Privacy Policy

01 Who we are

Jose Blanco Rosado Sales & Marketing is a sales and marketing consulting business based in Puerto Rico. We offer physician referral strategy, social media management, website development, private portals and tracking tools for clinics and other businesses. We are responsible for the information collected through the means described in this policy.

02 Information we collect

Information you provide

• Contact form: name, clinic or company, email, phone, service of interest and your message.
• Portal account: name, email and password (the password is stored encrypted; we cannot see it). If you create your account or sign in with Google, we receive your name and email from Google; never your Google password.
• Business profile: business details, contacts, hours, services, logo, photos, documents and other content you upload so we can provide the service.
• Messages and decisions: the messages you exchange with us in the portal and your approvals or change requests for designs and profiles.
• Direct communications: what you send us by email, phone or WhatsApp.

Payment information

Payments are processed by Stripe. We do not receive or store your full card or bank account number. We keep the customer name, billing email, amounts, dates and the status of each invoice or subscription.

Information collected automatically

• Technical logs: IP address, browser and device type, pages requested, date and time. We use them to operate and protect the site and diagnose problems.
• Portal activity log: sign-ins, failed attempts and actions taken in your account, for security and record keeping.
• Location: in visit apps (Refiere and our internal tools), a user can confirm arrival at an office with the device location. This happens only if the user allows it on the device and taps the corresponding button. The public website does not collect your location.

Professional information about physicians and offices

For the physician referral service we maintain directories of physicians, offices and health centers: name, specialty, office address and phone, referral relationship status and notes from professional visits. This information comes from public sources (such as the federal NPPES registry and Google Maps), from the offices themselves and from our visits.

Information we do not request

We do not request or need patients’ medical information, Social Security numbers, driver’s licenses or bank account details. Please do not include patient health information in forms, messages or documents.

03 How we use information

• To respond to your requests and quotes.
• To provide the contracted services, operate your portal and prepare reports.
• To invoice, collect payment and keep accounting records.
• To send you account-related notices: designs for approval, messages, profile changes and invoices.
• To protect the site and accounts, prevent fraud and comply with the law.
• To improve our services.

We do not use your information to make automated decisions that legally affect you.

04 Who we share information with

We do not sell your personal information or share it with third parties so they can advertise to you. We share it only in these cases:

Each client organization has access only to the information in its own account.

05 Cookies, similar technologies and “Do Not Track”

• Necessary cookies: the portals use session cookies to keep you securely signed in. Without them you cannot sign in.
• Local storage: we store preferences on your device, such as light or dark theme and language.
• Analytics: on the public pages of the site (not in the private portals or the Refiere app) we use Google Analytics 4 to measure visits in aggregate: pages viewed, where visits come from, device type and approximate location. Google Analytics uses first-party cookies (_ga) and does not give us your name or email. You can opt out with the Google Analytics opt-out browser add-on or by blocking cookies in your browser.
• Usage analytics: on the same public pages we use PostHog to understand how the site is used: pages viewed, clicks, heatmaps and anonymous recordings of navigation. Form fields are hidden in those recordings, so we do not see what you type. PostHog uses first-party cookies. You can avoid it by blocking cookies in your browser.
• Advertising: on the public pages of the site (not in the private portals or the Refiere app) we use the Meta Pixel to measure visits coming from Facebook and Instagram and to show ads to people who visited the site. The Pixel records the page visited and technical browser data; it does not send what you type into forms. You can limit it in your Meta account ad settings (“Ad preferences”) or by blocking cookies in your browser.
• Third parties: when you load Google fonts or open Stripe, Google Maps or WhatsApp links, those providers receive your IP address and browser data under their own policies.
• “Do Not Track”: the site does not track your activity across other websites, so it responds the same to all visitors, whether or not the browser’s “Do Not Track” signal is on.

06 Health information and HIPAA

JBR is not a health care provider or an insurer. Our referral services concern the professional relationship between physicians and clinics, not patients. Refiere is designed not to store patient information. If a client subject to the federal HIPAA law needed us to handle protected health information, we would do so only under a written Business Associate Agreement and with the safeguards that law requires.

07 Data obtained from Google services

Google Maps results used in our tools are displayed to locate offices and are not sold or used for advertising. If you connect a Google account to one of our applications, we will use the data received only for the function you authorized, we will not transfer it to third parties except to provide that function or comply with the law, and we will not use it for advertising. Use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

08 Communications

• Service notices: if you are a client, you will receive emails related to your account, such as the monthly referral report. You can ask us to turn them off; you will still see notices in the portal.
• Marketing: we will only send you promotional communications if you requested or agreed to them. Each message will explain how to unsubscribe, and we will honor your request within 10 business days.
• Text messages: as of the date of this policy we do not send automated text messages. If we offer them, we will first ask for your express consent.

09 Security and incident notice

We protect information with encrypted connections (HTTPS), encrypted passwords, lockout after failed sign-in attempts, separation of data by organization, file storage outside public reach and backups. No system is infallible. If unauthorized access to personal information protected by Puerto Rico Act 111-2005 occurred, we would notify affected individuals as soon as possible and the Puerto Rico Department of Consumer Affairs (DACO) within the period required by that law, and we would follow the breach notification laws of other states where they apply.

10 How long we keep information

• Contact requests: up to 24 months after the last exchange.
• Portal accounts and content: for the duration of the service relationship and up to 12 months after, unless you ask us to delete it sooner.
• Billing and accounting: as long as tax laws require, usually 6 years.
• Technical and security logs: up to 12 months.

11 Your choices and rights

You may ask us, at no cost, to:

• Tell you what personal information we have about you and give you a copy.
• Correct inaccurate information.
• Delete your information, except what we must keep by law or to defend claims.
• Stop sending you promotional communications or email notices.
• If you are a physician or represent an office included in a directory, correct your details or ask not to be contacted.

Write to info@joseblancorosado.com or call 787-526-2886. We may ask you to confirm your identity. We will respond within a reasonable time, normally within 30 days. We will not retaliate against you for exercising these choices.

California and other state residents: we do not sell personal information or share it for targeted advertising or third-party direct marketing. We will handle your access, correction and deletion requests on the same terms described above.

12 Minors

Our services are intended for businesses and adult professionals. We do not knowingly collect information from children under 13. If you believe a child has provided us information, write to us and we will delete it.

13 Third-party links and services

The site contains links to third-party services such as Stripe, WhatsApp and Google Maps. Their privacy practices are governed by their own policies, which we encourage you to read.

14 Where information is processed

Information is stored and processed on our providers’ servers, which may be located in the United States and other countries. By using our services, you understand that your information may be processed outside Puerto Rico.

15 Changes to this policy

We may update this policy. We will publish the new version on this page with its effective date. If the change is material, we will announce it visibly on the site or in the portal, or by email to clients, before it takes effect.

16 Legal framework

This policy was prepared taking into account, among others, the following laws:

• Puerto Rico: Act 39-2012 (Privacy Policy Notification Act) and DACO Regulation 8568; Act 111-2005 (Citizen Information on Data Bank Security Act) and its regulation; DACO Regulation 9158.
• Federal: Section 5 of the Federal Trade Commission Act (deceptive or unfair practices); CAN-SPAM (commercial email); COPPA (children under 13); TCPA (calls and text messages); HIPAA, to the extent it applies to services provided to covered entities.
• Other states: California Online Privacy Protection Act (CalOPPA).

17 Contact and complaints

Jose Blanco Rosado Sales & Marketing
Puerto Rico
Email: info@joseblancorosado.com
Phone: 787-526-2886
Website: joseblancorosado.com

If you believe we did not address your complaint, you may contact the Puerto Rico Department of Consumer Affairs (DACO), the Federal Trade Commission (FTC) or the consumer protection agency of your state.