Privacy Policy

Lakeside Lactation LLC ("Lakeside Lactation," "we," "us," or "our") is committed to protecting the privacy and security of your personal information and Protected Health Information (PHI). This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you visit our website at https://lakeside-lactation.com/ (the "Site"), book an appointment, or receive services from us.

Please read this policy carefully. By using the Site or our services, you acknowledge that you have read and understood this policy. If you do not agree with our practices, please do not use the Site or our services.

1. Scope of This Policy

This policy applies to information we collect through the Site, by email, by phone, through our third-party scheduling platform (IntakeQ), and during in-home or virtual lactation consultations. Protected Health Information (PHI) collected in the course of clinical care is also governed by the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and applicable Illinois law, including the Mental Health and Developmental Disabilities Confidentiality Act and the Personal Information Protection Act.

2. Information We Collect

a. Information You Provide

• Contact information: name, email address, phone number, mailing address.
• Appointment details: preferred dates and times, service type, location for in-home visits.
• Health information: your and your baby's medical history, pregnancy and delivery details, current medications, feeding history, symptoms, goals, and anything else you choose to share during intake or a consultation. This information constitutes Protected Health Information (PHI).
• Payment information: processed by our payment processor; we do not store full card numbers on our systems.
• Correspondence: messages you send us by email, text, or through the Site's contact form.

b. Information Collected Automatically

• Usage data: IP address, browser type and version, device type, referring URLs, pages visited, time spent, and similar technical information.
• Cookies and similar technologies: small files placed on your device by our Site or by third-party analytics providers (e.g., Google Analytics).

c. Information from Third Parties

• Our scheduling platform (IntakeQ) may share the information you submit during booking and intake.
• If you arrive at our Site from a referring provider, practice, or advertising platform, we may receive information about that referral.

3. Protected Health Information (PHI) and HIPAA

Lakeside Lactation takes its obligations under HIPAA seriously. PHI is any information — oral, written, or electronic — that relates to your or your baby's past, present, or future health condition, the provision of healthcare, or payment for healthcare, and that identifies you or could reasonably be used to identify you.

We use and disclose PHI only as permitted by HIPAA, including for the following purposes:

• Treatment: to provide, coordinate, or manage your lactation care, including consulting with your baby's pediatrician or your OB/GYN when you authorize us to do so.
• Payment: to collect payment for services rendered, including generating superbills for insurance reimbursement at your request.
• Healthcare operations: to conduct quality improvement, continuing education, and routine business functions that support our practice.
• As required or permitted by law: including mandated reporting of suspected child abuse or neglect, public health reporting, court orders and subpoenas, and to avert a serious threat to health or safety.

Any other use or disclosure of your PHI will be made only with your written authorization, which you may revoke at any time (except where we have already acted in reliance on it).

4. Your HIPAA Privacy Rights

You have the following rights with respect to your PHI held by Lakeside Lactation:

• Right to access: request a copy of your records in paper or electronic form.
• Right to request amendments: ask us to correct information you believe is inaccurate or incomplete.
• Right to an accounting of disclosures: request a list of certain disclosures of your PHI.
• Right to request restrictions: ask us to limit certain uses or disclosures of your PHI.
• Right to confidential communications: request that we contact you at a specific phone number, email, or address.
• Right to a paper copy of this Notice: available on request at no charge.
• Right to file a complaint: with us or with the U.S. Department of Health and Human Services, Office for Civil Rights, without fear of retaliation.

To exercise any of these rights, please contact us using the information at the bottom of this page.

5. Breach Notification

If we become aware of a breach of your unsecured PHI, we will notify you in accordance with HIPAA's Breach Notification Rule and applicable Illinois law.

6. How We Use Non-PHI Information

Information that is not PHI — such as general Site analytics, contact form inquiries, and marketing responses — is used to: respond to your inquiries, provide and improve the Site and our services, communicate with you about your care and our business, and comply with legal obligations.

7. Information Sharing and Disclosure

We do not sell, rent, or trade your personal information or PHI. We may share information only in these situations:

• Service providers and business associates: trusted vendors that help us operate our practice (scheduling, payment processing, secure messaging, electronic health record systems, IT support). These vendors are bound by HIPAA Business Associate Agreements where required and by confidentiality obligations.
• With your authorization: with other healthcare providers, insurers, or persons you designate in writing.
• As required by law: in response to a subpoena, court order, regulatory request, or other legal process; or to report suspected abuse, neglect, or threats to health or safety.
• Business transfer: in the event of a merger, acquisition, or sale of substantially all of our assets, subject to the surviving entity continuing to honor this policy and HIPAA.

8. Telehealth and Virtual Visits

When you attend a virtual consultation, we use video and telecommunications platforms that are configured for HIPAA-compliant use. You are responsible for conducting your session in a private location, using a secure internet connection, and not recording or sharing the session without our written consent. Standard internet and cellular carrier risks apply to any electronic communication; while we take reasonable precautions, we cannot guarantee the security of data transmitted over the internet.

9. Electronic Communications (Email and Text)

Email and standard SMS text messages are not fully secure methods of transmitting PHI. If you choose to communicate with us by email or text about your care, you accept the risks associated with those methods. At your request, we can provide alternative, more secure communication channels.

10. Cookies and Analytics

We use cookies and third-party analytics tools (such as Google Analytics) to understand how visitors use the Site and improve its performance. These tools collect information about your visits (pages viewed, time spent, approximate geographic location) but do not contain PHI. You can control cookies through your browser settings; disabling cookies may affect some Site functionality.

11. Data Security

We maintain reasonable administrative, physical, and technical safeguards designed to protect your personal information and PHI against unauthorized access, use, disclosure, alteration, or destruction. These safeguards include encrypted data storage where appropriate, access controls, secure third-party platforms, and staff training. No security program is perfect, and we cannot guarantee absolute security.

12. Data Retention

We retain PHI for the longer of: (a) the period required by applicable law (including Illinois's medical record retention requirements) and (b) the period necessary to fulfill the purposes for which it was collected. Non-PHI information is retained only as long as needed for legitimate business purposes or as required by law. You may request deletion of non-PHI information at any time, subject to our legal obligations.

13. Children's Privacy

The Site is intended for adults. We do not knowingly collect personal information directly from children under the age of 13. Of course, during the course of lactation care, we collect PHI about the infant you are caring for; that information is provided by you as the parent or legal guardian and is handled in accordance with HIPAA and this policy.

14. Your Rights Under State Privacy Laws

Depending on your state of residence, you may have additional rights under state privacy laws (including the California Consumer Privacy Act, where applicable). To exercise any such rights, contact us using the information below. We will respond within the timeframe required by the applicable law.

15. Third-Party Links

The Site may contain links to websites, social media platforms, or services operated by third parties. We are not responsible for the privacy practices of those third parties. We encourage you to review the privacy policies of any third-party service you use.

16. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we do, we will post the revised policy on this page and update the "Effective Date" above. Material changes will be prominently posted on the Site. We encourage you to review this policy periodically.

17. Contact Us

If you have questions about this Privacy Policy, wish to exercise any of your privacy rights, or want to file a complaint, please contact us at:

Lauren LiButti, RN, IBCLC
Privacy Officer, Lakeside Lactation LLC
Libertyville, IL 60048
lauren@lakeside-lactation.com
(708) 317-9070

You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, at www.hhs.gov/hipaa/filing-a-complaint or by calling 1-877-696-6775.