Effective October 1, 2026
Last updated: September 29, 2026

Flora and Fana, LLC ("Flora + Fana," "we," "us") runs this website and the acupuncture and holistic health practice at 6930 Carroll Ave, Suite 408, Takoma Park, MD 20912. This policy explains what we collect when you visit floraandfana.com, book with us, or join our newsletter, and what we do with it.

We keep this simple on purpose. We collect what we need to care for you and run the practice, and nothing beyond that.

The short version

We never sell your information. We never rent it or trade it. We do not share your health information for advertising. We share information only with the services that help us run the practice, and only so they can do that work.

Information you give us

When you book an appointment. Booking runs through Jane, our scheduling and records system. You go to Jane directly from the buttons on this site. Jane collects your name, contact information, appointment preferences, health history, intake answers, and payment details.

When you come in for treatment. We record your health history, intake answers, treatment notes, and progress over time. These form your medical record.

When you pay. We accept credit and debit cards through Jane's payment processing. Your full card number never reaches us or our records. The processor handles it, and we see only what we need to confirm the payment and issue receipts.

When you buy a gift card. We collect the purchaser's name, email, payment details, and whatever message and recipient information you choose to include.

When you join our newsletter. The sign-up form at the bottom of every page asks for your first name, last name, and email address. Mailchimp stores your subscription and sends the newsletter. Mailchimp emails you once to confirm, and you are not subscribed until you click the link in that email. Squarespace, our website host, also keeps a copy of each sign-up in our website account. We do not send email from that copy.

When you contact us. The contact form on our home page asks for your name, email address, phone number (optional), and your message. Squarespace stores what you send in our website account and emails a copy to us. If you email or call us instead, we keep what you send so we can respond. Please do not use website forms or email to send us detailed health information, since ordinary email travels unencrypted. Your Jane account gives you a secure way to reach us.

At events and festivals. If you sign up at a community event, we collect the contact information you write down or enter.

Information collected automatically

Our website host and the analytics tools we use record technical details when you visit: your IP address, browser and device type, the pages you view, how long you stay, the links you click, and the site that referred you.

Some cookies keep the site secure and working properly. Others measure how many people visit and which pages they read. We use that to make the site more useful, not to identify you personally.

We may add or change analytics and site-performance tools over time. Whatever we use, the purpose stays the same: understanding how people find and use the site.

Spam protection. Our newsletter sign-up uses Google reCAPTCHA to screen out automated sign-ups. reCAPTCHA collects information about your device and how you use the page and sends it to Google. Google's Privacy Policy and Terms of Service apply.

Most browsers let you block or delete cookies in their settings. Blocking the necessary ones may break parts of the site.

Some browsers let you send a "Do Not Track" signal. Our site works the same way whether or not it receives one, because no industry standard ever settled how websites should respond to it.

Advertising and tracking. We do not currently run advertising trackers on this site, and we do not send information about your visit to advertising platforms. Health interests deserve more care than ordinary browsing, and a page visit here can reveal why someone is seeking treatment. If we ever add advertising tools, we will ask for your consent first and update this page before turning them on.

How we use your information

We use what we collect to:

• Schedule, confirm, and remind you about appointments

• Provide and document your care

• Process payments and issue receipts and superbills

• Answer your questions

• Send the newsletter, event announcements, and practice updates, if you asked for them

• Meet our legal, tax, and professional recordkeeping obligations

• Understand which parts of the site people find useful, and reach people in our community who might benefit from care

We do not use your health information to advertise to you, and we do not build advertising profiles from what you tell us or from what you read on this site.

Your health information

Maryland's Confidentiality of Medical Records Act (Health-General § 4-301 and following) requires health care providers to keep medical records confidential. We follow it, and we hold your records to the standards of care our profession expects. We discuss your care with no one outside the practice unless you tell us to, or unless the law requires it.

Flora + Fana operates as a cash-pay practice. We do not bill insurance companies and we do not send claims to health plans, so the federal HIPAA rules that attach to insurance billing do not currently govern us. That does not loosen how we handle your records. If we ever begin billing insurance, we will update this policy first.

Superbills. If you ask for a superbill to submit to your own insurance company, we prepare it and give it to you. You decide whether to send it. Once you do, your insurer's own privacy practices govern what happens next.

When we may disclose without asking you. In a few narrow cases, the law requires or allows us to share information without your permission: a court order or a subpoena that meets Maryland's legal requirements, a report of suspected abuse or neglect, an investigation by the state acupuncture board, or a medical emergency where you need immediate care. When that happens, we share only what the situation requires.

Who we share information with

We share information with the companies that run parts of the practice for us. Today those fall into these categories:

• Scheduling, patient records, gift cards, and payment processing. We currently use Jane.

• Website hosting, website forms, and analytics. We currently use Squarespace.

• Spam protection on the newsletter sign-up. We currently use Google reCAPTCHA.

• Email newsletter delivery. We currently use Mailchimp.

• Professional advisors, including our accountant and bookkeeper, when they need information to do their work.

Vendors change. If we move to a different scheduling system, host, or email service, the categories above still describe what we share and why, and we will name the current tools on request.

Each of these handles your information under its own privacy terms, and we choose them partly on that basis. We ask them to use your information only for the work we hired them to do, and not for their own purposes.

We may also disclose information when the law requires it, or if we ever sell or transfer the practice, in which case your records would move to the new owner under the same protections.

Email and text messages

You can leave the newsletter at any time using the unsubscribe link at the bottom of every message, or by writing to us through our contact form. Appointment reminders and messages about your care are separate from marketing, and you manage those through your Jane account or by asking us.

Your choices

You can:

• Ask what information we hold about you

• Request a copy of your medical record

• Ask us to correct anything wrong

• Withdraw consent for the newsletter

• Ask us to delete information we no longer need to keep

Maryland law sets how long health care providers must retain medical records, so we cannot delete a clinical record on request while that period runs. We can tell you what applies to your file.

We may ask you to confirm your identity before we release records.

How long we keep things

We keep medical records for the period Maryland law requires of health care providers. We keep financial records as long as tax rules require. We keep newsletter subscriptions until you unsubscribe. If you want the copy of your sign-up in our website account deleted too, tell us and we will remove it. We keep contact form messages as long as we need them to answer you and follow up. We keep website analytics for a limited window, on the retention schedule our analytics provider sets.

Security

We use reasonable safeguards to protect your information, including password-protected systems, encrypted connections, and limits on who can see what. The services we rely on maintain their own security programs. No system on the internet offers perfect protection, and we cannot promise one.

Maryland's Personal Information Protection Act requires us to notify you within 45 days if a breach puts your personal information at risk of misuse. We would tell you what happened, what was involved, and what to do about it.

Children

This website serves adults. We do not knowingly collect information from children under 13 through the site. We treat minors only with a parent or guardian's consent, and a parent or guardian controls that child's record. If you believe a child gave us information through the website, contact us and we will remove it.

Links to other sites

Our site links out to our booking system, to social media, and sometimes to articles and resources we like. Once you leave floraandfana.com, this policy stops applying. Read the privacy policy of wherever you land.

Changes to this policy

We update this policy when our practices change. The effective date at the top tells you which version you are reading. Material changes will be announced on this page, and by email if we hold your address.

Contact us

Questions about this policy, or about your information:
www.floraandfana.com/home#contact

Flora and Fana, LLC
6930 Carroll Ave, Suite 408
Takoma Park, MD 20912

If you think we have mishandled your information, tell us first. We would rather hear it directly. You can also contact the Maryland Attorney General's Consumer Protection Division.