Privacy Policy

Effective date: October 30, 2026   Last updated: October 30, 2026

This Privacy Policy explains how Luisa Gonzalez Ballesteros, M.D., PLLC (the “Practice,” “we,” or “us”) collects, uses, shares, and protects information through endo-well.com (the “Site”), any email newsletter we may offer, and other general, non-clinical communications with the Practice. EndoWell is the brand name and logo used by the Practice on this Site and is not a separate legal entity.

Two different privacy documents This Website Privacy Policy generally covers information collected through the Site, our newsletter, and other non-clinical communications. Our Notice of Privacy Practices explains how the Practice uses and protects protected health information (“PHI”) when HIPAA applies. If information collected through the Site or another communication channel is PHI, the Notice of Privacy Practices controls for that information, regardless of whether a formal physician-patient relationship has already begun. It is linked in the footer of the Site.

1 · Information we collect

Information collected automatically

When you visit the Site, our systems and our analytics provider may collect: your IP address (used to estimate general location such as city or country); browser and device type; operating system; language setting; pages viewed and time spent; the website that referred you; the date and time of your visit; and certain actions, such as clicking a phone number, an email link, or the message link, or switching between English and Spanish.

Information you give us

• If you sign up for a newsletter or request a resource: your name and email address, and the resource you requested.
• Contact form: your name, email address, optional phone number, and the message you choose to write.
• Calls and messages: what you choose to tell us when you call, email, or message us.

Health information

Please do not send health information by email, WhatsApp, through the contact form, or by social media message. For clinical information, the Practice will direct you to a secure channel. To the extent information we receive is PHI under HIPAA, it is governed by our Notice of Privacy Practices.

Social media

If you follow, comment on, or message our accounts on platforms such as Instagram, TikTok, Facebook, LinkedIn, or YouTube, we can see what you post publicly, the messages you send us, your public username, and aggregated analytics the platform gives us. The platform, not the Practice, controls the data it collects.

This Site does not process payments. Payment for care is taken outside the Site, at our office or with a card on file, through our payment processor. The Site does not ask for government identification numbers.

2 · Cookies, analytics, and embedded content

Cookies and similar technologies are small files or scripts placed on your device or browser. We use them as follows:

• Essential: to make the Site work, keep it secure, and remember settings such as your language.
• Analytics: we use Google Analytics 4 to understand, in aggregate, how the Site is used and which pages are helpful. We have turned off Google’s advertising features, Google signals, and ad personalization, and we do not connect analytics data to your name or email.
• Embedded content: videos from YouTube or similar services, our Instagram feed, and the Google reviews shown through Trustindex may load content from those services and set their own cookies or collect technical information when they load or when you interact with them. If you open the message window, what you type goes to Klara, our patient messaging platform, as our service provider, as described in Section 4.

We do not add advertising cookies, remarketing tools, or tracking pixels from advertising networks or social media platforms to the Site ourselves. Embedded third-party content, described above, may set its own cookies, which we do not control. Because we do not track you across other websites, browser signals such as Do Not Track or Global Privacy Control do not change how the Site works. You can block or delete cookies in your browser settings, though parts of the Site may not work as intended. You can also opt out of Google Analytics with Google’s browser add-on.

Health-related pages

Some pages describe health conditions. We do not use the topic of a page you viewed, or the fact that you viewed it, to advertise to you or to build a profile of your health interests, and we do not share that information with advertisers.

3 · How we use information

• To respond to your questions and coordinate appointments.
• To operate, secure, and improve the Site and its content.
• If we offer a newsletter or resources, to send you what you asked for.
• To comply with legal obligations, and to protect the rights, property, and safety of the Practice, our patients, and others.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

4 · How we share information

We share information only as described here:

• Service providers who help us run the Practice and the Site under contract and only for our purposes, such as website hosting and maintenance, email and newsletter delivery, analytics (Google), Google Workspace for email and documents, Trustindex for displaying Google reviews, Klara (our patient messaging platform) for messaging and for patient consent forms and agreements, Zoom for Healthcare for telehealth, and Stax for payment card processing. When a service provider creates, receives, maintains, or transmits PHI on behalf of the Practice and HIPAA requires a business associate agreement, we require the appropriate agreement and safeguards.
• Legal and safety reasons: when required by law, subpoena, or court order, or when needed to protect someone’s safety or to enforce our Terms of Use.
• Business changes: if the Practice is sold, merged, or closed, information may transfer as permitted by law. Patient records are handled under the rules that protect them, and patients are notified as required.
• With your consent, or at your direction.

We may use or share information that has been aggregated or de-identified so that it no longer identifies you. Information you provide may become part of your medical record when appropriate. To the extent that information is PHI under HIPAA, our Notice of Privacy Practices applies.

5 · Email, newsletter, and text messages

• If we offer a newsletter or resources, we send them only to people who sign up.
• Every marketing email has an unsubscribe link and our postal address. We honor unsubscribe requests promptly and no later than 10 business days. We may still send service messages, such as appointment coordination, if you are a patient.
• Your newsletter subscription is kept separate from any medical record. We do not use medical information to decide what to send you.
• Our email platform may record whether an email was opened or a link was clicked.
• We do not send marketing text messages. If you are a patient, we use Klara or text messages only as described in the patient agreements.

6 · Social media platforms

The Practice maintains accounts on third-party platforms such as Instagram, TikTok, Facebook, LinkedIn, and YouTube. Each platform has its own privacy policy. Please do not share health information in comments or direct messages. We do not confirm whether anyone is a patient.

7 · How long we keep information

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, including to operate the Site, respond to requests, comply with legal and regulatory obligations, maintain security, resolve disputes, and enforce our agreements.

Newsletter information is retained while you remain subscribed. If you unsubscribe, we may keep the minimum information needed to honor your request and prevent future marketing emails.

Analytics and technical logs are retained according to the settings and retention periods of the systems we use. Patient records are retained as required by applicable law and are governed by our Notice of Privacy Practices.

8 · Security

We use reasonable administrative, technical, and physical safeguards suited to the information we handle, consistent with New York law, including encryption (HTTPS) on the Site. No website or transmission is completely secure. Please do not send health information through standard email, WhatsApp, social media, or public website fields; use the approved secure clinical channel provided by the Practice. If a security incident affects your information, we will notify you and authorities as the law requires.

9 · Your choices and rights

• Access, correction, and deletion. You may ask us what personal information we hold from your use of the Site, ask us to correct it, or ask us to delete it. We may need to verify your identity and may keep information the law requires us to keep.
• Email. Unsubscribe with the link in any marketing email, or contact us.
• Cookies. Use your browser settings, as described in Section 2.
• State-law rights. Residents of some states may have additional privacy rights under applicable law, including rights to access, correct, or delete certain personal information or to opt out of certain uses or disclosures. We do not sell personal information or share it for cross-context behavioral advertising. Where applicable law gives you additional rights, we will honor verified requests and respond within the time required by that law.
• Patient rights. Your rights over protected health information are described in our Notice of Privacy Practices.

To make a request, contact us using Section 13.

10 · Children

The Site is directed to adults, including parents and guardians. It is not directed to children under 13, and we do not knowingly collect their personal information through the Site. If you believe a child under 13 has provided personal information through the Site, contact us. We will take appropriate steps to delete it unless we are required or permitted by law to retain it.

11 · Visitors outside the United States

The Practice is based in New York, and information collected through the Site may be processed or stored in the United States or in other countries, depending on our service providers, where privacy laws may differ from those of your country. If you have questions about your information, use the contact details in Section 13.

12 · Changes to this Policy

We may update this Policy. The dates at the top show the current version. If we make a material change, such as adding a new kind of tracking or a new way of using your information, we will post a notice on the Site before the change takes effect. Earlier versions are available on request. This Policy is provided in English and Spanish. If the two versions differ, the English version controls.

13 · Contact us

Privacy contact: Dr. Luisa Gonzalez Ballesteros

Luisa Gonzalez Ballesteros, M.D., PLLC, 4 East 89th Street, Suite 1C, New York, NY 10128

Email: contact@endo-well.com  |  Phone calls and WhatsApp: +1 (917) 573-0248; calls or messages via Klara, our patient messaging platform: +1 (646) 846-4816

Please do not send health information through standard email, WhatsApp, or social media messages. Use the secure channel the Practice provides.