Privacy Policy

1. Introduction

This Privacy Policy explains how Faraz Luni MD Consulting PLLC collects, uses, stores and protects personal information in the course of running a physician consulting practice. The practice is operated by Faraz Luni MD, a physician and consultant working from a single consulting room in Draper, Utah. The developer of this website and the principal of the practice is Faraz Luni MD, and the business entity that holds the consulting engagements is Faraz Luni MD Consulting PLLC.

Faraz Luni MD Consulting PLLC provides educational and professional consulting services for clinicians. The work includes clinical skills training, chart review coaching, board examination preparation, case conference facilitation, procedure video review and study plan auditing. In delivering those services, the practice necessarily handles personal information about the clinicians who engage it, about the people who write to the practice through this website, and about the material that clients choose to share for review.

The practice takes privacy seriously because the material it handles is often sensitive. Clinicians bring written notes, examination records, calendars, assessment rubrics and occasionally consented video recordings to their sessions. The practice treats all of that material as confidential professional information and limits access to the consultant who is directly working on the engagement.

This policy describes what is collected, why it is collected, how long it is kept and what choices are available. It applies to this website and to all consulting engagements unless a separate written agreement states otherwise for a particular engagement. Where a separate engagement agreement contains terms that differ from this policy, the engagement agreement governs the specific engagement, and this policy continues to apply to the website and to everything else not covered by that agreement.

2. Scope of This Policy

This policy covers every page of this website, including the home page, the services page, the contact page, this privacy page and the terms of service page. It also covers the consulting engagements that the practice delivers, the messages exchanged during those engagements, the written consulting notes the practice produces and the records the practice keeps for its own administration.

This policy does not cover the practices of other organizations, including the websites or platforms that a client may use to reach the practice, such as an email provider or a video conferencing service. Those organizations maintain their own privacy notices, and the practice encourages clients to read them. This policy also does not cover the internal records that a client keeps at their own institution, which remain under the control of that institution.

The practice is not a healthcare provider for the purposes of this website. It does not offer medical care through this website, does not diagnose or treat any condition through this website, and does not create a clinician and patient relationship through any page of this website. Information submitted through the contact form is treated as business correspondence about consulting services, not as a clinical record.

Where the practice reviews charts or procedure recordings that a client supplies, those materials remain the responsibility of the client, who must ensure that appropriate consents have been obtained and that identifying details have been removed before sharing. The practice will not accept material that has not been properly de-identified, and will return or destroy any material that arrives in identifiable form as soon as the issue is noticed.

3. Information We Collect

The practice collects only the information that is needed to answer inquiries and deliver consulting engagements. The categories below describe what is typically collected.

3.1 Information you provide directly

• Contact details such as name, email address, telephone number and, where relevant, the name of the institution or program the client is associated with.
• The contents of messages sent through the contact form or by email, including the subject line, the body of the message and any attachments the client chooses to include.
• Scheduling information such as preferred dates, time zones and the dates of examinations or assessments that shape the timeline.
• Consulting material shared for review, such as de-identified charts, study plans, rubrics and consented procedure recordings.
• Payment and billing details for engagements that are invoiced, limited to what is necessary for accounting and tax purposes.
• Written feedback that a client chooses to send about a session, a track or the website itself.

3.2 Information collected automatically

• Technical information about the device and browser used to visit the website, such as the browser type and version, the operating system and the screen size.
• Server log information such as the internet protocol address, the date and time of a request and the page that was requested. These logs are short-lived and are used to keep the website available and secure.
• Aggregate information about which pages are visited most often, if a page counting tool is in use. No individual visitor is identified by that count.

3.3 Information we do not seek

The practice does not ask for government identification numbers, financial account numbers, health records of patients, biometric data or any special category of personal information through this website. If a client sends sensitive material that was not requested, the practice will treat it carefully, will limit its use to the purpose for which it was sent, and may ask the client to withdraw it.

4. How Information Is Collected

Most information reaches the practice through direct correspondence. When a visitor completes the contact form on the contact page, the browser prepares an email message addressed to training@farazlunimd.lol and opens the visitor email application. The message is only sent when the visitor confirms it in that application. The practice receives the message as ordinary email, with the sender address, subject and body that the visitor chose to include.

Additional information is collected when a client books an engagement. During intake, the consultant records the goals, timeline and constraints described by the client, together with any reference numbers or dates the client supplies. This information is recorded in the consulting notes for the engagement.

When a client shares charts, plans or recordings for review, the files arrive by email or through a secure transfer link. The practice stores those files only for the duration of the engagement and only on devices controlled by the practice. Files are not uploaded to public cloud folders and are not shared with other clients.

Some information is generated by the website itself. A typical web server records a short access log for each request, which includes the internet protocol address and the requested page. These logs help the practice understand whether the site is available and whether it is being misused. The practice does not attempt to link log entries to individual visitors unless an investigation of a security incident makes that necessary.

5. Purposes of Processing

The practice uses personal information for the following purposes, each of which is connected to the consulting work described on the services page.

• To reply to inquiries and schedule intake conversations.
• To prepare and deliver consulting sessions across the six tracks offered by the practice.
• To write consulting notes, summaries and study plans that the client can keep.
• To keep the administrative records needed for invoicing, accounting and tax obligations.
• To protect the security and availability of the website and the practices devices.
• To improve the clarity of the website and the usefulness of the material sent between sessions.
• To comply with legal obligations that apply to a professional consulting practice in the United States.
• To defend the practice against claims arising from an engagement, where that is necessary and proportionate.

The practice does not sell personal information, does not rent contact lists and does not use the information collected through this website for advertising. There is no advertising network on this website and no tracking pixel from a third-party advertising platform.

6. Legal Bases for Processing

Where the law requires a legal basis for processing, the practice relies on one or more of the following bases. The first is the performance of a contract or the steps taken at the request of a client before a contract is formed. Scheduling an intake, delivering a session and producing a consulting note all fall within this basis.

The second is legitimate interest. The practice has a legitimate interest in answering inquiries, running a professional consulting business, protecting its records and improving its services. When relying on this basis, the practice weighs its interest against the rights of the individual and limits the processing to what is necessary.

The third is consent. Where a client chooses to share charts, recordings or other review material, the practice relies on the written consent recorded at intake. Consent can be withdrawn at any time, and withdrawal does not affect work that was already completed on the basis of that consent.

The fourth is a legal obligation. Certain records must be kept for accounting, tax and professional reasons, and the practice retains and discloses those records where the law requires it. The fifth is the establishment, exercise or defense of legal claims, which allows the practice to keep records that may be needed in a dispute.

7. Cookies and Similar Technologies

This website is deliberately simple and is designed to work without a marketing or analytics cookie. The site does not set advertising cookies, does not embed social media trackers and does not use cross site profiling. Any cookie that is present is limited to what the hosting provider requires for basic delivery and security, such as a short-lived session cookie used to balance traffic between servers.

If the practice later adds a page counting tool, it will use a privacy-respecting tool that does not set identifying cookies and does not build a profile of individual visitors. Any such change will be reflected in this policy before the tool is enabled, and visitors will be able to read about it here.

Most browsers allow visitors to view and delete cookies through their settings. Blocking all cookies may affect how some sites behave, but this website is built so that its pages remain readable and its contact form remains usable even when cookies are blocked.

8. How We Share Information

The practice does not sell, rent, trade or publish personal information. Information is shared only in the narrow circumstances described below, and only to the extent needed for the purpose named.

• With service providers who help run the practice, such as the email provider that delivers messages and the hosting provider that serves this website. These providers receive only the information needed to perform their function and are bound by their own confidentiality and security obligations.
• With an accountant or bookkeeper, where financial records are needed for invoicing, accounting or tax filing. Only the billing details relevant to the engagement are shared.
• With a legal advisor, where advice is needed about an engagement or a dispute. Only the material relevant to the question is shared.
• With a court, regulator or law enforcement agency, where the practice is legally required to disclose information or where disclosure is necessary to protect the rights and safety of the practice or of another person.
• With a successor entity, if the practice is ever transferred, merged or reorganized. In that case the recipient would be bound by this policy or by a policy at least as protective, and clients would be notified before their information changed hands.

Beyond those circumstances, nothing is shared. In particular, review material supplied by one client is never shown to another client, and case conference evenings use only the material that each presenter has agreed in writing to discuss in the group.

9. Service Providers and Vendors

The practice keeps its vendor list short on purpose. Email is delivered through a reputable provider that supports encrypted transport. The website is hosted on a server that the practice controls the configuration of. Video sessions use a conferencing service with end to end encryption where the plan supports it. File transfers for large recordings use a secure transfer service with expiring links.

Each vendor is chosen with attention to its security posture, its data location and its own privacy commitments. Before a vendor is used for material that contains personal information, the practice reviews the vendor terms and confirms that the vendor does not claim ownership of client material, does not use it to train general models without permission and does not disclose it to advertisers.

Vendors change from time to time as better options become available. When a vendor is replaced, the practice closes the account with the previous vendor, requests deletion of stored material where the vendor offers that option, and confirms that the new vendor meets the same standard. The categories of vendor used by the practice are listed here rather than the individual brand names, because brand names change more often than the categories.

10. Data Retention

Inquiry messages are kept for as long as needed to answer them and for a reasonable period afterward in case a follow up question arrives. Messages that do not lead to an engagement are deleted within twelve months. Messages that lead to an engagement become part of the engagement record.

Consulting notes are kept for the duration of the engagement and for a period afterward that allows the client to return for a review. The practice normally keeps the final consulting note for seven years, because that is a common period for professional record keeping in the United States and is useful if a client asks for a copy later.

Charts, study plans and procedure recordings supplied for review are kept only for the duration of the engagement. At the close of the engagement, the client chooses whether the material should be returned or destroyed, and the practice follows that choice within thirty days. Recordings are never kept beyond the engagement unless the client requests a longer series and confirms that in writing.

Billing and tax records are kept for the period required by applicable law, which is normally seven years. Server logs are kept for a short period, typically under thirty days, and are then deleted automatically. Backup copies of records are kept for a rolling period and are deleted when the backup cycle completes.

11. Security Measures

The practice uses administrative, technical and physical measures to protect personal information. Access to client material is limited to the consultant who is working on the engagement. Devices used for consulting work are protected by full disk encryption, screen locks and current security updates. Accounts are protected by strong passwords and multi-factor authentication where the service supports it.

Files travel over encrypted connections. Large recordings are shared through expiring links rather than by open attachment. Printed material is kept in a locked cabinet and is shredded when it is no longer needed. The consulting room is used only for scheduled sessions, and screens are positioned so that material is not visible to anyone outside the session.

No system is perfectly secure, and the practice does not claim otherwise. If a security incident affects personal information, the practice will investigate promptly, will take steps to contain the incident, and will notify affected clients and any required authority without undue delay where the law requires notification. The practice also keeps a short incident log so that lessons learned are applied to future practice.

12. Your Privacy Rights

Depending on where you live, you may have certain rights over the personal information the practice holds about you. The practice honors the following requests whether or not a specific law compels it, because they reflect good practice.

• The right to know what personal information the practice holds about you and to receive a copy of it.
• The right to correct information that is inaccurate or incomplete.
• The right to request deletion of information that is no longer needed, subject to record keeping obligations that the law imposes.
• The right to withdraw consent for the use of review material, which will stop future use of that material.
• The right to object to processing that is based on legitimate interest, where your circumstances justify the objection.
• The right not to be discriminated against for exercising a privacy right.

To make a request, write to training@farazlunimd.lol with the words privacy request in the subject line, or call +17248748339. The practice will acknowledge the request within five business days and will respond substantively within thirty days, or will explain why more time is needed. The practice may ask for enough information to confirm identity before acting on a request, but will not ask for more than is necessary.

If a request is refused, the practice will explain the reason and will describe how to raise a concern. Clients who are not satisfied with the response may contact the relevant privacy authority in their jurisdiction.

13. Privacy for Children

This website and the consulting services described on it are intended for adults who work in clinical, educational or technical professions. The practice does not knowingly collect personal information from children under the age of thirteen. If a parent or guardian believes that a child has sent personal information to the practice, the parent or guardian should contact training@farazlunimd.lol, and the practice will delete the information promptly.

Where a consulting engagement concerns the teaching of clinicians who work with younger people, the practice discusses only the professional skills of the clinician. No information about a young person is collected through this website, and any chart material supplied for review must already be de-identified in line with the rules described in the scope section above.

14. International Visitors

The practice is based in the United States and stores its records there. Visitors from other countries should understand that information sent to the practice will be processed in the United States, where privacy law may differ from the law of their own country. By sending a message or booking an engagement, a client consents to that transfer to the extent that consent is required.

For clients in regions with specific transfer rules, the practice will discuss the available safeguards before the engagement begins. Where a client requires that material stay within a particular region, the practice will say plainly whether that can be accommodated. In some cases the honest answer will be that it cannot, and it is better to know that before the work starts.

Remote sessions make international engagement possible, but the practice reserves the right to decline an engagement where the legal or practical differences are too great to manage responsibly. Declining an engagement is not a judgment about the client and carries no cost.

15. Changes to This Policy

The practice reviews this policy at least once a year and whenever a material change is made to the way information is handled. When a change is material, the revised policy will be posted on this page with a new effective date, and clients with an active engagement will be told by email. Small clarifications that do not change the substance of the policy may be made without a separate notice.

The current version of the policy is the one published on this page. Earlier versions can be requested from the practice by email. The practice does not apply a new policy retroactively to work that was completed under an earlier version except where the law requires it.

Continued use of the website after a revised policy takes effect indicates acceptance of the revised policy for future use of the website. Clients who object to a material change may end their engagement in line with the terms of service, and the practice will handle their records according to the choices recorded at intake.

16. Contact Information

Questions about this policy, requests to exercise a privacy right and complaints about the handling of personal information should be sent to the practice using the details below. The practice aims to answer every privacy message within five business days.

Please include enough detail for the practice to understand the request, such as the date of the session if the request concerns an engagement, or the date of the message if the request concerns an inquiry. The practice will not ask for passwords or full payment card numbers and will never request those details by email.

17. Additional Notices

This section collects a few smaller notices that do not fit neatly into the sections above. They are included so that the policy is complete rather than because they are likely to apply to most clients.

17.1 Analytics and counting

The website uses no third-party analytics script. Any counting that takes place is done from the server access log, at the level of pages rather than people. This means the practice can tell that a page is visited, but not who visited it.

17.2 Email security

Email is not a perfectly secure channel. The practice encourages clients not to send highly sensitive material as an open attachment. For charts and recordings, use the secure transfer method offered at intake. If a client is unsure, a short email asking for the transfer option is always welcome.

17.3 Do not track signals

Some browsers send a do not track signal. Because this website does not use tracking scripts, the signal is honored implicitly. There is nothing to switch off, and the practice will keep it that way unless a future feature genuinely requires a change, in which case this policy will say so first.

17.4 Business transfers

If the consulting practice is ever sold or merged, the engagement records would move with it. Clients would be told before the transfer, would be given the name of the recipient and would have the option to end the engagement rather than have their records transferred. This notice survives any change of ownership.

17.5 Complaints

The practice would rather hear about a problem than not hear about it. A client who is unhappy with how information has been handled can write to training@farazlunimd.lol and will receive a reply from the consultant. If the matter cannot be resolved directly, the client may contact the relevant privacy authority.

17.6 Effective date

This policy took effect on the date shown at the foot of this page and replaces earlier versions. It is published in English, and only the English version is authoritative.