Privacy Policy
Bella Vision Corporation, doing business as Bella Vision USA ("Bella Vision," "we," "us," or "our"), respects your privacy. This Privacy Policy explains how we collect, use, and protect information when you visit bellavisionusa.com (the "Site") and interact with our online services.
This policy covers the website only. Protected Health Information (PHI) collected during your eye care visits is governed by our separate HIPAA Notice of Privacy Practices, which is provided at the time of service and available at any of our offices.
Information we collect
As of the effective date of this policy the Site has one form: the appointment request on the appointment page. It asks for your first and last name, date of birth, phone number, email address, how you would like us to reach you, whether you are a new or returning patient, what the visit is for (chosen from a short list), which office you prefer, up to three preferred days and times of day, an optional note, and — if you have vision insurance — the name of your carrier, your member or subscriber ID, and the primary insurance holder’s name and date of birth. It never asks for a government ID number, and there is no field for one. What you send travels over an encrypted connection directly to our practice’s appointment system, which is operated for us under a HIPAA Business Associate Agreement, and not to this website’s host; the host never receives or stores it. Our practice may also send the office an email notice that a request has arrived. Our front desk uses the request to reach you, confirm the visit, and verify your benefits; the request is deleted from that system automatically seven days after you send it, whether or not we reached you. Appointments can also be booked by phone or through our online scheduler, a page hosted by our electronic health record vendor; information you enter there goes to your patient record under our HIPAA Notice of Privacy Practices, not to this website.
Apart from the appointment request described above, the only information the Site collects is standard server log data — browser type, device, IP address, referring page, and pages visited — recorded by our host for analytics and security. We do not use it to identify you.
How we use information
- To keep the Site running, secure, and free of abuse
- To understand how visitors use the Site and improve it
- To meet legal and regulatory obligations
When you call an office to book, or book through our online scheduler, whatever you tell us becomes part of your patient record. It is handled under our HIPAA Notice of Privacy Practices, not under this website policy. An appointment request is used for one purpose: to reach you, confirm the visit, and verify your insurance benefits for it.
Who we share information with
We do not sell your information. We share information only with service providers that help us operate the Site and our practice, including:
- Our electronic health record platform (Eyefinity Encompass / ModMed)
- Our practice’s appointment system, which receives the appointment request and is operated for us under a HIPAA Business Associate Agreement
- Website hosting and server logs (Netlify), and email (Google Workspace)
- Practice management and billing software (QuickBooks)
- Insurance carriers, when verifying eligibility for a scheduled visit
Each of these providers is bound by contract to use information only as needed to deliver their service. Our website host is not a HIPAA business associate, and that is why the appointment request is sent to our practice’s own system rather than to the host: the host never receives or stores what you type into it. Protected Health Information belongs in the practice systems that operate under a HIPAA Business Associate Agreement with us, not on this website; HIPAA requires such an agreement with any vendor that handles it on our behalf.
Cookies and tracking
The Site uses only the essential cookies needed for basic functionality. The appointment request sets no cookies. We do not use advertising cookies and we do not sell browsing data to advertisers. Most browsers let you block cookies in their settings.
Data retention
An appointment request is kept in our practice’s appointment system for seven days from the moment you send it and is then deleted automatically, whether or not we reached you. If we book a visit, the appointment and any insurance details we verified live in your patient record under our HIPAA Notice of Privacy Practices, not in the request. Nothing else you do on the Site creates a record for us to keep. Server logs are kept briefly for security and troubleshooting.
About information submitted through the former appointment request page. This Site previously offered an appointment request page where you could send us your details. That page was retired under our compliance review, and the request described above replaced it; the new request is sent to our practice’s own system and never to the website host. Retiring the old page did not delete what was sent earlier: information submitted through it still exists in our website host's records and in our practice email. The form record at our website host is being closed under our compliance process; until that is complete, previously submitted information remains in the host's records. If you sent us information that way and would like to know what we hold, or would like it deleted, please contact us using the details below. We will respond subject to legal record-keeping requirements.
Health information collected when you book, by phone or through the online scheduler, or visit an office is retained per Washington State and federal HIPAA requirements.
Security
We use industry-standard security measures, including encrypted connections (HTTPS) and access controls. The appointment request is limited to the fields listed above, travels over an encrypted connection straight to our practice’s own system, is never stored by the website host, and is deleted after seven days.
Your choices
- You may request a copy of the information we have about you
- You may ask us to correct or delete it, subject to legal record-keeping requirements
- You may opt out of non-essential communications at any time by replying to the message or contacting us directly
Children
The Site is not directed at children under 13, and we do not knowingly collect information from children under 13 through the Site. Pediatric eye care for our patients is handled in person, with parent or guardian involvement, under HIPAA.
Changes to this policy
We may update this Privacy Policy from time to time. The "Effective" date at the top reflects the most recent version. Material changes will be noted on the Site.
Contact us
Questions about this policy? Reach out to us at our headquarters office:
Bella Vision USA8862 161st Ave NE Ste 105
Redmond, WA 98052
(425) 881-6655
bellavisionusa.com