessary session cookie and temporary browser storage to keep you signed in and display appointment information. These are retained for up to 24 hours and cleared when you sign out. We do not use advertising or analytics cookies in the portal.

 

If you use a shared device, select Sign Out when finished. Closing the browser tab does not necessarily clear information stored by the portal.

 

8. How we protect information

We use administrative, technical, and physical safeguards designed to protect information. These include encrypted connections, identity verification, limits on staff access, and monitoring of system access.

 

No system can guarantee complete security. If a breach requires notification under HIPAA or other applicable law, we will notify affected individuals as required.

 

9. How long we keep information

We retain medical, appointment, and related account records according to applicable law and our record-retention policies. Different retention periods may apply to children’s records, security records, and other information.

 

You may request corrections or ask about deleting account information. We may need to retain medical records and other information to meet legal obligations. Disconnecting a linked sign-in account or requesting deletion of its associated data does not automatically delete a patient’s medical record.

 

10. Your health information rights

Under HIPAA, you generally have the right to request access to and copies of your health information; request a correction; request an accounting of certain disclosures; request limits on certain uses or disclosures; request confidential communications; and receive a paper copy of our Notice of Privacy Practices.

 

These rights are subject to applicable requirements and exceptions. We are not required to agree to every requested restriction. However, when you pay in full out of pocket for an item or service, we must honor a qualifying request not to disclose information about it to your health plan for payment or health care operations, unless disclosure is required by law.

 

A legally authorized personal representative may exercise applicable rights on a patient’s behalf. We may verify the representative’s identity and legal authority.

 

To make a privacy request, contact our Privacy Officer. We will respond as required by applicable law. Additional rights may apply under state law.

 

If you believe your privacy rights have been violated, you may complain to our Privacy Officer or to the U.S. Department of Health and Human Services, Office for Civil Rights, at https://www.hhs.gov/ocr/complaints/, by calling 1-877-696-6775, or by writing to 200 Independence Avenue SW, Washington, DC 20201. We will not retaliate against you for filing a complaint.

 

11. Children and access to their information

The patient portal is intended for users age 18 or older. We do not knowingly create portal accounts for children or collect information online directly from children under 13.

 

A parent or legal guardian generally may access a minor child’s records and exercise privacy rights on the child’s behalf. Exceptions may apply when a minor can consent to certain services under applicable law, when another person has authority to consent, or when access could endanger the child. We manage access according to applicable law and the authority of the person requesting it.

 

12. Changes to this policy

We may update this policy to reflect changes in our services, practices, or legal obligations. Updated versions will be posted at [Privacy policy URL] with a revised effective date. If a change materially affects how we handle your information, we will notify you by text message or email before it takes effect.

 

Updates to this policy do not replace consent or authorization when either is required by law. Changes to our HIPAA Notice of Privacy Practices are handled as described in that notice.

 

13. Contact us

For privacy questions, requests, or complaints, contact:
Privacy Officer
DoorStep Enterprises Inc., doing business as DoorStep Urgent Care
4532 Plank Rd., Fredericksburg, VA 22407

Email: info@DoorStepUC.com
Phone: 540-472-4050

 

For requests concerning information associated with a linked Facebook account, you may contact us directly or use Facebook’s available data-deletion request process.

DoorStep Urgent Care | Patient Portal Privacy Policy