Pricing Services About How It Works Blog Contact Book a Free Call

Legal

Privacy Policy

Effective Date: January 1, 2026  ·  Last Updated: October 2026

Table of Contents

  1. Who We Are
  2. Information We Collect
  3. How We Use Your Information
  4. HIPAA & Protected Health Information
  5. Information Sharing & Disclosure
  6. Cookies & Tracking Technologies
  7. Data Security
  8. Your Rights & Choices
  9. Data Retention
  10. Children's Privacy
  11. Changes to This Policy
  12. Contact Us

1 Who We Are

Sorrell MD ("we," "us," or "our") is a telemedicine medical practice operated by Dr. Luke Sorrell, MD. We provide virtual healthcare services including hormone replacement therapy, body composition optimization, gut health optimization, cardiovascular risk assessment, fertility optimization, and root cause analysis to patients in most U.S. states.

This Privacy Policy explains how we collect, use, share, and protect information obtained through our website at sorrell-md.com (the "Site") and in the course of providing our telemedicine services. By using our Site or services, you agree to the practices described in this policy.

Note: This policy governs information collected through our marketing website. For information about how we handle your Protected Health Information (PHI) as a patient, please refer to our Notice of Privacy Practices provided at the time of enrollment, which is governed separately under HIPAA.

2 Information We Collect

Information You Provide Directly

We collect information you voluntarily submit through our Site, including:

  • Contact form submissions (name, email address, phone number, message content)
  • Guide and resource download requests (name and email address)
  • Appointment scheduling information submitted through Cal.com
  • Email correspondence and communications with our practice
  • Information provided when requesting information about our services

Information Collected Automatically

When you visit our Site, certain information is collected automatically through standard web technologies:

  • IP address and approximate geographic location
  • Browser type, version, and device type
  • Pages visited, time spent on pages, and referring URLs
  • Date and time of your visit
  • Cookie identifiers and similar tracking data (see Section 6)

Information from Third-Party Services

Our Site integrates with third-party services that may collect information subject to their own privacy policies:

  • Cal.com — for appointment scheduling
  • Formspree — for contact and download form processing
  • Brevo — for our email list and contact management

3 How We Use Your Information

We use the information we collect for the following purposes:

  • Responding to inquiries — to answer questions submitted through our contact form or email
  • Scheduling — to coordinate and confirm appointments via Cal.com
  • Email marketing — to send you health articles, information about our services, and practice news (see below)
  • Site improvement — to understand how visitors use our Site and improve its content and functionality
  • Legal compliance — to comply with applicable laws, regulations, and professional licensing requirements
  • Security — to protect against fraud, unauthorized access, and other unlawful activity

We do not sell your personal information or use it for automated decision-making that produces legal or similarly significant effects.

Our Email List

When you download a guide or send us a message through our contact form, we add your name and email address to our contact records and our email list. The form you submit tells you this before you send it. We send regular emails covering health topics, our own services, and practice news. Every email includes an unsubscribe link, and you can also ask us to remove you at any time. We honor unsubscribe requests promptly, and always within 10 business days.

We add only your name and email address to our email platform. The contents of your message, the topic you selected, and any health information you share are not used to target or segment our marketing emails.

Phone Numbers

If you give us your phone number, we use it only to respond to your inquiry or to coordinate your care. We do not send marketing text messages or make automated or prerecorded marketing calls. If we ever offer text updates, we will ask for your separate, express consent first, and you will not need to give it to receive care.

4 HIPAA & Protected Health Information

Sorrell MD is a covered entity under the Health Insurance Portability and Accountability Act (HIPAA). When you become a patient, your Protected Health Information (PHI) — including medical history, diagnoses, lab results, treatment plans, and related communications — is governed by HIPAA and our Notice of Privacy Practices (NPP).

Your PHI will only be used or disclosed as permitted under HIPAA: for treatment, payment, and healthcare operations, or with your written authorization. You have rights under HIPAA including the right to access, amend, and request restrictions on your PHI.

Please note that communications sent through our general contact form on this website are not considered a secure clinical channel and should not include sensitive health information. Once you are an established patient, all clinical communications take place through our secure patient portal.

5 Information Sharing & Disclosure

We do not sell, rent, or trade your personal information. We may share your information in the following limited circumstances:

Service Providers

We engage trusted third-party vendors who assist in operating our Site and services. These parties are contractually obligated to handle your data securely and only for the purposes we specify:

  • Cal.com (appointment scheduling)
  • Formspree (contact and download form processing)
  • Brevo (email list and contact management)
  • Website hosting and analytics providers

Legal Requirements

We may disclose your information if required by law, court order, or governmental authority, or if we believe disclosure is necessary to protect the rights, property, or safety of Sorrell MD, our patients, or the public.

Business Transfers

In the event of a merger, acquisition, or sale of practice assets, patient information would be transferred subject to applicable HIPAA requirements and state medical records laws. You would be notified of any such change.

With Your Consent

We may share your information for any other purpose with your explicit prior consent.

6 Cookies & Tracking Technologies

Our Site uses cookies and similar technologies to improve your browsing experience and understand Site usage. Cookies are small text files stored on your device by your browser. We do not use advertising cookies, retargeting pixels, or cross-site tracking.

Types of Cookies We Use

  • Essential cookies — required for the Site to function properly (e.g., session management)
  • Analytics cookies (only with your consent) — help us understand how visitors interact with our Site so we can improve it (e.g., page views, traffic sources, and whether a booking link was clicked). We use Google Analytics 4 with IP anonymization and Google Signals turned off. Google Analytics does not load, and sets no cookies, unless you click "Accept" on our cookie banner. It never receives the contents of any form you submit.
  • Cookie-free statistics — Vercel Web Analytics and Speed Insights count page views and measure page speed without cookies or persistent identifiers, and run for all visitors.

Managing Cookies

When you first visit, a banner asks whether you accept analytics cookies. Declining has no effect on how the Site works. We remember your choice on your device for 12 months, then ask again. You can change your choice at any time with the "Cookie Settings" link in the footer of every page or the button below; withdrawing consent deletes the Google Analytics cookies from your browser.

You can also control and delete cookies through your browser settings. Most browsers allow you to refuse cookies or alert you when cookies are being sent.

Third-party services embedded in our Site (such as Cal.com) may set their own cookies, governed by their respective privacy policies.

Email Engagement

Our marketing emails, sent through Brevo, use standard open and click measurement (a small image and tracked links) so we can see whether an email was opened and which links were clicked. We use this only to improve our emails and keep our list healthy. Many email apps let you block images to turn off open measurement.

7 Data Security

We take reasonable administrative, technical, and physical measures to protect the information we hold from unauthorized access, alteration, disclosure, or destruction. These measures include:

  • SSL/TLS encryption for data transmitted to and from our Site
  • Secure, access-controlled systems for storing patient and contact information
  • HIPAA-compliant platforms and Business Associate Agreements (BAAs) with applicable vendors
  • Limiting access to personal information to staff with a legitimate need

No method of electronic transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. If you have reason to believe your interaction with us is no longer secure, please contact us immediately at info@sorrell-md.com.

8 Your Rights & Choices

Depending on your location and applicable law, you may have the following rights regarding your personal information:

Access & Correction

You may request access to the personal information we hold about you and ask us to correct any inaccuracies.

Deletion

You may request that we delete your personal information, subject to legal retention requirements and our obligations under HIPAA and applicable state medical records laws.

Opt-Out of Marketing

You may opt out of receiving marketing communications from us at any time by clicking "unsubscribe" in any email we send, or by emailing info@sorrell-md.com. We process opt-outs within 10 business days. Opting out of marketing does not affect communications related to your care.

Do Not Track

If your browser sends a Global Privacy Control signal, we treat it as declining analytics cookies and Google Analytics is not loaded. Our Site does not respond to the older "Do Not Track" signal, as no uniform standard for it exists.

California Residents

California residents may have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information is collected, the right to delete, and the right to opt out of the sale of personal information. We do not sell personal information. To exercise your rights, contact us at info@sorrell-md.com.

To exercise any of these rights, please contact us using the information in Section 12.

9 Data Retention

We retain personal information for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce our agreements.

Medical records and PHI are retained in accordance with applicable federal and state law, which generally requires retention for a minimum of seven (7) years from the date of service, or longer in the case of minor patients.

Non-clinical contact form submissions are typically retained for up to two (2) years unless you request earlier deletion. If you are on our email list, we keep your name and email address while you remain subscribed. After you unsubscribe, we keep your email address on a suppression list only so that we don't email you again.

10 Children's Privacy

Our Site and services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children under 18. If you believe we have inadvertently collected information from a minor, please contact us immediately and we will take steps to delete such information promptly.

11 Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make changes, we will revise the "Last Updated" date at the top of this page.

We encourage you to review this policy periodically. Your continued use of our Site or services after any changes constitutes acceptance of the updated policy. For material changes that affect how we handle existing patient information, we will provide notice through appropriate channels.

12 Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or how we handle your information, please contact us:

We will respond to all privacy-related inquiries within a reasonable time, and to HIPAA-related requests within the timeframes required by law.