Privacy Policy
Website Privacy Policy
Wasatch Physical Therapy & Sports Medicine Website: https://wasatchpt.net Effective date: August 28th 2026 Last reviewed: August 28th 2026· Reviewed at least annually
This policy explains how we collect, use, and share information through wasatchpt.net and the tools linked from it — online scheduling, bill pay, and patient intake through Prompt and the patient portal.
Clinical records and other protected health information (PHI) are covered by the HIPAA Notice of Privacy Practices we provide to patients. If this website policy and that notice ever conflict regarding health information, the HIPAA Notice controls.
Who we are
Wasatch Physical Therapy & Sports Medicine ("Wasatch PT," "we," "us") is a physical therapy practice with clinics in:
Heber City: 376 Gateway Dr Ste 101, Heber City, UT 84032 · (435) 654-4525 · Fax (435) 654-4138
Park City: 597 Parkway Dr Suite C, Park City, UT 84098 · (435) 649-7335 · Fax (435) 649-7568
Email: office@wasatchpt.net
Privacy questions and requests go to our Privacy Officer at privacy@wasatchpt.net or by calling either clinic.
This policy is available in large print on request, and we provide language assistance at no cost. Ask at either front desk.
Information we collect
1. Information you send us directly
The public website does not host a contact form. If you email or call us, we receive whatever you choose to send: your name, contact details, and your message.
Email is not a secure channel. Please do not email medical records, Social Security numbers, or payment card numbers. If you send us health details by email, we may respond by phone or through the patient portal rather than by reply email.
2. Prompt EMR (scheduling, bill pay, and intake)
The website directs you to Prompt for:
Scheduling:https://scheduling.go.promptemr.com/onlineScheduling
Bill pay:https://go.promptemr.com/payment
Patient intake and the patient portal
Prompt is a separate company operating under a HIPAA Business Associate Agreement with us. Information you enter in Prompt is collected under Prompt's terms and privacy policy, and we receive what we need to treat you, schedule you, and manage your account.
These pages are hosted on Prompt's own domains. Our website analytics do not run on them.
Completed intakes come back to us through Prompt or the patient portal. Do not email a completed intake form.
3. What the patient intake asks for
Our contact page offers a downloadable intake packet so you can review the questions before completing them in Prompt. Whether you complete it in the portal or use the PDF as a worksheet, the information we retain is the same. The intake asks for:
Identity and contact: legal name, date of birth, sex, mailing address, phone numbers, email (including a parent or guardian email where applicable), employer, marital status
Social Security number — optional. We request it only to help distinguish patients with similar identifying details and to support account collections. You may decline; declining does not affect your care.
Care coordination: referring physician, work status, date of injury or onset
Billing and insurance: person responsible for payment; primary and secondary insurance (subscriber name and date of birth, member and group numbers); workers' compensation and auto-claim details where applicable
Health information: past medical history, medications, allergies, pregnancy, imaging and surgical history, pain rating, activity limits, and related clinical details
Signatures and consents: conditions of admission, HIPAA acknowledgment, cancellation policy
The intake contains PHI. Once submitted through Prompt it becomes part of your clinical and billing record, and we use it to treat you, bill you or your payer, and operate the practice.
4. Payment cards
We keep a card on file to support our no-show and late-cancellation policy. Card details are entered only through Prompt's secure payment system.
We do not store full card numbers, and we never store card security codes (CVV/CVC). Our records retain a payment token supplied by our processor plus the card brand and last four digits. The downloadable intake worksheet does not include a card section — do not write card details on paper, fax them, or email them.
5. Website analytics
Our website is hosted on Squarespace. We use two analytics tools to understand whether the site is working:
Google Analytics 4 (measurement ID G-HCGEFRQ9G7)
Microsoft Clarity
These tools set cookies and may collect IP address, device and browser type, pages viewed, approximate location, and general navigation behavior.
We limit them as follows:
They run only on our public informational pages. They do not run on Prompt's scheduling, bill pay, intake, or patient portal pages.
Microsoft Clarity session recording is configured to mask all text and form input.
Google Signals and advertising personalization are disabled in Google Analytics, and analytics data retention is set to the shortest interval available.
These tools do not receive your name, your health information, or any information you submit to us as a patient. We do not use website analytics to make treatment or billing decisions.
6. What we do not use
We do not use advertising or social media tracking pixels on this website. There is no Meta/Facebook Pixel, no Google Ads conversion tag, and no comparable advertising tracker on wasatchpt.net.
We do not sell your personal information, and we do not share it for targeted or cross-context behavioral advertising. Because we do not sell or share your data in this way, there is nothing for you to opt out of.
7. Social media
Our website links to Facebook and Instagram (@wasatchptheber). If you follow or message us there, those platforms' own policies govern what you share with them.
How we use information
Respond to your questions and schedule or change visits
Provide physical therapy and related care
Verify insurance, collect payment, and run billing, including no-show and late-cancellation fees
Send appointment reminders
Meet legal, payer, and professional recordkeeping requirements
Maintain and improve the website
Text and email communications
By providing a mobile number, you agree that we may send you appointment reminders by text and email. We typically send these on scheduling, roughly one day before your visit, and a few hours before your visit.
Message and data rates may apply. Reply STOP to any reminder text, or tell the office, to opt out. Opting out of reminders does not stop us from contacting you about your active care — for example, to reach you about a schedule change or a clinical matter.
Marketing and affiliated businesses
Some of our owners and staff are involved in other businesses in the community. We do not use patient information to market those businesses, or any other product or service, without your written HIPAA authorization. Patient lists are not shared across businesses.
Consent to receive appointment reminders is not consent to receive promotional messages. If we ever want to send you marketing texts or emails, we will ask separately and you can decline without any effect on your care.
We do not sell, rent, or trade patient lists.
How we share information
Vendors that handle health information under a Business Associate Agreement
Prompt EMR (electronic health record, scheduling, intake, payment processing)
Our email and telephone providers
Our billing and collections vendors
Vendors that support the website and do not receive health information
Squarespace (website hosting)
Google Analytics and Microsoft Clarity (website measurement, as limited above)
These website vendors are not Business Associates and do not receive PHI.
Other permitted disclosures
To treat you: other clinicians, referring providers, and observers involved in training, as described in your intake consents
To get paid: your health insurer, and workers' compensation carriers as Utah law and HIPAA permit without your authorization. Disclosures to auto or other liability carriers are made with your authorization or as your claim assignment directs.
To follow the law: required reporting, subpoenas, regulators
Business transitions: if the practice is sold, merged, or transferred, your records may transfer to the successor practice. Limited information may be reviewed under written confidentiality obligations during due diligence. HIPAA treats this as a health care operation.
Anything else: only with your written authorization, which you may revoke at any time
Fax may be used for permitted health-information disclosures, as your intake consent describes.
Retention
Website and email inquiries: kept only as long as needed to respond to you and to maintain a reasonable business record, then deleted or archived.
Scheduling, billing, and clinical records (including completed intakes in Prompt): kept at least as long as Utah and federal law require. In practice this is seven years after the last visit for adults, and for minors until seven years after the eighteenth birthday or seven years after the last visit, whichever is later. Payer contracts may require longer retention.
HIPAA documentation: privacy and security policies, authorizations, and related records are kept at least six years, as HIPAA requires.
Analytics data: retained for the shortest period our analytics tools allow.
Disposal. We maintain a written records retention schedule. When records reach the end of their retention period, we dispose of them securely — paper records are cross-cut shredded, and electronic records and media are securely erased or destroyed.
Security
We use reasonable administrative, technical, and physical safeguards for the information we control, including access controls, workforce training, and vendor agreements.
Access is limited to workforce members with a business need for the information. We apply HIPAA's minimum necessary standard, meaning staff see only the information required to do their job.
No website or email system is completely secure. Do not send Social Security numbers or full card numbers by unencrypted email.
If a breach of your unsecured protected health information occurs, we will notify you without unreasonable delay and no later than 60 days after discovery, as HIPAA and Utah law require.
Children and minors
We treat minors when a parent or guardian is involved. The intake asks for a parent or guardian email and a guardian signature.
This website is not directed to children under 13 as a consumer service, and we do not knowingly collect website analytics about children for marketing purposes.
Your rights and choices
You may:
Access your records. Request a copy of your health information. You may choose an electronic copy where we maintain the record electronically, and you may ask us to send it directly to a person or organization you name in writing. We respond within 30 days, and may extend once by an additional 30 days with written notice to you. We may charge a reasonable, cost-based fee for copies; we will tell you the amount in advance, and there is no fee to inspect your record.
Revoke an authorization you previously gave us, in writing, at any time. Revoking it does not undo disclosures we already made while it was in effect.
Request a correction to information you believe is inaccurate or incomplete.
Request restrictions on certain uses or disclosures. We will consider your request, though we may not be able to agree where a restriction would block treatment or payment.
Request confidential communications — ask us to contact you at an alternate address or phone number.
Request an accounting of certain disclosures we have made of your health information.
Opt out of appointment reminders by replying STOP or telling the office.
Receive notice if a breach affects your unsecured health information.
Request a paper copy of this policy or of our HIPAA Notice of Privacy Practices, available at the front desk or in the patient portal.
To make any request, email privacy@wasatchpt.net or call the clinic you visit.
We verify identity before releasing records. Expect us to ask for photo identification or other reasonable proof before we act on a request. This protects your information.
Personal representatives. Someone with legal authority to act for you — a parent or guardian of a minor, a holder of a health care power of attorney, or the executor of an estate — may exercise these rights on your behalf. We will ask for documentation of that authority. In limited circumstances Utah law lets us decline, such as where we reasonably believe involving that person would endanger you.
State privacy rights. We do not sell personal data or share it for cross-context behavioral advertising. Most information we hold about patients is protected health information, which is governed by HIPAA rather than state consumer privacy law. Where a state privacy law grants you a right that applies to a specific request, we will honor it.
Managing cookies. You can block or delete cookies through your browser settings; some site features may not work as well if you do. You can also opt out of Google Analytics using Google's browser opt-out add-on, and out of Microsoft Clarity through the opt-out controls in Microsoft's privacy statement.
Do Not Track and browser opt-out signals. Some browsers send a "Do Not Track" (DNT) or Global Privacy Control (GPC) signal. Our website is not currently configured to detect or respond to these signals. Because we do not sell personal information or share it for cross-context behavioral advertising, these signals would not change how we handle your information. To limit website analytics, use the cookie and opt-out methods described above.
Third-party websites
The services below operate outside this website. Their own privacy policies govern the information they collect:
ServiceRolePrivacy policyPrompt EMRScheduling, intake, bill pay, patient portal https://www.prompthealth.com/legal/privacy-policy
SquarespaceWebsite hostinghttps://www.squarespace.com/privacy
Google AnalyticsWebsite measurementhttps://policies.google.com/privacy
Microsoft ClarityWebsite measurementhttps://privacy.microsoft.com/privacystatement
Facebook / InstagramSocial media pageshttps://www.facebook.com/privacy/policy
We do not control or endorse the content or privacy practices of sites we link to. If you visit them, you do so under their terms.
Changes to this policy
We review this policy at least once a year and may update it at other times. The effective date and last-reviewed date at the top will change when we do. For material changes affecting health information, we will follow HIPAA notice requirements, including providing a revised Notice of Privacy Practices.
Contact and complaints
Wasatch Physical Therapy & Sports Medicine — Privacy Officerprivacy@wasatchpt.net Heber City (435) 654-4525 · Park City (435) 649-7335
If you believe we have misused your health information, please contact our Privacy Officer first so we can address it. You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, at https://www.hhs.gov/ocr/complaints. A complaint to OCR generally must be filed within 180 days of when you knew the problem occurred.
We will not retaliate against you for filing a complaint, and it will not affect your care.