Apex Brain & Spine PLLC

Effective Date: 11/4/2026

Apex Brain & Spine PLLC (“Practice,” “we,” “us,” or “our”) is committed to protecting the privacy of individuals who visit our website at apexbrainandspine.com and any related subdomains, mobile versions, or associated pages (collectively, the “Site”). This Website Privacy Policy (“Policy”) describes in detail the information we collect, how we use and disclose it, the choices available to you, and the security measures we implement.

This Policy applies solely to information collected through the Site. It does not govern protected health information (“PHI”) created, received, maintained, or transmitted by the Practice in the course of providing health care services. All PHI is governed by our Notice of Privacy Practices, the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), the HIPAA Privacy, Security, and Breach Notification Rules, Florida law (including Fla. Stat. § 456.057), and other applicable federal and state laws. Where state law provides greater protection than HIPAA, we follow the more protective standard.

Any health-related information you voluntarily submit through Site forms or communications becomes PHI once received by the Practice and is thereafter handled exclusively under our Notice of Privacy Practices and applicable law. Do not use general contact forms for detailed clinical information; use only the secure channels we designate.

1. Information We Collect

We collect information in the following categories. We do not sell personal information and do not use it for targeted advertising in a manner that constitutes a “sale” under applicable state privacy laws.

a. Information You Provide Directly

• Name, email address, telephone number, mailing address, and any message or inquiry content submitted via contact forms, appointment request forms, newsletter sign-ups, or other interactive features.

• Any additional information you choose to include in communications with us.

• We strongly discourage submission of sensitive medical history, diagnoses, or detailed health information through unsecured general contact forms.

b. Information Collected Automatically

• Device and browser data (IP address, browser type and version, operating system, device identifiers, screen resolution).

• Usage data (pages viewed, time spent, clickstream data, referring and exit URLs, approximate geographic location derived from IP address).

• Technical data necessary for Site security and operation.

c. Cookies, Pixels, and Similar Technologies

We use a consent management platform (currently Usercentrics or a successor) that categorizes technologies as Essential, Functional, Analytical, and Marketing. Essential cookies are required for basic Site functionality and cannot be disabled. Non-essential cookies and tracking technologies are deployed only with your consent where required by law. You may withdraw or modify consent at any time through the consent banner or tool. Blocking non-essential cookies may limit certain Site features.

d. Information from Third Parties

Limited information from analytics providers, social media platforms (if you interact with embedded content), or referral sources. We do not control the privacy practices of these third parties.

e. Children’s Information

The Site is not directed to children under 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected such information, we will delete it promptly.

2. How We Use Information

We use collected information solely for legitimate purposes, including:

• Responding to your inquiries and processing appointment requests.

• Operating, securing, maintaining, troubleshooting, and improving the Site.

• Analyzing usage patterns in aggregated or de-identified form to enhance performance and content.

• Communicating administrative or service-related messages.

• Detecting, preventing, and responding to fraud, security incidents, or violations of our Terms of Use.

• Complying with legal obligations, responding to lawful requests, and protecting the rights, property, or safety of the Practice, our patients, staff, or others.

• With appropriate consent or as otherwise permitted by law, for limited marketing or educational outreach (you may opt out at any time).

We use the minimum information reasonably necessary to accomplish these purposes.

3. How We Disclose Information

We do not sell, rent, or trade your personal information. We may disclose information only in the following limited circumstances:

• To service providers and vendors who process data on our behalf (website hosting, analytics, email delivery, consent management, appointment scheduling systems) under written agreements requiring them to protect the information and use it only for the services they provide to us.

• To professional advisors (attorneys, accountants, insurers) under confidentiality obligations.

• When required by law, regulation, subpoena, court order, or governmental request, or to protect rights, safety, or property.

• In connection with a merger, acquisition, reorganization, or sale of assets, subject to appropriate confidentiality protections.

• With your explicit consent.

Any PHI is disclosed only as permitted by HIPAA, our Notice of Privacy Practices, and applicable law.

4. Data Retention

We retain personal information collected through the Site only for as long as necessary to fulfill the purposes described in this Policy, comply with legal obligations, resolve disputes, and enforce our agreements. Retention periods vary by data type and legal requirements. PHI is retained in accordance with our medical records policies and applicable law.

5. Data Security

We implement reasonable administrative, technical, and physical safeguards designed to protect information collected through the Site against unauthorized access, alteration, disclosure, or destruction. These measures include access controls, encryption where appropriate, and vendor oversight. However, no method of electronic transmission or storage is completely secure. We cannot and do not guarantee absolute security of any information transmitted to or from the Site. You transmit information at your own risk. We are not responsible for the security or confidentiality of information you transmit through unsecured means (including ordinary email or general contact forms).

6. Your Rights and Choices

Subject to applicable law, you may have the right to:

• Access, correct, or delete certain personal information we hold about you.

• Opt out of certain processing or marketing communications.

• Withdraw consent for non-essential cookies.

• Lodge a complaint with a supervisory authority.

Florida residents and residents of other states with comprehensive privacy laws may have additional rights. To exercise any rights or submit a request, contact us using the information below. We will verify your identity and respond within the timeframes required by law. We will not discriminate against you for exercising privacy rights.

Rights related to PHI are governed exclusively by our Notice of Privacy Practices and HIPAA.

7. Third-Party Websites and Embedded Content

The Site may contain links to third-party websites, social media platforms, or embedded content (videos, maps, reviews). We do not control and are not responsible for the privacy practices, content, or security of any third-party site or service. Your interactions with third parties are solely between you and them. Review their privacy policies before providing any information.

8. International Transfers

The Site is operated from the United States. If you access the Site from outside the United States, you understand that information may be transferred to, stored, and processed in the United States, where privacy laws may differ from those in your jurisdiction.

9. Changes to This Policy

We reserve the right to modify this Policy at any time. Material changes will be posted on the Site with an updated effective date. Your continued use of the Site after the effective date of any changes constitutes your acceptance of the revised Policy. We encourage periodic review of this Policy.

10. Contact Information

Privacy Officer: Gregory Cannarsa, MD

Apex Brain & Spine PLLC

3530 Kraft Road, Suite 203

Naples, FL 34105

Phone: 239-422-2739

Email: info@apexbrainandspine.com

For questions about this Website Privacy Policy, data practices related to the Site, or to exercise rights described herein, contact us at the above information. For questions regarding your medical records or PHI, please refer exclusively to our Notice of Privacy Practices.

Reservation of Rights: Nothing in this Policy creates any contractual rights or obligations beyond those required by applicable law. We reserve all rights not expressly granted.

© 2026 Apex Brain & Spine PLLC. All rights reserved.