PRIVACY POLICY

1. General provisions and definitions

1.1. This privacy policy (the "Policy") governs the handling of information on the website www.drsalvadorkaplan.com (the "Site") and in communications initiated through it.

1.2. The database owner and data controller is Dr. Salvador Kaplan, a physician licensed by the Ministry of Health (the "Controller"). No company, corporate registration number or registered database number is declared in this document, as none has been confirmed in writing as at the last-updated date.

1.3. "User": any person who browses the Site or communicates through it.

1.4. "Enquirer": a User who has provided contact details in order to receive information or arrange an appointment, and who has not yet received medical care.

1.5. "Patient": a person who has received medical care.

1.6. The Policy has been drawn up in accordance with the Protection of Privacy Law, 5741-1981, including Amendment No. 13, and the Protection of Privacy (Data Security) Regulations, 5777-2017.

1.7. The Policy applies to the Site and to communications initiated through it. It does not apply to third-party sites or services.

2. Nature and operation of the Site

2.1. The Site is an informational and institutional website. It has no database, no user registration system, requests no passwords and processes no payments.

2.2. Data entered into the contact form is not stored on any server belonging to the Site.

2.3. On submission of the form, the WhatsApp application opens on the User's device with the message already composed and containing the details entered. The message is sent only if the User chooses to send it, from their own account.

2.4. The WhatsApp buttons on the Site operate in the same manner: they open a conversation and send nothing automatically.

3. Categories of information

3.1. Information provided at the User's initiative: first name, surname, telephone number and the content of any message the User chooses to write.

3.2. The content of any WhatsApp conversation the User chooses to open or continue, including any health information they choose to share of their own accord.

3.3. Language preference: stored in the User's browser under the key sk_lang. It contains only the selected language and is not transmitted to any server.

3.4. Technical connection data: IP address, user agent and referring page, received, by the ordinary operation of the network, by the services listed in clause 8.

3.5. The Site does not request identity document numbers, health insurance details, financial data or clinical documentation.

4. Source of the information and purposes

4.1. All information comes directly from the person to whom it relates. No contact lists are purchased, rented or received from third parties, and the information is not enriched from external sources.

4.2. The information is used solely for the following purposes:

4.2.1. answering enquiries and arranging appointments;

4.2.2. maintaining the clinical and administrative communication initiated by the Patient;

4.2.3. providing the medical care requested and keeping the clinical documentation arising from it;

4.2.4. retaining the interface language;

4.2.5. maintaining the operation and security of the Site.

4.3. The information is not used for any purpose other than that for which it was provided without prior notice and, where the law so requires, without obtaining the corresponding consent.

5. Voluntary nature of provision

5.1. Providing contact details is voluntary and there is no legal obligation to do so.

5.2. The consequence of not providing them is that the enquiry cannot be answered and an appointment cannot be arranged through this channel.

5.3. In the course of in-person medical care, certain details are necessary in order to provide that care and to comply with the applicable medical documentation obligations.

6. Enquirer and Patient: distinction

6.1. A person who communicates through the Site is, at that stage, a person interested in information about the services. The information provided is used to respond to them and to arrange an appointment, if requested.

6.2. The doctor–patient relationship arises upon the actual provision of medical care. From that moment, in addition to this Policy, the duties of confidentiality and medical documentation laid down by law apply.

6.3. A Patient's medical information is not used for commercial, advertising or segmentation purposes.

7. Health information

7.1. It is not necessary to describe one's state of health in order to request information or arrange an appointment.

7.2. Sending detailed medical information, clinical images or medical documentation by messaging prior to the first consultation is not recommended.

7.3. Health information a Patient chooses to share is covered by the duty of confidentiality described in clause 12 and is not transmitted to advertising or measurement platforms under any circumstances.

8. Third parties involved

8.1. No identifying personal data is sold, rented or disclosed to third parties for commercial purposes.

8.2. Google Fonts: typefaces are loaded from Google servers, and consequently Google receives the User's IP address and user agent on every page load, automatically and without any action on their part. This constitutes the only automatic transfer performed by the Site.

8.3. WhatsApp (a Meta service): involved only when the User chooses to open or send a message. Meta's infrastructure is located outside Israel.

8.4. Hosting platform: serves the Site's pages and generates server-side logs and statistics, outside the Site's own code.

9. Measurement and advertising technologies

9.1. As at the last-updated date of the Policy, the Site incorporates no measurement, analytics, attribution or advertising tools. There is no Google Analytics, Google Tag Manager, Google Ads, Meta Pixel or Meta Conversions API. There is no session recording and there are no first-party cookies.

9.2. Tools in the following categories are intended to be introduced in the future: Site usage analytics, advertising campaign measurement and conversion attribution.

9.3. Prior to the activation of any of them, the Policy will be updated to identify the provider, the purpose and the information involved, and the last-updated date will be amended.

9.4. No non-essential technology will be loaded before consent is obtained where the law so requires. The consent mechanism will allow refusal as easily as acceptance, without pre-ticked boxes, and will allow the decision to be withdrawn at any time.

9.5. Tools used solely for the technical administration of the Site, which collect no information about Users, fall outside the scope of this clause.

9.6. Under no circumstances are medical information, diagnoses, treatments enquired about, form content, private message content or any other sensitive information transmitted to advertising or measurement platforms. This limitation does not depend on the User's consent and applies at all times.

10. Cookies and browser storage

10.1. The Site installs no first-party cookies.

10.2. The only data retained in the browser is the language preference, under the key sk_lang. It is not transmitted to any server and may be deleted from the browser settings.

10.3. Under the current configuration there is no optional technology requiring consent, and accordingly no consent mechanism is displayed. One will be implemented prior to the activation of any of the technologies described in clause 9.

11. Transfers outside Israel

11.1. Loading the typefaces entails an automatic transfer of technical connection data to Google servers located outside Israel.

11.2. Use of WhatsApp means that the conversation is processed on Meta infrastructure located outside Israel, subject to the terms and privacy policy of that service.

11.3. Anyone who prefers to avoid using WhatsApp may request an alternative means of contact.

12. Retention and medical confidentiality

12.1. The Site retains no information, as it stores none.

12.2. WhatsApp conversations remain on each party's device and account and on that service's infrastructure, in accordance with its terms. Conversations that do not lead to medical care are deleted once they are no longer necessary to answer the enquiry.

12.3. Clinical documentation generated in the course of in-person medical care is retained in accordance with the rules applicable to medical records.

12.4. All health information communicated to the Controller is covered by the duty of medical confidentiality and is not disclosed to third parties save with the Patient's consent or where required by law.

13. Information security

13.1. The measures adopted are reasonable and proportionate to the nature of the Site, which stores no information: the Site is served over an encrypted connection; it exposes no keys or credentials in browser code; it embeds no third-party advertising scripts; and it minimises the fields requested in the form.

13.2. Access to conversations and to the practice's documentation is limited to those involved in providing the care and in its administrative management.

13.3. No transmission over the Internet or via a messaging service can be regarded as absolutely secure.

14. Users' rights

14.1. Under the Protection of Privacy Law, every person has the right to:

14.1.1. access information concerning them;

14.1.2. request the correction of information that is incorrect, incomplete or out of date;

14.1.3. request the removal of their details from any register intended for direct marketing, where one exists;

14.1.4. withdraw consent given, where processing is based on consent, without affecting the lawfulness of prior processing;

14.1.5. lodge a complaint with the competent Israeli privacy protection authority.

14.2. Such requests are answered within a reasonable time, following verification of the requester's identity.

15. Exercising these rights

15.1. A request shall be submitted through a written and recordable channel, stating the specific request and the minimum details necessary to locate the information and verify the requester's identity.

15.2. It may be sent by email to privacy@drsalvadorkaplan.com.

15.3. The request and the response to it are retained for as long as necessary to evidence that it was handled, and are not used for any other purpose.

16. Direct marketing

16.1. As at the last-updated date of the Policy, no commercial communications or direct marketing messages are sent.

16.2. Should any be sent in the future, the prior, express, documented and verifiable consent of the recipient will be required, obtained separately from the contact enquiry and without pre-ticked boxes, and every message will include a simple means of withdrawing that consent.

16.3. Requesting an appointment or information does not constitute consent to receive commercial communications.

17. Social media and third-party content

17.1. Where the Site links to social media profiles, the interaction takes place on the relevant platform and is subject to its terms and privacy policy.

17.2. No information enabling a Patient to be identified, and no images or clinical details, are published without their prior, specific and written consent.

18. Minors

18.1. The Site is not directed at persons under 18 years of age.

18.2. Any communication concerning a minor must be made by their parent or legal guardian.

19. Security incidents

19.1. In the event of a security incident that could affect personal information, its scope will be assessed, appropriate containment and corrective measures will be taken, and affected individuals and the competent authorities will be notified where the applicable rules so require.

20. Links to external sites

20.1. The Site may link to third-party pages. No control is exercised over their content or their handling of information, and this Policy does not apply to them.

21. Amendments to the Policy

21.1. The Policy may be updated when the operation of the Site or the applicable rules change.

21.2. The version in force is the one published on this page, together with its last-updated date.

22. Governing law and contact

22.1. This Policy is governed by the law of the State of Israel.

22.2. For matters relating to the Policy, contact may be made at privacy@drsalvadorkaplan.com.