Privacy policy and clinical data governance.

1. Effective Date and Governance Baseline

This Privacy Policy and Clinical Data Governance Statement took effect on 2026-10-27 and governs all digital communications, scheduling requests, consultation notes, and technical tracking telemetry transmitted across zelguora.com. This document is maintained by Zelguora Oncology Practice under the continuous clinical direction of Dr. Ivan Petrov.

2. Identity of the Data Controller

The data controller responsible for personal information and clinical intake records collected through this website is Zelguora, trading as Zelguora Oncology Practice at zelguora.com.

Our verified physical and mailing address is: 308 East Tyler Street, Tampa, Florida 33601, Tampa, Florida, United States. For administrative and data protection inquiries, you may reach our office directly by telephone at +1 (662) 555-6607 or via email at [email protected]. The medical practice operates under Florida Medical License № XXXXXXX, with clinical navigation and regimen evaluations led by Ivan Petrov, MD.

3. Categories of Data Collected

Zelguora limits the collection of personal information to data necessary for scheduling, clinical triage, consultation preparation, and technical operation. We collect data across four specific conduits:

Clinical Consultation Inquiry Form (salab08.php): When a prospective patient or their representative submits an inquiry, the form writes the following fields to our secure database: full name, telephone number, email address, residential or mailing address, selected consultation kind (such as Initial Diagnostic Consultation or Regimen Navigation), primary malignancy or diagnosis notes, requested specification, and explicit affirmative consent checkbox. Concurrently and automatically, the server records the visitor’s IP address, browser user-agent string, referring URL, the exact timestamp when the form was rendered on screen, and the exact timestamp when transmission was completed.

Clinical Support Chat (pace01b.php): The on-site intake support widget records the dialogue conversation body, optional patient contact details if supplied, and issues a cryptographic session token stored locally in the visitor’s browser under localStorage to allow seamless continuity between page visits.

Technical and Server Access Logs: Web server infrastructure records HTTP requests, IP addresses, resource endpoints requested, operating system metadata, and status codes for operational diagnostics.

Advertising Click Identifiers: Inbound visitor traffic generated by digital advertising campaigns carries tracking parameters appended to the URL query string, specifically gclid from Google Ads, msclkid from Microsoft Advertising, and fbclid from Meta Ads.

No Account or Payment Data: Zelguora operates as an inquiry-only clinical practice. This website hosts no patient portals, creates no login accounts, stores no passwords, and accepts no credit card or financial payment transactions online.

4. Purposes of Data Processing

Personal and technical data collected by Zelguora are processed exclusively for defined operational and clinical objectives:

First, to conduct clinical intake triage, verify oncology diagnosis records, and schedule 55-minute consultation appointments with Dr. Ivan Petrov. Second, to verify patient contact channels by telephone (+1 (662) 555-6607) or email ([email protected]) during intake desk hours (8:00–17:00). Third, to coordinate external records acquisition from pathology labs, radiology centers, and treating oncologists prior to visits. Fourth, to evaluate marketing performance, verify landing page ad delivery, and measure campaign conversion rates across active platforms. Fifth, to maintain technical integrity, safeguard web infrastructure against abusive bots, and comply with medical board recordkeeping obligations.

5. Explicit Legal Bases for Processing

Under applicable statutory frameworks, including Florida common law and international data protection standards where applicable, Zelguora processes data under three distinct legal grounds:

6. Paid Advertising Platforms and Click Identifiers

This website is an active destination for paid marketing campaigns. Zelguora runs traffic from google ads, microsoft advertising, and Meta Ads. When a visitor reaches zelguora.com through an advertisement, these platforms attach specific click identifier parameters to the URL:

gclid: The Google Click Identifier transmitted by Google Ads campaigns to attribute consultation inquiries to specific search queries.

msclkid: The Microsoft Click ID transmitted by Microsoft Advertising across Bing network search results to measure lead generation efficiency.

fbclid: The Meta Click Identifier transmitted through Meta Ads campaigns when educational oncology outreach is conducted across Facebook or Instagram properties.

These identifiers enable conversion attribution only when the visitor has explicitly authorized marketing storage. Zelguora does not transmit protected health information or diagnostic text fields to any advertising platform.

7. Google Consent Mode v2 Implementation

Zelguora enforces technical privacy controls directly in the browser using consent mode v2. Prior to any interaction with our cookie banner, four specific signal parameters are initialized in an absolute denied state:

ad_storage = 'denied'
ad_user_data = 'denied'
ad_personalization = 'denied'
analytics_storage = 'denied'

If a visitor clicks “Allow Storage”, these parameters update to granted, enabling technical conversion measurement. If a visitor clicks “Deny Optional” or modifies their preferences via the footer control, all four parameters are set back to denied immediately. The visitor’s decision is stored locally under the browser key site_consent_v2 for a duration of exactly 12 months. No marketing tags fire or store persistent identifiers while signals remain denied.

8. Authorized Third-Party Processors

To maintain secure web hosting, electronic messaging, and conversion attribution, Zelguora engages the following third-party processors under strict confidentiality contracts:

Google LLC / Google Ireland Ltd: Provides web analytics and Google Ads conversion measurement infrastructure.

Microsoft Ireland Operations Ltd: Operates Microsoft Advertising conversion measurement. You may review Microsoft’s data governance standards directly in the Microsoft Privacy Statement at privacy.microsoft.com.

Meta Platforms Ireland Ltd / Meta Platforms, Inc.: Processes conversion telemetry for campaigns managed across Meta Ads.

Secure Hosting & Mail Routing Infrastructure: Our web hosting facility operates dedicated servers hosting our MariaDB database and PHP intake endpoints in the United States, alongside an encrypted SMTP mail transfer agent delivering automated consultation alerts directly to [email protected].

9. International Data Transfers

Zelguora’s primary physical operations, clinical servers, and patient filing systems are located within the United States. When European or international visitors access zelguora.com, their web traffic and consultation inquiries are transferred to and processed within the United States.

Where international transfers occur through global technology vendors (such as Google or Microsoft), they are governed by Standard Contractual Clauses (SCCs) approved by the European Commission, alongside supplementary technical safeguards including TLS 1.3 cryptographic cipher suites and restricted personnel access controls.

10. Definite Data Retention Schedules

Zelguora strictly adheres to definite retention schedules rather than indefinite or open-ended storage. Personal information is purged according to the following verified schedule:

11. Clinical Data Security Measures

Zelguora enforces administrative, physical, and technical safeguards to prevent unauthorized access, alteration, or disclosure of patient communications:

All traffic between your browser and our servers is encrypted using modern Transport Layer Security (TLS 1.3) with HSTS headers. Internal intake tables in our database employ salted hashing, parameterised PDO prepared statements, and role-based access restrictions. Physical records dropped at 308 East Tyler Street in Tampa are locked in fire-rated medical chart cabinets under direct physician supervision.

12. Rights Under the General Data Protection Regulation (GDPR)

For visitors residing in the European Economic Area or United Kingdom, the gdpr confers specific enforceable rights regarding personal data:

Right of Access: You may request confirmation of whether personal data is processed and obtain a copy of all stored records.
Right to Rectification: You may demand correction of inaccurate diagnostic summaries, contact information, or misspelled identities.
Right to Erasure: You may request the deletion of your consultation intake records, subject to statutory healthcare retention laws.
Right to Restriction: You may request that data processing be suspended while a dispute regarding accuracy is resolved.
Right to Data Portability: You may obtain your inquiry history in a structured, commonly used, and machine-readable format.
Right to Object: You may object at any time to data processing carried out under legitimate interest grounds.
Right to Withdraw Consent: You may revoke marketing or cookie storage consent at any time without affecting previous processing.

13. United States State Privacy Rights and California Disclosures

Residents of California and other states with comprehensive consumer privacy statutes (such as Virginia, Colorado, Connecticut, and Texas) possess statutory rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act (ccpa / CPRA):

You have the right to know what personal information is collected, disclosed, or shared; the right to delete personal information held by our practice; the right to correct inaccurate records; and the right not to receive discriminatory treatment for exercising these protections.

No Sale or Sharing of Personal Information: Zelguora does not sell, rent, monetize, or lease personal or health information to third-party data brokers. We do not engage in cross-context behavioral tracking beyond direct advertising conversion measurement authorized via our consent banner.

14. Recognition of Global Privacy Control (GPC)

Zelguora honors the global privacy control (Sec-GPC) browser signal. If your browser transmits a valid GPC header indicating an opt-out preference, our website automatically interprets this signal as an immediate decline of all optional marketing storage and analytics tags without requiring you to manually interact with our consent banner.

15. Pediatric Privacy and Children’s Data

Zelguora is a medical consultation practice designed exclusively for adult patients and their designated legal representatives. Our digital website is not targeted at, marketed to, or intended for use by children under 18 years of age. We do not knowingly collect personal information from minors. Inquiries concerning adolescent oncology must be submitted directly by a parent or legal guardian.

16. Regulatory Complaints and Supervisory Authorities

If you believe your privacy rights or healthcare confidentiality have been compromised, you have the right to lodge a formal complaint with relevant regulatory bodies:

In Florida, you may contact the Office of the Attorney General of Florida or the Florida Department of Health. In California, you may lodge a complaint with the California Privacy Protection Agency (CPPA) or the California Attorney General. In the European Union, you may file a complaint with the supervisory data protection authority of your member state of residence.

17. Formal Data Subject Access Request (DSAR) Procedure

To exercise any statutory privacy right—including accessing, correcting, or deleting your submitted intake information—you may transmit a written request directly to our clinical data desk:

Response Timeline: Zelguora processes and answers all verifiable data subject requests within 10 days of receipt. We do not impose administrative fees for standard requests. To protect confidential medical charts, we will verify your identity against previous inquiry submissions prior to releasing or erasing records.

18. Notification of Policy Amendments

Zelguora reviews and updates this policy periodically to reflect evolving clinical operations, statutory privacy laws, and ad platform technical standards. Material modifications are published directly on this page with an updated “Effective Date” displayed at the top of the dated rail. Significant changes impacting clinical intake protocols are announced via notice on our homepage for a period of thirty days.

19. Direct Privacy and Clinical Governance Contact

For inquiries regarding this policy, clinical chart releases, or data governance protocols, contact our Tampa clinical team:

Dr. Ivan Petrov, MD, Supervising Oncologist
Zelguora Oncology Practice
308 East Tyler Street, Tampa, Florida 33601, United States
Direct Practice Telephone: +1 (662) 555-6607
Secure Clinical Email: [email protected]
Intake Desk Hours: Monday through Friday, 8:00–17:00 Eastern Time.