Privacy Policy

About this document

This document contains two separate notices. They cover different information and are governed by different rules.

Part I is the Website Privacy Policy. It describes how Darren M. Smith, M.D., P.C. (the “practice,” “we,” or “us”) collects, uses, and shares information about visitors to www.darrensmithmd.com (the “Website”). It applies to information such as the contact details you enter in our consultation request form and the technical and usage data collected automatically when you browse the Website. This information is not protected health information under federal law, and Part I governs it.

Part II is the practice’s Notice of Privacy Practices under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). It describes how the practice uses and discloses protected health information about its patients, and the rights patients have with respect to that information. Protected health information is created and held by the practice in its medical records and practice systems. It is not collected or stored through the Website, and Part I does not govern it.

If you are a visitor to the Website and are not a patient, Part I is the notice that applies to you. If you are a patient, both parts apply: Part I to your use of the Website and Part II to your medical information.

Part I. Website Privacy Policy

Who we are

The Website is operated by Darren M. Smith, MD, FACS, a board-certified plastic surgeon practicing as Darren M. Smith, M.D., P.C. The practice is located at 111 East 57th Street, Ground Floor, New York, NY 10022. It can be reached by telephone at (212) 633-0627 and by email at info@darrensmithmd.com.

We respect your privacy and are committed to protecting it through our compliance with this policy.

What this policy covers

This policy applies to information we collect through the Website, through electronic messages you send in response to the Website, and through our advertising on third-party websites and services where that advertising links to this policy.

This policy does not apply to information collected by us offline or by any other means, or to information collected by any third party, including through any application, content, or advertising that links to or is accessible from the Website. Those third parties have their own privacy policies.

This policy also does not apply to any information that falls within the definition of “health information” or “protected health information” under 45 C.F.R. § 160.103. The practice maintains such information in accordance with HIPAA and applicable federal and New York law, as described in Part II below.

Please read this policy carefully. If you do not agree with our policies and practices, your choice is not to use the Website. By accessing or using the Website, you agree to this policy. Your continued use of the Website after we make changes is deemed acceptance of those changes, so please check this policy periodically for updates.

Information we collect

We collect two kinds of information from and about users of the Website.

The first is information you provide to us directly. The Website’s consultation request form collects your name, email address, telephone number, the subject you are interested in, the best time to reach you, and a free-text message. You may also provide information when you email, call, or text the practice using contact details published on the Website.

The second is information collected automatically as you navigate the Website. It includes your IP address, browser type and version, device type, operating system, the pages you view, the date and time of your visit, the website that referred you to us, and similar usage details. It also includes a record of what you do on a page, such as clicking, scrolling, and submitting a form. This information is collected through the cookies and tracking technologies described below, and much of it goes to the companies that provide those tools.

The consultation request form

The Website is hosted on a third-party website platform. That platform does not enter into a HIPAA business associate agreement with the practice, and for that reason the practice does not store protected health information on the Website or its hosting platform.

When you submit the consultation request form, your submission is transmitted directly to the practice’s customer relationship management system and is not stored on the Website or by the hosting platform. The practice uses that system to respond to your inquiry and to schedule and manage consultations.

The consultation form is a general contact form. Please do not include medical records, photographs, or sensitive medical details in your message. If you would like to share medical information with the practice, please call us at (212) 633-0627 and we will tell you how to do so securely. Any information you choose to enter in the form despite this request is treated as ordinary website contact information under this Part I until it is received by the practice, and is handled by the practice in accordance with Part II once it becomes part of your patient record.

The consultation form is protected by Google reCAPTCHA, which helps us distinguish human visitors from automated traffic. reCAPTCHA collects hardware and software information, such as device and application data, and sends it to Google for analysis. Your use of reCAPTCHA is subject to the Google Privacy Policy and Google Terms of Service.

How we use information

We use information that we collect about you or that you provide to us for the following purposes: to respond to your inquiry and to schedule, confirm, and manage consultations; to communicate with you about the practice and its services in the manner you have requested; to operate, maintain, secure, and improve the Website; to understand how visitors use the Website and to evaluate traffic patterns; to measure and improve our marketing; and to comply with our legal obligations.

Cookies, analytics, and advertising technologies

The Website uses cookies and similar technologies, including tracking pixels and scripts that run in your browser. A cookie is a small file placed on your device when you visit a website. Some cookies are needed for the Website to work. The rest are set by the analytics and advertising tools listed below. Those cookies do things like tell a tool whether your browser has been here before, keep one visit grouped together as a single session, record which search result, link, or advertisement sent you here, and connect an action you take on the Website to an advertising account.

These tools are loaded through Google Tag Manager and they run on every page of the Website. That includes the consultation request page and the page shown after a form is submitted. They are active whether or not you fill anything in.

• Google Analytics 4 measures traffic to the Website. It records the pages you view, how you arrived, for example from a search, an advertisement, or a link on another site, your device type, browser, and operating system, and your approximate location, which Google estimates from your IP address. Google receives and processes this information and also uses it under its own privacy policy.
• Google Analytics also records specific actions, not only page views. Submitting any form on the Website, clicking a telephone number to call the practice, clicking a consultation link on the contact page, and reaching the booking confirmation page are each recorded as separate events. What you do on the Website is measured, not only what you look at.
• Microsoft Clarity records session activity. It captures mouse movement, scrolling, and clicks, and from that it produces session replays, which are playbacks of what happened during an individual visit, and heatmaps showing where visitors click and how far down a page they scroll.

A Meta pixel, the advertising tag used by Facebook and Instagram, also runs on every page. It reports to Meta that a browser visited this Website and which pages it visited. Meta may connect that activity to a Facebook or Instagram account and use it for advertising. Google Ads conversion measurement runs on every page as well. It connects visits and actions on the Website back to Google advertising, so the practice can see which advertisements lead to consultation requests. This information is not anonymous in the way that word is usually understood. It is tied to identifiers stored in your browser, and in Meta’s case it can be matched to an account you hold with that company.

You can limit this, but you have to do it in your browser or on your device. The Website does not have a cookie banner or an on-site opt-out control, so there is nothing here to switch off. Your browser settings let you block or delete cookies, and most browsers can block third-party cookies entirely, although that may affect how some parts of the Website work. Google publishes the Google Analytics Opt-out Browser Add-on, which stops Google Analytics from measuring your visits. Most browsers and mobile devices also have their own tracking protection and advertising settings, and some browser extensions block session recording and advertising scripts. To read how these companies use what they collect, see the Google Privacy Policy, the Microsoft Privacy Statement, and the Meta Privacy Policy.

The Website does not currently respond to “Do Not Track” browser signals.

How we share information

We do not sell your contact information. We do share website activity. Google, Microsoft, and Meta each receive information about visits to this Website through the tools described in the cookies section above, and they receive it directly from your browser rather than from us. Under some state privacy laws, sharing of that kind may count as a sale or as sharing for targeted advertising.

We may disclose information that we collect or that you provide to us: to service providers that help us operate the Website and manage our communications, including the Website’s hosting platform, our customer relationship management system, and the analytics and advertising vendors described above, in each case only to the extent needed to perform their services for us; to comply with any court order, law, or legal process, including a request from a government or regulatory authority; to enforce this policy or our Website terms of use; and to protect the rights, property, or safety of the practice, our patients, or others.

Any health information the practice receives from you is disclosed only as permitted by HIPAA and as described in Part II.

Third-party websites and services

The Website may contain links to third-party websites and services, including social media platforms and the websites of the financing companies we work with, CareCredit and Alphaeon Credit. If you apply for financing, you do so directly with the financing company under its own terms and privacy policy. The practice does not control these third parties and is not responsible for their privacy practices. We encourage you to review the privacy policy of any third-party site you visit. Separately from any link you click, the analytics and advertising tools described above send information about your visit to Google, Microsoft, and Meta while you are still on this Website.

Children

The Website is not intended for children under 18, and we do not knowingly collect personal information from children under 18 through the Website. If you believe a child has provided personal information through the Website, please contact us at info@darrensmithmd.com and we will delete it.

Security

We employ commercially reasonable administrative, technical, and physical safeguards to protect the information collected through the Website. However, because of the inherent risks of online activity, the safety of information transmitted over the internet cannot be guaranteed. Any transmission of information is at your own risk.

Retention

We retain website contact information for as long as necessary to respond to your inquiry, to maintain our relationship with you, and to meet our legal and recordkeeping obligations. Automatically collected usage data is retained in accordance with the retention settings of the analytics vendors described above.

Your choices and rights

You may decline to provide information to us, although this may prevent us from responding to your inquiry. You may control cookies and tracking technologies as described above. You may ask us to correct or delete the contact information you have provided through the Website by emailing info@darrensmithmd.com or calling (212) 633-0627. Requests to access, amend, or delete medical information are governed by Part II.

Depending on where you live, you may have additional rights under state privacy law.

Changes to this policy

It is our policy to post any changes we make to this policy on this page and to update the date at the top of this document. Your continued use of the Website after we post changes constitutes your acceptance of those changes. You are responsible for periodically visiting the Website and this policy to check for updates.

Contact us about this policy

To ask questions or comment about this policy and our privacy practices, contact us by email at info@darrensmithmd.com, by telephone at (212) 633-0627, or by mail at Darren M. Smith, M.D., P.C., 111 East 57th Street, Ground Floor, New York, NY 10022. Our office hours are Monday through Friday, 9:00 AM to 5:00 PM.

Part II. Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Effective date: September 24, 2026

Who this notice covers

This notice is provided by Darren M. Smith, M.D., P.C., a plastic surgery practice that operates NYC Surgical, PLLC, a private surgical center on site at 111 East 57th Street, Ground Floor, New York, NY 10022. The surgical center is accredited by QUAD A. This notice applies to the practice, its physician, its clinical and administrative staff, and the surgical center.

What protected health information is

Protected health information (“PHI”) is information that identifies you and relates to your past, present, or future physical or mental health, the health care you receive, or payment for that care. It includes your medical record, photographs taken for clinical purposes, billing records, and communications between you and the practice about your care. We are required by law to maintain the privacy of your PHI, to give you this notice of our legal duties and privacy practices, to follow the terms of the notice currently in effect, and to notify you if a breach of your unsecured PHI occurs.

How we may use and disclose your PHI without your authorization

The law permits us to use and disclose your PHI for the following purposes without your written authorization.

For treatment. We use your PHI to provide, coordinate, and manage your care. For example, the physician and clinical staff review your history and examination findings to plan a procedure, and we may share your information with an anesthesiologist, a laboratory, a pharmacy, or another physician involved in your care.

For payment. We use and disclose your PHI to obtain payment for the services we provide. The practice is out of network with all insurance plans. Where your care may be eligible for out-of-network benefits, and at your request, we may disclose information about your diagnosis and treatment to your insurer or prepare documentation for you to submit to your insurer. We may also disclose limited information to a third-party financing company you have chosen to use, to the extent needed to process your payment.

For health care operations. We use and disclose your PHI to run the practice and maintain the quality of care. Examples include quality review, accreditation activities of the surgical center, staff training, business planning, and obtaining legal, accounting, or other professional services. We may also use your contact information to remind you of an appointment or to tell you about treatment alternatives or health-related services we offer.

Business associates. We may disclose your PHI to companies that perform services for us, such as billing, electronic health record hosting, secure messaging, and legal services. Each business associate must sign a written agreement requiring it to protect your PHI. The Website’s hosting platform is not a business associate, and for that reason no PHI is stored on the Website.

Other uses and disclosures permitted or required by law. We may also use or disclose your PHI, subject to the conditions in the law, when required by federal, state, or local law; for public health activities such as reporting adverse reactions to medications or medical devices; to report suspected abuse, neglect, or domestic violence; for health oversight activities such as audits and inspections; in response to a court order, subpoena, or other lawful process; to law enforcement in limited circumstances; to a coroner, medical examiner, or funeral director; for organ and tissue donation; for certain research approved by a privacy board or institutional review board; to prevent a serious and imminent threat to health or safety; for specialized government functions such as military or national security activities; and for workers’ compensation purposes.

Uses and disclosures that require your written authorization

We will not use or disclose your PHI for any purpose not described in this notice without your written authorization. In particular, we will obtain your written authorization before we use or disclose your PHI for marketing purposes, before we sell your PHI, and before we use or disclose psychotherapy notes, if any.

Before-and-after photographs. Photographs of patients shown on the Website, in the office, in publications, or in educational presentations are of actual patients of the practice and are used only with the patient’s written consent. Consenting to photography for your medical record does not by itself authorize the practice to display your photographs; that requires a separate written authorization, which you may limit to specific uses and may revoke at any time in writing. Revocation does not affect uses that occurred before we received it.

Individuals involved in your care. Unless you object, we may share information relevant to your care with a family member, friend, or other person you identify as involved in your care or payment for your care. In an emergency or if you are unable to agree, we will use professional judgment to determine whether such a disclosure is in your best interest.

Your rights

You have the following rights with respect to your PHI. To exercise any of them, contact the practice in writing at the address in the Complaints section below.

• Right to access. You may inspect and obtain a copy of your medical and billing records, including an electronic copy where we maintain the record electronically. We may charge a reasonable, cost-based fee as permitted by federal and New York law.
• Right to amend. If you believe information in your record is incorrect or incomplete, you may ask us to amend it. We may deny the request in certain circumstances, and if we do, we will tell you why in writing and explain how you may respond.
• Right to an accounting of disclosures. You may request a list of certain disclosures we have made of your PHI during the six years before your request, other than disclosures for treatment, payment, health care operations, and certain other purposes.
• Right to request restrictions. You may ask us to limit how we use or disclose your PHI. We are not required to agree, except that we must agree not to disclose PHI to your health plan for a service you have paid for in full out of pocket, if you ask us in advance.
• Right to confidential communications. You may ask us to contact you in a specific way or at a specific location, such as by email rather than telephone or at a work address rather than home. We will accommodate reasonable requests.
• Right to notice of a breach. We will notify you if a breach compromises the privacy or security of your unsecured PHI.
• Right to a paper copy of this notice. You may obtain a paper copy of this notice at any time, even if you have agreed to receive it electronically.
• Right to revoke an authorization. You may revoke any written authorization you have given us at any time by notifying us in writing, except to the extent we have already acted in reliance on it.

Our duties and changes to this notice

We are required to abide by the terms of the notice currently in effect. We reserve the right to change this notice and our privacy practices, and to make the revised notice effective for PHI we already hold as well as PHI we receive in the future. If we make a material change, we will post the revised notice on the Website and in our office, and will make copies available on request. The effective date of the current notice appears at the top of Part II.

Complaints

If you believe your privacy rights have been violated, you may file a complaint with the practice or with the federal government. We will not retaliate against you for filing a complaint.

To file a complaint with the practice, contact our Privacy Officer by mail at Darren M. Smith, M.D., P.C., Attention: Privacy Officer, 111 East 57th Street, Ground Floor, New York, NY 10022; by telephone at (212) 633-0627; or by email at info@darrensmithmd.com.

To file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, write to 200 Independence Avenue, S.W., Washington, D.C. 20201; call 1-877-696-6775; or visit www.hhs.gov/ocr/privacy/hipaa/complaints/.

Contact the Privacy Officer

The practice’s Privacy Officer is Darren M. Smith, MD, FACS. For questions about this notice or the practice’s privacy practices, contact the Privacy Officer at the address, telephone number, or email address listed in the Complaints section above. Our office hours are Monday through Friday, 9:00 AM to 5:00 PM.