Last updated October 9, 2026

Privacy notice

Template wording. Have this notice reviewed by a privacy professional before publishing, and update it whenever the practice changes how it uses information.

This notice explains how Mihi School of Homeopathy and Research Center ("MIHI", "we") collects, uses and protects personal information, including health information, through this website and our consultations. It is written to meet the California Consumer Privacy Act as amended by the CPRA (CCPA), the California Confidentiality of Medical Information Act (CMIA), and, for visitors in the European Economic Area or the United Kingdom, the GDPR and UK GDPR.

What we collect

Identifiers and contact details: name, email address, phone number, city, and a parent or guardian's name for a child.
Health information (sensitive personal information): the symptoms, modalities, medical history, medications, emotional state and other details you choose to give in the symptom intake form or a consultation, and the consultant's assessment and remedy recommendations.
Demographics: age, gender and occupation, if you choose to give them.
Booking details: the type of visit, preferred times and any message you send.
Website usage, only with your permission: pages visited, the site that referred you, and device type. We count visitors with a one-way code that changes every day; we never store your IP address.
Records of your choices: when you accepted the medical disclaimer and what cookie choices you made, so we can show we respected them.

We collect this information directly from you. We do not buy information about you from others.

How we use it, and our legal bases

To arrange and provide your consultations, including case analysis, remedy recommendations and follow-up. GDPR basis: steps at your request before a contract and performance of that contract; for health data, your explicit consent (Article 9(2)(a)) and the provision of health care (Article 9(2)(h)).
To reply to booking requests and questions. GDPR basis: steps at your request.
To keep records we are required to keep and to deal with complaints or legal claims. GDPR basis: legal obligation and legitimate interests.
To teach and supervise student consultants, only with your permission, and using de-identified case material wherever possible. GDPR basis: consent.
To understand how the website is used, only if you allow analytics. GDPR basis: consent.

We do not use your information for advertising, we do not make automated decisions about you, and we do not use your health information to infer characteristics about you for any other purpose.

Health information

Under the California Confidentiality of Medical Information Act, we do not disclose your medical information without your written authorisation, except where the law requires or permits it (for example, to comply with a court order or to prevent a serious threat to health or safety).

MIHI is a complementary practice and does not bill health insurance, so it is generally not a "covered entity" under the federal HIPAA law. We nonetheless protect your health information with HIPAA-style administrative, physical and technical safeguards, described under Security. Under the CCPA, health information is sensitive personal information, and we use it only to provide the services you request.

We do not sell or share your personal information, as "sell" and "share" are defined in the CCPA, and we have not done so in the past 12 months. We do not knowingly sell or share the information of anyone under 16.

We disclose information only to:

Service providers that host this website and our email, under contracts that require them to keep it confidential and use it only for us.
Your doctor or another provider, only when you ask us to in writing.
Authorities, where the law requires it.

If your information is transferred outside the EEA or UK, we use the European Commission's standard contractual clauses or another lawful transfer mechanism.

Cookies and similar technologies

We use only first-party cookies. Optional analytics run only after you choose "Accept all" or turn analytics on in Cookie settings. We honour the Global Privacy Control signal as a valid request to opt out of the sale or sharing of personal information.

Name	Category	Purpose	Lasts
`mihi_sid`	Strictly necessary	Keeps your session and protects forms against forgery	Until you close the browser
`mihi_vid`	Strictly necessary	A random ID used only to record which disclaimer and cookie choices this browser made	13 months
`mihi_disclaimer`	Strictly necessary	Remembers that you accepted the current medical disclaimer	6 months
`mihi_consent`	Strictly necessary	Remembers your cookie choices	12 months
Page-view counter (no cookie)	Analytics, optional	Counts page visits by path, referring site and device type, using a daily-rotating one-way code instead of your IP address	Records deleted after 13 months

We also load the Montserrat typeface from Google Fonts, which means your browser contacts Google's servers to download it. Google does not set cookies for this.

Your rights

California residents (CCPA/CPRA)

Know what personal information we collect, use and disclose, and get a copy of it.
Delete personal information we hold about you, subject to legal exceptions.
Correct inaccurate personal information.
Opt out of the sale or sharing of personal information. We don't sell or share it, but you may still ask.
Limit the use of your sensitive personal information. We already use it only to provide our services.
Not be discriminated against for using any of these rights.

You may use an authorised agent; we will ask for proof of their authority. We verify your identity by matching details you give against our records, and we reply within 45 days. That period can be extended once by another 45 days if we tell you first.

EEA and UK residents (GDPR)

You have the right to access, rectify, erase, restrict and object to processing, and to data portability. Where processing is based on consent, you can withdraw it at any time without affecting what was done before. We reply within one month. You may also complain to your local data protection authority or, in the UK, the Information Commissioner's Office.

Make a privacy request

How long we keep information

Consultation and intake records: for as long as you are a client, and then for the period required by applicable record-keeping rules and professional guidance (we use 7 years after your last consultation, or until a child turns 25).
Booking requests that don't lead to a consultation: 2 years.
Website analytics: 13 months.
Disclaimer and cookie consent records: 5 years, to show we respected your choices.

Security

We protect information with encrypted connections (HTTPS), access limited by role so only the people involved in your care can see clinical details, unique accounts with strong passwords and automatic sign-out, a log of every view and change to patient records, and encrypted backups. Staff email alerts never contain clinical details. No system is perfectly secure; if a breach affects your information, we will notify you and the authorities as the law requires.

Children

The symptom intake form for a child under 18 must be completed by a parent or guardian. We do not knowingly collect information directly from children under 13.

Contact

Email privacy@mihihomeopathy.com, call [(925) 000-0000], or write to Mihi School of Homeopathy and Research Center, [Street address], Dublin, CA 94568. To exercise a right, use the privacy request form.