Privacy Policy — HEROH Sports and Family Chiropractic
1. Introduction
HEROH Sports and Family Chiropractic (“HEROH,” “we,” “us,” or “our”) is committed to protecting the privacy and security of the personal and health information you share with us. This Privacy Policy explains what information we collect, why we collect it, how we use and protect it, and what rights you have regarding your information.
This policy applies to all patients, prospective patients, and website visitors who interact with our clinic, whether in person at our office, through our website (www.DrJWare.com), through our online booking system, or by phone or email. It covers all services we provide, including chiropractic care, dry needling, stretch therapy, massage therapy, vibration plate therapy, heat, laser and electric stimulation, as well as our membership programs and care plans.
By using our services or our website, you acknowledge that you have read and understood this Privacy Policy.
2. Who We Are
HEROH Sports and Family Chiropractic is a healthcare practice organized as an S-Corporation, operating at:
HEROH Sports and Family Chiropractic 8425 Castleton Corner Dr Indianapolis, IN 46250 Phone: 317.400.5853 Email: hschiro@heroh.com Website: www.DrJWare.com
For the purposes of U.S. federal privacy law, we are a “covered entity” under the Health Insurance Portability and Accountability Act (HIPAA) with respect to the health information we create and maintain about you, because we transmit health information electronically in connection with billing and, where applicable, insurance or third-party (for example, attorney-involved) claims. We are responsible for deciding how and why your personal and health information is collected, used, and shared, and for keeping it secure.
3. What Personal Data We Collect
Because we provide multi-disciplinary musculoskeletal and wellness care, we collect a range of information depending on the services you receive. This includes:
Identity data — your name, date of birth, sex, emergency contact details, and photographic identification where required.
Contact data — your address, phone number(s), and email address.
Health and clinical data — your medical history, current symptoms, injury history, examination findings, diagnoses, treatment plans and notes relating to chiropractic care, dry needling, stretch therapy, massage therapy, heat, redlight, laser, vibration plate use, and electric stimulation; imaging or reports you share with us or that are shared with us by other providers; progress notes; and outcomes of care.
Financial data — payment method details, billing history, financing applications and agreements, insurance information (where applicable), and records relating to membership or care plan enrollment.
Technical data — information collected automatically through our website and online booking system, such as IP address, browser type, and device information.
Communications data — records of correspondence between you and our clinic, including appointment confirmations, reminders, intake forms, and any messages you send us.
4. How We Collect Your Data
We collect information about you in the following ways:
- Directly from you, when you complete intake or consent forms, attend consultations or treatment sessions, or communicate with us by phone, email, or in person.
- Through our online booking system, when you schedule, reschedule, or cancel an appointment.
- Through payment processing, when you pay by cash, card, or set up a financing arrangement for treatment.
- Through our clinical records system, ZHealthEHR, where your clinical notes and treatment records are stored digitally.
- Through our email marketing platform, Kit, if you opt in to receive newsletters or promotional communications.
- From third parties, such as insurance companies, attorneys, or other healthcare providers, where relevant to your care or claim (for example, in the case of a personal injury matter).
5. Why We Collect Your Data and Our Legal Basis
We only collect and use your personal and health information where we have a valid basis to do so. Health information is treated as especially sensitive, and we apply extra care to how it is used and shared. Our purposes include:
Providing clinical treatment. We use your health data to assess your condition, deliver chiropractic and related therapies, and manage your ongoing care. This is necessary for the provision of healthcare services and is carried out with your consent to treatment.
Booking and appointment management. We use your contact and identity data to schedule, confirm, and manage appointments through our online booking system. This is necessary to perform our agreement to provide you with care.
Processing payment. We use your financial data to process payments by cash, card, or financing, and to manage membership or care plan billing. This is necessary to fulfill our contract with you and to meet our accounting obligations.
Sending appointment reminders. We use your contact data to send appointment confirmations and reminders. This supports the delivery of your care and is a normal part of operating our practice.
Compliance with legal obligations. We retain clinical records and other data as required by Indiana healthcare recordkeeping requirements and other applicable law, and we may disclose information where required by law, court order, or regulatory request.
Marketing communications. If you opt in, we use your contact data to send newsletters or promotional content through Kit, our email marketing platform. This is based on your consent, and you may withdraw that consent at any time (see Section 11).
6. Who We Share Your Data With
We do not sell your personal information. We share your data only where necessary, with the following parties:
Insurance companies and attorneys. Where your treatment relates to a motor vehicle accident, workers’ compensation matter, personal injury claim, or other situation involving legal representation, we may share relevant clinical records, billing information, and reports with your insurer, your attorney, or opposing parties’ representatives as authorized by you or required by the claims or legal process.
ZHealthEHR. Our electronic health records platform stores your clinical data digitally on our behalf. ZHealthEHR acts as a data processor for us and is contractually and technically required to safeguard your information. We recommend confirming ZHealthEHR’s current data hosting location and security certifications directly with the vendor so this section can be kept fully up to date.
ZHealthEHR online booking system. The provider of our online booking platform processes your contact and appointment data to enable scheduling.
Payment processors. Card payments are processed through a third-party payment processor, and financing arrangements are processed through a third-party financing provider. These providers only receive the information necessary to process your payment or application and are responsible for securing that information under their own compliance obligations (such as PCI DSS for card processing).
Kit (email marketing platform). If you opt in to marketing communications, your name and email address are processed by Kit, a U.S.-based email marketing provider, solely to send you newsletters or promotional content.
Professional advisors and regulators. We may share information with our accountants, legal advisors, or regulatory and licensing bodies where necessary to run our practice lawfully or to respond to a complaint or investigation.
We do not currently share your data internationally in a way that would require cross-border transfer safeguards beyond those applicable to standard U.S.-based service providers; however, we recommend confirming the data hosting locations of ZHealthEHR, the online booking platform, and Kit as part of your compliance review.
7. How Long We Keep Your Data
We retain your clinical and personal records for 7 years from the date of your last treatment or interaction with our clinic, consistent with our clinic’s recordkeeping practice. For patients who were minors at the time of treatment, we recommend confirming whether Indiana law requires a longer retention period measured from the date the patient reaches the age of majority, and adjusting this policy accordingly if so.
After the applicable retention period has passed, your records are securely and permanently destroyed or de-identified, unless we are required to retain them for longer to comply with a legal obligation, resolve a dispute, or enforce our agreements — for example, where a personal injury claim or attorney-involved matter is still active.
8. How We Keep Your Data Safe
We take the security of your personal and health information seriously and apply a combination of technical and organizational measures to protect it, including:
- Storing your clinical records digitally in ZHealthEHR, a dedicated electronic health records system, rather than in unsecured paper files.
- Restricting access to your health and personal data — currently, only Dr. Ware accesses patient records directly, minimizing the number of people who can view your information.
- Using secure, password-protected systems for our booking, payment, and email marketing platforms.
- Requiring that any staff member, contractor, or third-party service provider who may access patient information in the future is bound by confidentiality obligations.
- Reviewing our security practices periodically to reflect changes in our systems or in applicable law.
No system can guarantee absolute security, but we work to ensure that appropriate safeguards are in place and are reviewed as our practice grows.
9. Your Rights
As a patient, you have a number of rights regarding your personal and health information. These include:
Right to access. You can ask us for a copy of the personal and health information we hold about you.
Right to correction. If you believe any information we hold about you is inaccurate or incomplete, you can ask us to correct it.
Right to request restriction or an accounting of disclosures. You can ask us to limit certain uses of your information, or ask for a list of certain disclosures we have made of your health information, subject to applicable exceptions.
Right to request deletion. You can ask us to delete your information, although we may need to retain certain records to meet our legal and recordkeeping obligations, particularly clinical records within the retention period described above.
Right to obtain a copy of your records for transfer. You can ask us to provide your records to you or, with your written authorization, transfer them directly to another healthcare provider.
Right to object or withdraw consent. Where we rely on your consent (for example, for marketing communications), you can withdraw that consent at any time without affecting the lawfulness of any processing carried out before you withdrew it.
Right to file a complaint. You have the right to raise concerns about how we handle your information, either with us directly or with the relevant regulatory authority (see Section 14).
To exercise any of these rights, please contact us using the details in Section 15. We will respond to your request within a reasonable timeframe and in accordance with applicable law.
10. Children’s Privacy
We provide care to patients under the age of 18. For any patient under 18, we obtain consent to treatment and to the collection and use of their personal and health information from a parent or legal guardian before providing services. Parents or guardians may exercise the rights described in Section 9 on behalf of their minor child, and may access, correct, or request the deletion of their child’s records subject to the retention obligations described in Section 7. We take additional care to ensure that a minor patient’s information is only shared or disclosed with appropriate parental or guardian involvement, except where restricted by law (for example, in certain circumstances involving older minors and specific types of care).
11. Marketing Communications
If you choose to opt in, we use Kit, our email marketing platform, to send you newsletters, wellness tips, and promotional information about our services, membership programs, and care plans. We only send marketing communications where you have actively opted in, and you can unsubscribe at any time by using the “unsubscribe” link included in every marketing email, or by contacting us directly at hschiro@heroh.com.
Please note that marketing communications are separate from clinical and administrative communications, such as appointment confirmations, reminders, and information about your treatment. These clinical communications are necessary to the delivery of your care and are not affected by unsubscribing from marketing emails.
12. Cookies and Website Tracking
Our website, www.DrJWare.com, may use functional cookies and similar technologies to help the site operate properly — for example, to remember your preferences or to support our online booking system. We do not currently use these technologies for third-party advertising purposes beyond what is required for the website and booking system to function. If this changes, we will update this section to describe any additional tracking technologies in use and, where required, provide you with the ability to manage your cookie preferences.
13. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practice, our services, or applicable law. Where we make material changes — for example, a change in how we share your data or a new third-party service provider — we will update the “Last Updated” date below and, where appropriate, notify you directly or post a notice on our website. We encourage you to review this policy periodically.
14. How to Make a Complaint
If you have any concerns about how we have handled your personal or health information, please contact us first at hschiro@heroh.com or 317.400.5853 so we can try to resolve the issue directly.
If you are not satisfied with our response, or if you would prefer to raise your concern with a regulator, you have the right to file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights (OCR), which oversees compliance with HIPAA. You may also be able to raise concerns with the Indiana Attorney General’s office regarding consumer protection matters. We recommend confirming current complaint procedures and any Indiana-specific privacy authority as part of your legal review, since state-level privacy enforcement in Indiana continues to develop.
15. Contact Us
If you have any questions about this Privacy Policy or how we handle your information, please contact us:
HEROH Sports and Family Chiropractic 8425 Castleton Corner Dr, Indianapolis, IN 46250 Email: hschiro@heroh.com Phone: 317.400.5853 Website: www.DrJWare.com
16. Last Updated
9/9/2026