Privacy policy

Effective Date: 11/05/2023
Last Updated: 11/13/2026

Introduction

Pruett & Co., LLC, DBA AlpineForm (“AlpineForm,” “we,” “us,” or “our”) is committed to protecting the privacy of our website visitors, customers, and the individuals whose information is submitted through our platform. This Privacy Policy explains how we collect, use, disclose, and protect information when you visit our website at AlpineForm.com or use our services.

AlpineForm provides HIPAA-compliant electronic form services for healthcare providers. We serve as a Business Associate to covered entities under the Health Insurance Portability and Accountability Act (HIPAA), and our handling of protected health information (PHI) is governed by our Business Associate Agreements with our customers and applicable law.

Information We Collect

Information from Website Visitors

Our website does not use analytics tools, advertising trackers, or third-party scripts, and does not keep a record of the pages you visit. Our servers use your IP address briefly, in memory, to limit repeated requests and protect the website against attacks. We do not share this information with third parties for marketing purposes.

Information You Send Us

If you ask for a free trial, we collect the information you enter: your name, title or role, email address, and phone number, and your practice's name, website, city, and state. We use it to review your request, contact you about it, and set up your account. We send you an email to confirm we received it.

Information from Customers (Covered Entities)

When healthcare providers become AlpineForm customers, we collect:

Information from Form Submissions (Patient Data)

When individuals submit forms through our platform on behalf of our customers’ practices, the following types of information may be collected as directed by the covered entity:

Important: This patient information is collected on behalf of and at the direction of our healthcare provider customers (covered entities). The covered entity determines what information to collect and is the controller of this data. AlpineForm processes this information as a Business Associate under HIPAA.

How We Use Information

Website Visitor Information

We use information collected from website visitors to:

Customer Information

We use customer information to:

Patient Form Submission Data

We use patient data solely to:

We do not use patient data for marketing, analytics, or any purpose other than providing services to our covered entity customers as permitted by HIPAA and our Business Associate Agreements.

Cookies and Tracking Technologies

We use a limited number of cookies and similar technologies:

Essential Cookies: Required for website functionality, including login sessions and security features.

Security Services: We use security tools to protect our website from malicious activity and attacks.

We do not use:

How We Share Information

We Do Not Sell Personal Information

We do not sell, rent, or trade personal information to third parties for their marketing purposes.

Service Providers

We share information with service providers who assist us in operating our business:

All service providers who may access protected health information have signed Business Associate Agreements and are contractually obligated to protect the information they receive.

We may disclose information when required by law, such as:

Business Transfers

In the event of a merger, acquisition, or sale of assets, personal information may be transferred to the acquiring entity, subject to the same privacy protections described in this policy.

Data Retention

We retain information for the following periods:

Upon termination of a customer relationship, we retain only protected health information necessary for our proper management and administration or to carry out our legal responsibilities, as permitted by law and our Business Associate Agreements.

Data Security

We implement comprehensive administrative, physical, and technical safeguards to protect information, including:

For complete details on our security practices, please refer to our HIPAA Security Rule Compliance Documentation.

In the event of a breach of unsecured protected health information, we will cooperate with the covered entity in meeting notification obligations as required by law. Breach notification to affected individuals, the U.S. Department of Health and Human Services, and media (where required) is the responsibility of the covered entity. We will provide the covered entity with the information necessary to fulfill those obligations.

Your Rights and Choices

For Website Visitors

You may:

For Customers

You may:

For Patients and Form Submitters

Because AlpineForm processes patient data on behalf of covered entities (healthcare providers), requests regarding access to, correction of, or deletion of patient information should be directed to the healthcare provider whose forms you completed. The covered entity is the controller of this data and will instruct us regarding any actions to be taken.

If you submitted a form through AlpineForm and wish to:

Please contact the healthcare provider directly. They will coordinate with us as needed to fulfill your request in accordance with applicable law.

State Privacy Rights

California Residents

If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), including the right to:

To exercise these rights, please contact us using the information below. Note that HIPAA-covered information is exempt from CCPA/CPRA.

Other State Privacy Laws

Residents of Virginia, Colorado, Connecticut, and other states with comprehensive privacy laws may have similar rights. Please contact us to inquire about exercising rights under your state’s privacy law.

Children’s Privacy

Website Visitors: Our website is designed for healthcare providers and is not directed to children under the age of 13. We do not knowingly collect personal information directly from children under 13 through our website. If we learn that we have collected personal information from a child under 13 through our website without verifiable parental consent, we will delete that information promptly. This applies to information collected through our trial request form, which is governed by the Children’s Online Privacy Protection Act (COPPA).

Patient Form Submissions: Patient intake forms hosted on our platform may collect information about minors when submitted by parents, guardians, or the minors themselves with appropriate consent, as directed by healthcare providers. The collection of patient data through our forms is governed by HIPAA and applicable state law, not COPPA, because it is collected on behalf of and at the direction of the covered entity (healthcare provider). The covered entity is responsible for obtaining any required authorizations or consents for the collection of minor patient data.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

We encourage you to review this policy periodically.

Contact Us

If you have questions about this Privacy Policy or our privacy practices, please contact us:

Pruett & Co., LLC, DBA AlpineForm

Privacy Contact: Scott Pruett, Founder
Email: scott@alpineform.com
Phone: (540) 358-0137

Mailing Address:
Pruett & Co., LLC
8401 Mayland Dr, Suite A
Richmond, VA 23294 USA

For concerns about our handling of protected health information, you may also contact the U.S. Department of Health and Human Services Office for Civil Rights.

This Privacy Policy is effective as of the date listed above and applies to AlpineForm.com and related services.