Patient Data & Privacy
Healthcare businesses handle sensitive patient information. Before we work on your search visibility, you should know exactly what LightTangent can access, what we do not need, and where the line sits between search marketing and your practice's clinical and patient data.
What We Access — and What We Don't
Standard SEO, Local SEO, and AI Search Optimization work does not require access to protected health information. Here's the practical breakdown of where our access starts and stops.
What LightTangent Accesses
- ✓ Your public-facing website content, structure, and code (for technical SEO, schema, and AI Search Optimization work)
- ✓ Google Search Console, Google Business Profile, and Google Analytics — aggregate traffic, ranking, and engagement data
- ✓ Anonymous, site-wide enquiry and conversion counts (e.g. "how many contact-form submissions this month")
- ✓ Publicly available directory listings, citations, and review platform profiles
- ✓ Marketing copy, service descriptions, and educational content you approve for publication
What We Don't Access
- ✕ Electronic Health Records (EHR/EMR), practice management systems, or clinical charting software
- ✕ Individually identifiable patient records — names, diagnoses, treatment notes, appointment details tied to a person
- ✕ Insurance, billing, or payment information
- ✕ Individual patient health information, including information that may be considered PHI or equivalent protected health information under applicable law
- ✕ Patient communications — intake forms, secure messaging, or call recordings, unless fully de-identified by you first
What Clients Can Provide for Standard SEO Work
If you're ever unsure whether something should be shared, use this principle: it should describe the practice or its performance, not identify or reveal information about an individual patient.
De-identified case studies & testimonials
Public case studies or testimonials that have been appropriately de-identified and approved for publication by the client. We do not require individual patient records for standard SEO work.
Service and clinical information for public content
General, practice-approved descriptions of services, conditions, and treatments intended for public-facing content.
Aggregate business metrics
Total appointment volume, occupancy trends, or enquiry counts by month — numbers about the business, not about any individual patient.
Star ratings & public review content
Public reviews and ratings may be used as publicly available marketing information. We do not need private patient communications or records.
SEO Reporting Without PHI
Every report we send is built from platform-level, aggregate data — never from anything that identifies a specific patient.
Source: Analytics platforms, not patient systems
Rankings, traffic, and enquiry-volume figures come from Google Search Console, Google Business Profile, and website analytics — tools that report on visitor behavior, not patient identities.
Granularity: monthly totals, not individual records
A monthly report might show "34 contact-form submissions, up 18% month over month." It will never show who submitted, what they wrote, or why they were seeking care.
Forms: keep clinical information out of marketing workflows
We recommend that marketing forms do not collect unnecessary clinical details. Where clinical or sensitive information is required, it should be handled through the healthcare business's appropriate privacy and clinical systems—not through LightTangent's SEO workflow.
Measure the Business Outcome — Without Accessing the Patient Record
Privacy-conscious reporting does not mean traffic-only reporting. We can measure the search journey from visibility to website engagement to aggregate enquiries and bookings without needing individual patient records.
Search visibility
Impressions, clicks, click-through rate, rankings, search queries, landing pages, and service or location visibility.
Website engagement
Sessions, engagement, important page activity, and agreed conversion actions using website analytics.
Aggregate enquiries
Total calls, forms, booking actions, or other agreed enquiry events—reported as business-level totals rather than individual records.
Aggregate bookings
Where the client can provide them, total bookings or appointment outcomes can be used to evaluate performance without sharing patient identities.
Service & location performance
Compare which services, conditions, locations, and search themes are contributing to visibility and enquiries.
What stays with you
Individual patient identity, clinical history, treatment details, and patient-level records remain within the healthcare business's appropriate systems.
Aggregate Enquiry & Conversion Reporting
Here's the level of detail you can expect in a typical monthly report — enough to judge whether the strategy is working, without ever touching patient-level data.
What a Report Shows
- ✓ Website visits, by channel and by page
- ✓ Keyword rankings and search visibility trends
- ✓ Total form submissions, calls, and direction requests (counts only)
- ✓ Conversion rate: enquiries ÷ visits, as a percentage
- ✓ Google Business Profile views, calls, and booking clicks
What a Report Never Shows
- ✕ Names or contact details of individual enquirers
- ✕ The content of any message, symptom, or condition submitted
- ✕ Which specific person converted into a booked patient
- ✕ Any data cross-referenced with your EHR or billing system
Outside the Scope of Standard SEO Services
Being clear about what we don't do is as important as being clear about what we do.
Clinical & treatment decisions
We don't provide medical advice, review clinical content for accuracy beyond general readability, or influence how care is delivered.
Healthcare privacy compliance for your systems
We are not your healthcare privacy or compliance officer. If a tool or workflow requires access to individual health information, that falls outside our standard SEO service model and must be evaluated separately before any data is shared.
Patient communication & intake handling
We don't manage secure messaging, intake triage, or anything that requires access to a patient's clinical record.
Billing, insurance & payments
Financial and insurance data is entirely outside our access and outside the scope of any deliverable we produce.
Legal & regulatory advice
We flag privacy-relevant gaps when we see them (like an overly detailed intake form), but we're not a substitute for your healthcare attorney or compliance consultant.
EHR / PMS integration
We don't build integrations with, or request credentials for, electronic health record or practice management platforms.
Fine Print
This page is provided for general informational purposes only and does not constitute legal, medical, privacy, or compliance advice. LightTangent is a marketing and SEO agency. Our standard SEO service model is designed not to require access to individual patient health information.
Each client remains responsible for ensuring that information shared with LightTangent and content published on their website complies with applicable privacy, healthcare, advertising, and data-protection requirements in their jurisdiction. We recommend that clients obtain appropriate professional advice for patient stories, testimonials, clinical content, forms, and any workflow involving sensitive information.
Nothing on this page overrides the terms of a signed services agreement between LightTangent and a client. Where the two conflict, the signed agreement governs. For questions about a specific engagement, contact us directly at info@lighttangent.com.
Questions About How We Handle Your Data?
We're happy to walk through this in detail before you sign anything — no pressure, no jargon.