Patient information
Security
How we protect the information you trust us with, and how to reach us if you see a problem.
Cosmetic surgery and medispa care involve some of the most personal information a person can share: medical history, photographs, payment details. Protecting it is part of the care we provide, not a separate administrative task. This page explains, in plain terms, how we approach that and what you can expect from us.
How we protect your information
Our people
Access to patient information is limited to the staff who need it to do their job. Everyone who works here is trained on privacy and security when they join and at least annually after that, and is bound by confidentiality obligations that continue after they leave. Staff are trained to recognize and report suspected privacy or security problems, and we investigate every report.
Our premises
Paper records, photographs and devices are kept in controlled areas of the practice, and records are disposed of securely rather than discarded intact.
Our systems and vendors
We use established third-party providers for our website, scheduling and payment processing rather than handling those functions ourselves. HIPAA requires a Business Associate Agreement with any vendor that handles protected health information on our behalf, and it is our policy to have one in place before such a vendor receives patient information.
When something goes wrong
We maintain a process for reporting, investigating and correcting incidents, including privacy and security events. If a breach affects your unsecured health information, we will notify you as HIPAA requires. Your rights in that situation are set out in our Notice of Privacy Practices.
Please don’t send us sensitive information by email, text or chat
Email, text and website chat are not secure
Our email address, text line and website chat are convenient for scheduling and general questions, but messages sent that way can be intercepted or misdirected. Please don’t use them to send your medical history, symptoms, photographs of a treatment area, insurance identifiers, Social Security number, or card details.
If we need that information from you, we’ll tell you how to provide it securely. If you would prefer we contact you only in a particular way, you can ask — and we will accommodate reasonable requests without asking why.
What we will never do
- We will never email or text you asking for your Social Security number, full card number, or a password.
- We will never call and ask you to read back a verification code you received.
- We will never ask you to pay by gift card, cryptocurrency, or wire transfer to a personal account.
- We will never pressure you to act immediately on a payment request. If a message feels urgent and unusual, it is worth a phone call to us on the number below.
If you receive a message that claims to be from us and asks for any of these things, please don’t respond to it — contact us directly using the phone number on this page, and let us know so we can warn other patients.
Report a security concern
If you are a patient, a member of staff, or a security researcher and you believe you have found a vulnerability in this website, a problem with how we are handling information, or evidence that information has been exposed, we want to hear from you.
Contact for security reports
Kathryn Dalton, DO, Security Officer
[email protected]
Phone: (508) 680-7004
Cape Cod Aesthetics and MediSpa, DBA Cape Cod Surgical Arts and Medispa, 352 Main Street, Falmouth, MA 02540
What to include
- What you found, and where — a URL, a page, or a description of the system.
- The steps needed to observe the issue.
- Why you think it matters, and any evidence you can share safely.
- How we can reach you if we have questions.
What we ask of you
- Report promptly, and give us reasonable time to investigate and fix the issue before disclosing it publicly.
- Do not access, download, modify or delete anyone else’s information. If you encounter patient information, stop and tell us immediately.
- Do not run tests that could degrade our service or affect patient care — no denial-of-service testing, no automated scanning at volume, no social engineering of our staff or patients.
- Do not demand payment in exchange for details of the issue.
What you can expect from us
- We will acknowledge your report within two business days.
- We will investigate, keep you informed of what we find, and tell you when it is resolved.
- If you follow the guidance above and report in good faith, we will not pursue legal action against you for your research.
- We will credit you if you would like that, and respect your preference if you would rather stay anonymous.
Related information
- Notice of Privacy Practices — how we use and disclose your medical information, and your rights over it.
- Privacy Policy — what this website collects and how it is used.
Last reviewed October 20, 2026