Madison Avenue Website Privacy Policy

Website Privacy Policy Effective Date: 8/31/2026

1. INTRODUCTION AND SCOPE. Madison Avenue TMS & Psychiatry (“Madison Avenue TMS,” “we,” “us,” or “our”) is a psychiatric practice operated by DAVID WOO M.D., P.C. registered at 515 Madison Avenue, RM 2310, located at 515 Madison Ave, Suite 2310, New York, NY 10022. We are committed to protecting the privacy of every person who visits our websites, contacts our practice, or receives our care.

This Privacy Policy describes how we collect, use, disclose, and protect information gathered through our websites, including:

  • www.madisonavetms.com (our main website)
  • quiz.madisonavetms.com (our online screening questionnaire)

(together, the “Sites”).

This Policy applies to information collected through the Sites. Protected health information that we create or receive as part of providing you care is additionally governed by our Notice of Privacy Practices under the Health Insurance Portability and Accountability Act (“HIPAA”), available at www.madisonavetms.com/privacy-notice/. Where this Policy and the Notice of Privacy Practices both apply to the same information, the Notice of Privacy Practices controls.

The Sites are intended for users located in the United States and are not directed to children under 13.

2. OUR COMMITMENT TO HIPAA COMPLIANCE. Madison Avenue TMS is a covered entity under HIPAA. We comply with the HIPAA Privacy Rule, Security Rule, and Breach Notification Rule with respect to Protected Health Information (“PHI”).

What this means in practice:

  • Health information you submit through our Sites is treated as PHI. When you complete our online screening questionnaire or otherwise send us information about your health (for example, your name, date of birth, contact details, symptoms, or medical history), we handle that information as PHI from the moment we receive it.
  • PHI is transmitted and stored securely. Information submitted through the Sites is encrypted in transit using TLS and stored on HIPAA-compliant infrastructure operated by our website, hosting, and analytics vendor, Medical Web Experts (“MWE”), acting as our business associate under a written Business Associate Agreement (“BAA”), as required by HIPAA. This BAA covers all services MWE provides to us, including the operation of the MWE Analytics platform described in Section 4.
  • PHI is used only for permitted purposes. We use health information submitted through the Sites to evaluate your inquiry, communicate with you about care, and for treatment, payment, and health care operations as described in our Notice of Privacy Practices. We do not sell PHI. We do not use or disclose PHI for advertising or marketing purposes without your written authorization.
  • PHI is never shared with advertising or social media platforms. No advertising pixels, ad-network tags, or third-party marketing trackers are present on the pages where health information is collected, and no PHI is transmitted to advertising platforms from any page of the Sites.
  • Access is restricted. Access to PHI is limited to authorized personnel of our practice and our business associates who need it to perform their duties, under role-based access controls and confidentiality obligations.

3. INFORMATION WE COLLECT

3.1 Information You Provide Voluntarily.

  • Contact and inquiry information. If you call us, complete a contact form, or email us, we collect the information you choose to provide, such as your name, phone number, email address, and the content of your message.
  • Online screening questionnaire. Our screening quiz at quiz.madisonavetms.com collects identifying and health-related information, which may include your name, date of birth, contact information, and information about your symptoms, medical history, and prior treatment. This information is PHI and is handled as described in Section 2.
  • Appointment and insurance information. If you pursue care with us, we may collect additional information needed for scheduling, insurance verification, and billing. This information is governed by our Notice of Privacy Practices.

Providing information through the Sites is voluntary. You may always contact our office by phone instead at (212) 731-2033.

3.2 Information Collected Automatically.

  • Traffic data. Our servers and service providers automatically log technical information such as IP address, browser type, device type, pages visited, and the date and time of access.
  • First-party analytics. We measure how the Sites are used through a privacy-protective, first-party analytics system (see Section 4).
  • Cookies. We use cookies and similar technologies as described in Section 5.

4. WEBSITE ANALYTICS. We take a deliberately conservative approach to analytics because we are a health care provider.

  • All analytics on the Sites is first-party. Both Sites are measured by MWE Analytics, a self-hosted analytics platform (built on Matomo, a privacy-focused analytics engine) operated for us by MWE on HIPAA-compliant infrastructure in the United States. MWE operates MWE Analytics as our business associate, under the same written Business Associate Agreement that covers its website development and hosting services for our practice. No separate analytics vendor is involved, and analytics data never leaves MWE’s environment.
  • What MWE Analytics collects on our main website. On www.madisonavetms.com, MWE Analytics records pages viewed, site search terms, and interaction events (for example, clicks on our phone number or on links to request a consultation), together with standard technical details (browser and device type) and a masked IP address, under a first-party cookie scoped to madisonavetms.com.
  • What MWE Analytics collects on the questionnaire, and what it does not. On quiz.madisonavetms.com, MWE Analytics records only limited usage events (for example, an event noting that a contact request was submitted) and standard technical details with a masked IP address. It does not record your questionnaire answers or results. Analytics data from either Site is not shared with any third-party advertising network and is not combined with data from other websites. To the extent any analytics record could identify you, it is protected as PHI under HIPAA and handled under the BAA described above. No Google Analytics, Google Ads, Meta (Facebook), or other third-party tracking technologies load on the screening questionnaire.
  • IP addresses are anonymized at collection. Our analytics platform is configured with Matomo’s IP anonymization feature enabled: the last two segments of your IP address are masked before storage (for example, 192.168.x.x), so your full IP address is never retained in analytics data, and the anonymized address is used for any geolocation.
  • Marketing pages may use standard advertising tools. The marketing pages of www.madisonavetms.com use Google Ads conversion tracking, the Meta (Facebook) pixel, and the LinkedIn Insight Tag to measure the effectiveness of our advertising. These tools receive standard web-browsing signals (such as pages viewed and ad-click identifiers) from the marketing site only. Our screening questionnaire and contact forms are served from quiz.madisonavetms.com, a separate environment that loads no advertising technologies; where a marketing page displays the questionnaire or a contact form, it does so in an embedded frame whose contents the advertising tools cannot access. The advertising tools do not receive your name, date of birth, health information, questionnaire answers or results, form submissions, or any other PHI.
  • Your choices. You can opt out of Google’s advertising cookies at adssettings.google.com, opt out of interest-based advertising through the Network Advertising Initiative at optout.networkadvertising.org, control the Meta pixel through your Facebook ad preferences, and opt out of LinkedIn advertising cookies in your LinkedIn ad settings (members) or at linkedin.com/psettings/guest-controls/retargeting-opt-out (non-members). Blocking these cookies does not affect your ability to use the Sites or to receive care.

5. COOKIES AND TRACKING TECHNOLOGIES. We use the following categories of cookies:

  • Strictly necessary cookies, required for the Sites to function (for example, session continuity in the screening questionnaire).
  • First-party analytics cookies, used by MWE Analytics as described in Section 4.
  • Advertising cookies, used only on marketing pages of www.madisonavetms.com as described in Section 4.

You can control cookies through your browser settings, including blocking or deleting them. We honor opt-out preference signals to the extent required by applicable law.

6. HOW WE USE INFORMATION. We use the information we collect to:

  • Respond to your inquiries and screening submissions and communicate with you about care;
  • Provide, schedule, and coordinate treatment, and carry out payment and health care operations;
  • Operate, secure, maintain, and improve the Sites;
  • Measure the effectiveness of our outreach on non-health marketing pages;
  • Comply with legal obligations, including HIPAA and New York law.

We do not sell personal information. We do not use or disclose PHI for marketing without your written authorization. We do not send marketing communications to you based on the content of your health information.

7. HOW WE SHARE INFORMATION. We share information only as follows:

  • Service providers / business associates. Vendors that host, develop, secure, or support the Sites and our operations, including MWE (website development, hosting, and the MWE Analytics platform), receive information only as needed to perform their services. Vendors that handle PHI do so under written Business Associate Agreements imposing HIPAA safeguards; MWE’s services, including MWE Analytics, are covered by such a BAA.
  • Treatment, payment, and health care operations. As described in our Notice of Privacy Practices (for example, coordinating with your insurer).
  • Legal requirements. When required by law, subpoena, or court order, or to prevent a serious threat to health or safety, consistent with HIPAA.
  • Business transfers. If our practice is merged, acquired, or reorganized, information may be transferred subject to the same protections described here and to HIPAA.

We never share PHI with data brokers, advertising networks, or social media platforms.

8. HOW WE PROTECT INFORMATION. We maintain administrative, technical, and physical safeguards appropriate to the sensitivity of the information we handle, including:

  • Encryption of all transmissions. All pages of the Sites are served exclusively over HTTPS, and all information you submit, including any transaction, contact, or medical information, is transmitted using SSL/TLS encryption;
  • Encryption of data at rest on systems storing PHI;
  • Hosting of Site-collected PHI on HIPAA-compliant infrastructure operated under a BAA;
  • Role-based access controls and least-privilege access to PHI;
  • Logging, monitoring, and periodic security testing of the Sites and supporting infrastructure;
  • Workforce training and confidentiality obligations.

No method of transmission or storage is completely secure. If a breach of unsecured PHI occurs, we will notify affected individuals and regulators as required by the HIPAA Breach Notification Rule and applicable state law, including the New York SHIELD Act.

9. DATA RETENTION. We retain information collected through the Sites only as long as needed for the purposes described in this Policy and to meet legal and professional obligations. Health information incorporated into your medical record is retained in accordance with New York medical record retention requirements. Analytics data is collected with a masked IP address, and raw analytics visit data is automatically deleted after 13 months; only aggregated, non-identifying statistics are retained beyond that period.

10. YOUR RIGHTS AND CHOICES.

  • HIPAA rights. With respect to PHI, you have rights described in our Notice of Privacy Practices, including the right to access and obtain a copy of your records, request amendment, request restrictions on certain uses and disclosures, request confidential communications, and receive an accounting of certain disclosures. To exercise these rights, contact us using the details in Section 14.
  • Marketing choices. You may opt out of any promotional emails via the unsubscribe link in those messages. You may opt out of advertising cookies as described in Section 4.
  • Do Not Track / opt-out signals. We honor browser-based opt-out preference signals, including Global Privacy Control (GPC), where legally required.

10.1 United States State Privacy Rights. Depending on your state of residence, state privacy laws (including, for example, the California Consumer Privacy Act as amended by the CPRA, and the comprehensive privacy laws of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and other states) may grant you additional rights with respect to personal information that is not governed by HIPAA, including the right to:

  • Know and access the personal information we hold about you;
  • Correct inaccurate personal information;
  • Delete personal information, subject to legal exceptions;
  • Obtain a portable copy of your personal information;
  • Opt out of the sale of personal information, the sharing of personal information for cross-context behavioral advertising, and targeted advertising;
  • Not receive discriminatory treatment for exercising these rights; and
  • Appeal a decision we make on a rights request.

How these laws interact with HIPAA. Most state privacy laws exempt PHI maintained by HIPAA covered entities. Your health information remains protected by, and your rights over it are exercised under, HIPAA and our Notice of Privacy Practices. State privacy rights generally apply to non-PHI website data, such as marketing analytics and advertising cookies.

Our practices, stated plainly:

  • We do not sell personal information, and we have not sold personal information in the preceding 12 months.
  • We do not sell or share consumer health data. For residents of states with consumer health data laws (such as the Washington My Health My Data Act and Nevada SB 370), we do not sell consumer health data, and we collect and share it only as described in this Policy and as permitted by law.
  • The only “sharing” for cross-context behavioral advertising that occurs is the advertising cookies described in Section 4, which operate on marketing pages only. You may opt out via the methods in Section 4, browser controls, or a GPC signal.

To exercise any of these rights, contact us using the details in Section 14. We will verify your request as required by law and respond within the legally applicable timeframe. You may use an authorized agent where permitted.

New York residents: while New York does not currently have a comprehensive consumer privacy law, your data is protected by the New York SHIELD Act’s data security requirements, and your health information by HIPAA and applicable New York law, including the confidentiality protections for mental health records under New York Mental Hygiene Law.

11. CHILDREN’S PRIVACY. The Sites are not directed to children under 13, and we do not knowingly collect personal information from children under 13 through the Sites. If we learn that we have collected such information, we will delete it promptly. Prospective patients under 18 should be assisted by a parent or legal guardian, who should contact our office directly.

12. THIRD-PARTY WEBSITES. The Sites may link to other websites (for example, treatment manufacturers’ sites or insurance portals). This Policy does not apply to those sites, and we are not responsible for their privacy practices. We encourage you to review the privacy policy of any site you visit.

13. CHANGES TO THIS POLICY. We may update this Policy from time to time. The “Last Updated” date at the top reflects the most recent revision. Material changes will be posted prominently on the Sites. Your continued use of the Sites after changes are posted constitutes acceptance of the revised Policy.

14. CONTACT US. If you have questions about this Privacy Policy, our privacy practices, or wish to exercise your rights:

Madison Avenue TMS & Psychiatry
Attn: Privacy Officer David Woo, President
515 Madison Ave, Suite 2310
New York, NY 10022
Phone: (212) 731-2033
Email: [email protected]

If you believe your privacy rights have been violated, you may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, at www.hhs.gov/ocr/privacy/hipaa/complaints. We will not retaliate against you for filing a complaint.