Effective date: September 17, 2026. This policy describes the privacy practices of the Florida Hellthcare website and companion plugin. Hosting, email, security, backup, or other services may add practices that the site administrator must review and disclose.
Who we are
Florida Hellthcare is an independent research, advocacy, and public-education project operated by Travis Brett Creighton. The website address is https://floridahellthcare.com. For a privacy request, use the Contact form and enter “Privacy Request” as the subject.
Three different submission paths
Contact form
The short Contact form collects a name, email address, role, subject, message, and privacy acknowledgment. A valid message is stored as a nonpublic WordPress Message and the complete message is emailed to the WordPress administration address. The stored WordPress Message is not separately field-encrypted by the companion plugin. Website databases, backups, mail systems, and security logs may retain copies.
Share Information form
The Share Information form collects contact information, the submitted account or research lead, and separate choices governing aggregation, individual use, editing, attribution, and requested redactions. The submitted payload is encrypted before database storage. The administrator notification contains a reference number but no submitted answers.
Attorney Practice Survey
The Attorney Practice Survey collects optional Florida Bar verification information, practice characteristics, range-based experience measures, case-evaluation factors, comments, and publication permissions. The survey payload is encrypted before database storage. The administrator notification contains a reference number and verification status but no survey answers.
Attorney directory and email verification
An administrator may import a directory containing Florida Bar numbers, directory email addresses, names, ZIP codes, and membership status. Directory profiles are encrypted during import, and the uploaded CSV is not retained by the plugin. A keyed index of the normalized Bar number permits matching without storing the Bar number as a readable database index.
At the respondent’s request, Florida Hellthcare may use the submitted Bar number to retrieve that attorney’s corresponding public Florida Bar member profile and send a short-lived, single-use verification message to the directory email address shown there. The lookup is limited to the profile requested for verification and is not used to collect unrelated member profiles. The message provides a one-click link and a six-digit code. Successful use verifies access to that directory email account at that time. It does not conclusively prove identity, current membership status, or authorship of every answer. A respondent may continue without verification, and the response remains labeled accordingly.
The one-click link necessarily contains a random verification token in its URL. The readable code is not stored by the plugin. Only protected token or code representations are retained during the short verification period, but the link may temporarily appear in email-security systems, browser history, or web access logs. The token and code expire and are single-use.
Encryption, access, and information outside the encrypted payload
Share Information and Attorney Survey payloads are encrypted at rest using authenticated encryption provided by PHP Sodium. The encryption key is configured separately from the database. Only an authorized WordPress administrator with the required capability and access to the correct key can open those payloads through the site dashboard.
Operational fields needed to manage a submission remain outside the encrypted payload. These can include the random public reference number, submission type, workflow status, verification status, consent version, and received or updated time. Anyone who obtains both the database and the encryption key may be able to decrypt the protected payload. Encryption at rest does not eliminate risks involving an authorized administrator, a compromised server, a visitor’s device, email delivery, or information copied into an export.
Purpose and publication choices
Information is used to receive and respond to inquiries, manage research leads and family accounts, measure attorney practice experience, maintain site security, document publication permission, and comply with legal obligations. Submission does not guarantee publication. Permission to aggregate information does not authorize publication of an identifiable individual account. Individual use, editing, attribution, and requested redactions are controlled by the choices shown on the applicable form.
Data minimization
Do not submit medical records, Social Security numbers, complete dates of birth, financial account information, client names, privileged communications, case-identifying facts, or material you are not authorized to provide. Requested redactions reduce risk but cannot guarantee anonymity because dates, locations, rare events, relationships, and narrative details may identify a person.
Comments, accounts, cookies, and external services
Public comments and visitor registration are not currently enabled. The public site does not provide visitor media uploads or add advertising cookies. It uses the limited site analytics described below. WordPress uses login and preference cookies for authorized administrators. Hosting and security services may create technical logs or use essential anti-abuse measures. External links lead to services governed by their own privacy practices.
Site analytics
Florida Hellthcare uses Google Analytics through Google Site Kit to understand visits, page use, referrals, device and browser characteristics, and approximate geographic information. Google and the site may use cookies or similar identifiers to provide these measurements. Logged-in WordPress administrators are excluded by the current Site Kit configuration. Analytics should not be used to send the contents of contact, information-sharing, or attorney-survey submissions to Google. Visitors can limit cookies through browser controls, and Google applies its own privacy terms to the service.
Who may receive information
Information may be processed by the website host, email or SMTP provider, backup provider, and security services as needed to operate the site. It may also be disclosed when required by law, to protect rights or safety, or with further permission. Personal information is not sold, rented, traded, or provided for third-party marketing.
Retention and deletion
The project uses an administrative retention policy rather than promising automatic deletion. Contact messages and identifiable submission data should be reviewed at least annually and ordinarily deleted within 24 months after the last substantive communication or the completion of the documented research purpose, unless a shorter period is requested or a longer period is reasonably necessary for legal, administrative, security, source-verification, or documented research reasons. Research retained beyond that point should be de-identified or aggregated when feasible and used consistently with the recorded permission. Backup copies may remain until the normal backup cycle expires.
Imported directory data should be replaced or removed when it is no longer needed for attorney verification. Decrypted CSV exports are outside the database encryption after download and must be stored, transmitted, and deleted securely by the administrator.
Your choices and requests
A sender may request access to, a copy of, correction of, or deletion of personal information and may withdraw permission for future research use. Include the submission reference number and the email address used, when available. Because encrypted submissions are not indexed by email address, locating a record may require the reference number and a manual review. Identity may be verified before a request is completed. Information required for legal, administrative, source-integrity, or security purposes may be retained.
Security and incident response
The site should be operated with HTTPS, restricted administrator access, strong authentication, current software, appropriate backups, key protection, and security monitoring. No internet system can promise absolute security. Suspected incidents will be investigated, contained, documented, and reported to affected persons or authorities when applicable law requires notice.
Children, international visitors, and policy changes
This site is not directed to children under 13. Florida Hellthcare is based in the United States and does not intentionally target or monitor people in the European Union or European Economic Area. Information submitted from outside the United States may be processed in the United States. This policy may be revised as site functions or providers change. The effective date at the top identifies the current version.