Privacy Policy and Notice of Privacy Practices

Effective Date: February 16, 2026
Last Updated: July 21, 2026

The Tooth Shop
2276 S Higley Rd, Suite 106
Gilbert, AZ 85295
Phone: (480) 915-2195
Contact form: https://www.toothshop-az.com/contact/

This Privacy Policy and Notice of Privacy Practices describes how The Tooth Shop (“we,” “us,” or “our”) collects, uses, discloses, and safeguards personal information, including protected health information (“PHI”), when you interact with our website, services, forms, office, or SMS/text messaging program.

This Notice also describes how medical and dental information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

We reserve the right to change our privacy practices and the terms of this Notice at any time, as permitted by law. Any revised Notice will apply to all PHI we maintain — past, present, and future. We will post the current Notice in our office and on our website. A paper copy is available at the front desk at no charge. Material changes will be communicated to patients as required by law.

1. Information We Collect

We may collect the following categories of personal information:

Contact Information

This may include your name, email address, mailing address, phone number, and other information you provide when contacting us, submitting a form, scheduling an appointment, or communicating with our office.

Health and Dental Information

This may include information related to your dental history, medical history, treatment needs, appointment history, insurance, billing, dental records, treatment plans, and other protected health information used to provide care.

Transaction and Payment Information

This may include records of services you have received, services you have inquired about, billing details, insurance information, claims information, and payment-related records.

Communications Data

This may include messages you send to us, form submissions, customer support interactions, appointment requests, feedback, and communications with our office by phone, email, text message, or through our website.

Technical Data

This may include IP address, browser type, device information, website usage data, cookies, analytics data, and similar technologies used to improve website performance, security, and user experience.

SMS/Text Messaging Data

This may include your mobile phone number, SMS opt-in status, messaging preferences, and your consent to receive text messages from The Tooth Shop.

2. How We Use Your Information

We may use the information we collect to:

Provide, coordinate, and manage dental care
Schedule and confirm appointments
Send appointment reminders and follow-up communications
Respond to inquiries and provide customer support
Verify insurance coverage and process payments
Submit claims and work with billing partners
Operate, maintain, and improve our website and services
Send transactional, operational, or service-related communications
Comply with legal, regulatory, and professional obligations
Protect the security and integrity of our website, systems, patients, and practice

3. SMS/Text Messaging Consent and Data

When you opt in to receive SMS or text messages from The Tooth Shop, we collect your mobile phone number and your express consent to receive text messages.

All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

Mobile information, text messaging opt-in data, and SMS consent will not be shared with third parties or affiliates for marketing or promotional purposes.

Your SMS opt-in data and consent information will not be shared with, sold to, rented to, traded with, or purchased by any third party or affiliate for marketing or promotional purposes under any circumstances.

SMS opt-in and consent records may be retained as needed to comply with carrier, regulatory, legal, and business recordkeeping requirements.

4. How We May Use and Disclose Your Health Information

The following describes how we may use and disclose your PHI. Not every possible use is listed. All uses will fall within these categories or will otherwise be permitted or required by law.

Treatment

We may use and disclose your PHI to provide, coordinate, or manage your dental care. This includes sharing information with other providers involved in your care, planning and performing treatment, and obtaining referrals when needed.

Payment

We may use and disclose your PHI to obtain payment for services, such as verifying your insurance coverage, submitting claims, collecting payment, and working with third parties who assist with billing.

Health Care Operations

We may use and disclose your PHI for activities that keep our practice running well, including quality improvement, staff training, credentialing, audits, legal services, compliance services, and practice management.

Appointment Reminders and Health-Related Communications

We may contact you with appointment reminders by phone, text, email, postcard, or letter. We may also contact you to inform you about treatment options, follow-up care, or related services.

If you prefer a specific method of contact, please let us know in writing. We will honor all reasonable requests.

5. Other Uses and Disclosures Permitted or Required by Law

We may also use or disclose your PHI as allowed or required by applicable federal and state law, including:

Required by Law: When a specific law requires us to report or disclose PHI.
Public Health Activities: Reporting diseases, injuries, adverse events, or product defects.
Abuse, Neglect, or Domestic Violence: To an authorized government authority when required by law.
Health Oversight Activities: To agencies conducting legally authorized audits, inspections, or investigations.
Legal Proceedings and Law Enforcement: In response to a court order, subpoena, warrant, or other lawful process.
Coroners, Medical Examiners, and Funeral Directors: To assist in identifying a deceased person or determining cause of death.
Organ and Tissue Donation: To facilitate organ or tissue procurement, banking, or transplantation.
Research: Under certain conditions, with required approvals and privacy safeguards in place.
To Avert a Serious Threat: To prevent or lessen a serious, imminent threat to health or safety.
Specialized Government Functions: For certain military, national security, or protective services activities.
Workers’ Compensation: As authorized or required by workers’ compensation laws.

6. Sharing of Personal Information

We do not sell, rent, or trade your personal information.

We may share information only in limited circumstances, including:

Service Providers

We may share information with trusted vendors who help us operate our business and provide services, such as website hosting, appointment scheduling, billing support, payment processing, analytics, communication tools, email platforms, SMS providers, and other practice-support services.

These service providers are only permitted to use information as needed to provide services to The Tooth Shop and are required to protect the information they handle.

Legal Requirements

We may disclose information when required by law, court order, subpoena, government authority, legal process, or to protect the rights, safety, and security of our patients, practice, staff, or others.

Business Transfers

We may disclose information in connection with a merger, acquisition, sale of assets, restructuring, or similar business transaction, subject to applicable privacy and healthcare laws.

SMS Consent Limitation

Mobile information and opt-in consent will not be shared with third parties or affiliates for marketing or promotional purposes.

All categories of data sharing described in this Privacy Policy and Notice exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

7. Cookies and Tracking Technologies

Our website may use cookies and similar tracking technologies to improve website functionality, understand visitor behavior, enhance user experience, and support website security.

You can control cookie preferences through your browser settings. Disabling cookies may affect some website functionality.

8. Data Retention

We retain personal information and PHI only as long as necessary to fulfill the purposes described in this policy, provide care, operate our practice, comply with legal and professional obligations, resolve disputes, and maintain required records.

SMS opt-in and consent records are retained in accordance with applicable carrier, regulatory, legal, and business requirements.

9. Security

We implement reasonable administrative, technical, and physical safeguards to protect your information.

No method of transmission over the internet or method of electronic storage is 100% secure. While we work to protect your information, we cannot guarantee absolute security.

10. Children’s Privacy

Our website and online services are intended for use by adults, parents, and legal guardians. We do not knowingly collect personal information directly from children under 13 through our website without appropriate parental or guardian involvement.

Because The Tooth Shop provides pediatric dental care, health information about children may be collected from parents or legal guardians as part of treatment, payment, and healthcare operations.

If you believe we have inadvertently collected information from a child without appropriate consent, please contact us.

11. Special Protections for Certain Types of Information

Some information is subject to additional federal or state protections. Where required, we will obtain your written permission before using or disclosing this type of information, or we will follow any additional limitations that apply.

Specially protected categories may include:

HIV/AIDS-related information
Genetic information
Mental health and psychotherapy records
Substance use disorder treatment information

12. Substance Use Disorder Records — 42 CFR Part 2

While The Tooth Shop is not a federally assisted substance use disorder treatment program, we may receive substance use disorder-related records from other providers as part of coordinating your care. When we receive or maintain such records, additional protections may apply.

If we receive or maintain any information about you from a substance use disorder treatment program that is covered by 42 CFR Part 2, a “Part 2 Program,” through a general consent you provide to the Part 2 Program to use and disclose the Part 2 Program record for purposes of treatment, payment, or health care operations, we may use and disclose your Part 2 Program record for treatment, payment, and health care operations purposes as described in this Notice.

If we receive or maintain your Part 2 Program record through specific consent you provide to us or another third party, we will use and disclose your Part 2 Program record only as expressly permitted by you in your consent as provided to us.

General Consent

If you give a general consent to a Part 2 Program for treatment, payment, and health care operations, we may use and disclose those records for those same purposes, consistent with both HIPAA and Part 2.

Specific Consent

If you provide us a specific, direct consent regarding Part 2 records, we will only use or disclose those records as expressly authorized, unless otherwise required by law.

Legal Proceedings

We will not use or disclose your Part 2 Program record, or testimony that describes the information contained in your Part 2 Program record, in any civil, criminal, administrative, or legislative proceedings by any federal, state, or local authority against you, unless authorized by your consent or the order of a court after it provides you notice of the court order.

Redisclosure

Any redisclosure of Part 2 records by our practice will be limited as required by Part 2 regulations and will include required notices of the continued confidentiality protections that apply.

Part 2 imposes stricter confidentiality rules than standard HIPAA in certain circumstances. We will always follow the more protective standard when handling these records.

13. Uses and Disclosures Requiring Your Written Authorization

For uses and disclosures not described in this Notice, we will obtain your written authorization before proceeding. You may revoke any authorization in writing at any time.

Examples include:

Most uses and disclosures of psychotherapy notes, if applicable
Uses or disclosures for most marketing purposes
The sale of your PHI
Any other use or disclosure not otherwise permitted or required by law

14. Your Rights Regarding Your Health Information

To exercise any of the rights below, please submit a written request to our Privacy Officer.

Right to Access Your Records

You may inspect and obtain a copy of the PHI we maintain about you, with limited exceptions. We will provide electronic copies when readily available. A reasonable, cost-based fee may apply for copies or mailing.

Right to Request an Amendment

If you believe your PHI is incomplete or inaccurate, you may request in writing that we amend it. We may deny your request in certain circumstances but will provide a written explanation and inform you of your options.

Right to an Accounting of Disclosures

You may request a list of certain disclosures of your PHI made in the past six years, excluding disclosures for treatment, payment, and health care operations. The first request in any 12-month period is free; a reasonable fee may apply for additional requests.

Right to Request Restrictions

You may request that we limit how we use or disclose your PHI. We are not required to agree to most requests. However, we must honor a request if all of the following are true:

The disclosure is to a health plan for payment or health care operations
The PHI relates solely to a health care item or service for which you, or someone on your behalf, paid us in full
The disclosure is not otherwise required by law

Right to Request Confidential Communications

You may ask us to contact you using a specific method or at a specific address or phone number. We will accommodate all reasonable requests.

Right to a Paper Copy of This Notice

You may request a paper copy at any time, even if you previously agreed to receive it electronically. The current Notice is also available on our website and at our front desk.

Right to Be Notified of a Breach

If there is a breach of your unsecured PHI as defined by federal law, you have the right to receive written notification without unreasonable delay and no later than 60 days after discovery of the breach.

Right to File a Complaint Without Retaliation

You will never be penalized, denied care, or otherwise retaliated against for exercising any of your rights under this Notice or HIPAA.

15. Your Rights Regarding Personal Information

Depending on your jurisdiction and applicable law, you may have the right to:

Access, correct, or delete certain personal information
Opt out of certain data uses or marketing communications
Request data portability
Withdraw SMS consent by replying STOP
Lodge a complaint with a supervisory authority or regulatory agency

To exercise these rights, please contact us using the contact information below.

16. SMS Opt-Out and Support

You may opt out of SMS communications at any time.

Reply STOP to unsubscribe from SMS communications.

After texting STOP, you may receive one final confirmation message that you have been unsubscribed.

For assistance:

Reply HELP for assistance.

You may also contact us at (480) 525-7110 or through our contact form:
https://www.toothshop-az.com/contact/

Carriers are not liable for any delayed or undelivered messages.

17. Changes to This Privacy Policy and Notice

We may update this Privacy Policy and Notice from time to time. We will notify you of material changes by posting the updated policy on our website with a revised effective date and by providing additional notice when required by law.

Continued use of our website, services, or SMS messaging program after updates are posted constitutes acceptance of the updated policy, to the extent permitted by law.

18. Questions and Complaints

If you have questions about your privacy rights or believe your rights have been violated, please contact us or file a complaint with HHS.

Privacy Officer

The Tooth Shop
2276 S Higley Rd, Suite 106
Gilbert, AZ 85295
Phone: (480) 525-7110
Contact form: https://www.toothshop-az.com/contact/

U.S. Department of Health & Human Services

Office for Civil Rights
https://www.hhs.gov/ocr/privacy
1-800-368-1019
TTY: 1-800-537-7697

You will not be retaliated against for filing a complaint.

19. Acknowledgment of Receipt

A copy of this Notice will be provided to each patient at or before the first date of service. You may be asked to sign a separate acknowledgment form confirming receipt.

Prepared in accordance with 45 C.F.R. §164.520 and 42 C.F.R. Part 2 as amended. This document does not constitute legal advice.