Privacy policy

First, the thing that matters most

This is a demonstration website for a fictional business. Woodside Physical Therapy, LLC does not exist. It was built to show what can be designed, provisioned, deployed and hosted through MaiaHost. No appointment booked here reaches a physical therapist, and every telephone number and licence number on the site is a placeholder.

The booking application is nevertheless real and running, so anything you type into it is genuinely stored in a genuine database. Please do not enter real medical information. If you already have, email physical@bestdealwebdesign.com and it will be deleted.

What the website itself collects

Nothing, in the ordinary browsing case. There is no analytics script, no advertising pixel, no third-party tracker and no cookie set by these pages. Nothing here is loaded from a content delivery network, so no third party learns that you visited by serving you a font or a script.

The web server keeps ordinary access logs — the address requested, the time, the browser's user-agent string and the IP address it came from — which is how any web server on the internet works and how abuse is investigated.

What the contact form collects

Your name, your email address, the subject line and your message, plus the time and the IP address the message came from. That is submitted through MaiaHost's managed contact form and delivered as email. It is used to reply to you and for nothing else.

What the booking application stores

If you request an appointment: your name, telephone number, email address, the reason you gave for the visit, any notes you typed, the therapist and the hour you chose, the time you booked and the IP address you booked from. That record is what the therapist's calendar shows and what the confirmation and reminder emails are sent to.

If you tick the box asking for check-in reminders and clinic news, the record is also marked for those. That tick is optional, it makes no difference to your appointment, and every message sent under it carries a one-click unsubscribe link that works without logging in to anything.

The application also keeps a log of the emails it has sent, so that a message which failed can be found and resent, and a simple per-address rate-limit table so the booking form cannot be used to send thousands of emails to somebody else.

What we do not do with any of it

It is not sold. It is not shared with advertisers, data brokers or anybody else. It is not used to build a profile of you, and it does not follow you to other websites, because there is nothing here capable of doing that.

How long it is kept

Appointment records and the patient record they belong to are kept while they are useful to the practice, which for a real clinic is governed by New York's medical records retention rules rather than by preference. Email logs and rate-limit rows are pruned automatically. Server access logs rotate on the host's own schedule.

For this demonstration, the honest answer is that anything you enter will sit in the database until somebody asks for it to be removed or the demonstration is taken down.

Your choices

You can unsubscribe from reminders with the link in any message. You can cancel an appointment with the link in your confirmation email, at any point up until the appointment starts. And you can ask for everything held about you to be deleted by emailing physical@bestdealwebdesign.com, which for this demonstration will simply be done.

Security, stated honestly

The site is served over HTTPS. Admin passwords are stored hashed rather than in plain text, the admin area locks an account after repeated failed sign-ins, and the confirm and cancel links in emails are signed so that one person's link cannot be altered into another's.

None of that makes a database on a shared host an appropriate place for real medical information, which is why the paragraph at the top of this page asks you not to enter any.