SMS Privacy Policy

Overview
This SMS Privacy Policy explains how Wildflower Breast Center PLLC (“Wildflower”) manages information exchanged via SMS under Microsoft Teams Phone SMS. This policy applies only to SMS interactions and not to clinical communications conducted through Spruce or other platforms.

Information We Collect via SMS
We may collect:
• Phone numbers used to contact our SMS line
• Timestamps and basic message metadata
• Administrative information sent voluntarily (for example, confirmation of receipt of a referral)
• Non-clinical referral coordination details

Information We Do Not Collect
Wildflower does not collect, request, or store the following through SMS:
• Personal health information (PHI)
• Medical history
• Diagnostic details
• Treatment information
• Insurance information
• Any protected health information as defined by HIPAA

All PHI and clinical data are handled exclusively through our HIPAA-compliant system, Spruce.

Use of SMS Data
SMS information is used only to:
• Coordinate referral documentation
• Confirm receipt of administrative information
• Support non-clinical communication with partner clinics
• Maintain audit trails for administrative workflow

Data Sharing
Wildflower does not sell, rent, or share SMS data with third parties for marketing. Data may be shared with service providers (including Microsoft) strictly for the purpose of message delivery and system functionality.

Security Measures
SMS is not a HIPAA-secure channel.
Wildflower uses administrative controls to prevent users from sending PHI by SMS. Internal staff are trained to redirect PHI-related communication to Spruce immediately.

Data Retention
SMS logs may be retained for operational and compliance purposes in accordance with Wildflower’s retention schedule and applicable law.
No PHI is retained via SMS.

User Rights
Users may:
• Opt out of SMS at any time by replying STOP
• Request clarification about this policy
• Redirect communication to Spruce at any time for secure messaging

Separation of SMS and HIPAA Communication
Clinical communication must occur only on Spruce.
SMS is strictly for non-clinical administrative coordination and may not contain any medical or identifying health information.