Lollipop Dental Pediatric Dentistry & Orthodontics and Sweet Smiles Modern Orthodontics are two brand names of the same company. This policy applies to the Lollipop Dental website and practice. References to the “Practice,” “we,” “us,” or “our” mean that company, operating under the Lollipop Dental Pediatric Dentistry & Orthodontics name. Because both brands are one company, your privacy rights and our privacy practices are the same across both.

This page has three parts:

1. Part I — HIPAA Notice of Privacy Practices, which explains how we handle protected health information (PHI) for our patients.
2. Part II — California Consumer Privacy Notice, which explains your rights under the CCPA/CPRA for personal information collected through our website that is not PHI.
3. Part III — Cookies, Tracking Technologies & Communications Notice, which explains how we use tracking tools and chat/messaging features on our site, and your consent choices.

If any part of this policy conflicts with a more protective requirement of state or federal law, the more protective standard governs.

---

Part I — HIPAA Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED, AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

I. Dental Practice Covered by This Notice

This Notice describes the privacy practices of Lollipop Dental Pediatric Dentistry & Orthodontics (“Practice,” “we,” “us,” “our”). “You” and “your” means our patient, or the parent/legal guardian acting on a minor patient’s behalf.

II. Contacting Our Privacy Official

Questions about this Notice may be directed to our Privacy Official:

• Email: Smile@lollipopdental.com
• Phone: 714-592-0039
• Mail: 2750 Harbor Blvd B6, Costa Mesa, CA 92626

III. Our Legal Obligations

We are required by law to maintain the privacy of your protected health information (PHI), give you this Notice of our legal duties and privacy practices, and abide by the terms currently in effect. PHI is information about you — including demographic information — that may identify you and relates to your past, present, or future physical or mental health condition and related health care services.

In addition to HIPAA, we are subject to California law, including the California Confidentiality of Medical Information Act (CMIA) (Civil Code §§ 56 et seq.). Where California law provides greater protection for your medical information than HIPAA, we follow the more protective standard.

IV. How We May Use or Disclose Your Health Information

A. Common Uses and Disclosures

1. Treatment. To provide dental treatment or services, and to coordinate with dental specialists, physicians, or other providers involved in your care. Because Lollipop Dental and Sweet Smiles Modern Orthodontics are one company, care coordination between the two brands is internal to the Practice and is not a disclosure to a third party.
2. Payment. To bill and obtain payment from health plans, insurers, or you directly.
3. Health Care Operations. For quality assurance, staff training and evaluation, billing audits, legal compliance, and business planning.
4. Appointment Reminders. By postcard, letter, phone call, voicemail, text message, or email.
5. Treatment Alternatives and Related Benefits. To tell you about treatment options or health-related benefits and services.
6. Disclosure to Family Members or Friends. Involved in your care or payment, if you do not object, or when it is in your best interest and you are not present.
7. Business Associates. We may share PHI with vendors (“business associates”) who perform functions on our behalf, such as practice management or scheduling software providers. All business associates are contractually required to safeguard your information and may use it only as permitted by that contract.

B. Less Common Uses and Disclosures (as required or permitted by law)

Disclosures required by law; public health activities; reporting of abuse, neglect, or domestic violence; health oversight activities; judicial and administrative proceedings; law enforcement purposes; coroners/medical examiners/funeral directors; organ and tissue donation; research (with applicable IRB/Privacy Board oversight); to avert a serious threat to health or safety; specialized government functions (military, national security, correctional institutions); and workers’ compensation.

V. Written Authorization Required for Other Uses

Uses or disclosures involving psychotherapy notes, marketing, or the sale of PHI will be made only with your written authorization, which you may revoke at any time (except to the extent we already acted in reliance on it). Under California law, we also do not disclose your medical information to third parties for their own marketing purposes without your written authorization.

VI. Your Rights Regarding Your Health Information

To exercise any of these rights, submit a written request to our Privacy Official listed above.

A. Right to Access and Review. You may request access to and a copy of your health information. We will provide it in the form and format you request if readily producible; otherwise in hard copy or another mutually agreeable format. If your information is held in an electronic health record, you may request an electronic copy and may direct us to transmit it to a person or entity you designate. We may charge a reasonable, cost-based fee as permitted by HIPAA and California law. We may deny certain requests, and you will receive written notice of any denial and your right to have it reviewed.

B. Right to Amend. If you believe your health information is incorrect or incomplete, you may request an amendment. We may deny the request in certain circumstances; you will receive written notice and may file a statement of disagreement that will be included with your record.

C. Right to Restrict Use and Disclosure. You may request restrictions on uses or disclosures for treatment, payment, or health care operations, or to a family member or friend involved in your care. We are not required to agree, with one exception: if you pay in full out of pocket for a service and ask that we not submit the claim to your health plan, we must honor that request.

D. Right to Confidential Communications. You may request that we communicate with you by alternative means or at an alternative location, and we will accommodate reasonable requests.

E. Right to an Accounting of Disclosures. You may request an accounting of certain disclosures made in the six (6) years prior to your request, excluding disclosures for treatment, payment, and health care operations and certain other exceptions. The first accounting in any 12-month period is free; we may charge a reasonable, cost-based fee for additional requests in that period and will notify you in advance so you may modify or withdraw the request.

F. Right to a Paper Copy of This Notice. You may request a paper copy at any time, even if you agreed to receive it electronically.

G. Right to Notification of a Breach. We are required to notify you if the privacy or security of your unsecured health information has been breached. Notification will describe what happened and the dates involved, the steps you can take to protect yourself, and what we are doing to investigate the breach, mitigate harm, and prevent recurrence. We provide this notification within the timeframes required by HIPAA and applicable California law.

VII. Special Protections

Certain federal and state laws provide extra protection for information related to HIV status, substance use disorder treatment, mental health, reproductive health, and genetic information. Portions of this Notice may not apply to those categories; contact our office for details if your treatment involves this type of information.

VIII. Minor Patients and Parents/Guardians

Our patients are generally minors. In most cases a parent or legal guardian may exercise these rights on the minor patient’s behalf. California law provides that certain categories of care may be consented to by a minor directly, and in those limited circumstances the minor patient may control the related medical information. Please contact our Privacy Official with any questions about how this applies to your family.

IX. Changes to This Notice

We reserve the right to change this Notice and to make the revised Notice effective for PHI we already have as well as PHI we create or receive in the future. We will post the current Notice on our website and in our offices, and will provide a copy upon request.

X. Complaints

You may file a complaint with our Privacy Official (contact information above), with the U.S. Department of Health and Human Services, Office for Civil Rights, or with the California Department of Public Health. We will not retaliate against you for filing a complaint.

---

Part II — California Consumer Privacy Notice (CCPA/CPRA)

This section applies to personal information we collect through our website and related digital tools about California consumers. Health information governed by HIPAA and the CMIA (Part I, above) is separately regulated and is generally exempt from the CCPA, but general website/visitor data — such as contact-form submissions, browsing activity, and marketing-list information — is covered here.

A. Notice at Collection

We provide notice of the categories of personal information we collect, and the purposes for which they are used, at or before the point of collection. This section, together with the notice provided on our forms, serves as that notice at collection.

B. Categories of Personal Information We Collect

Category	Examples	Source	Retention
Identifiers	Name, email, phone number, IP address	You, directly; automatically via the site	Up to 3 years after last contact, unless you become a patient
Commercial information	Services requested, appointment history (non-PHI scheduling metadata)	You; our scheduling vendor	Up to 3 years after last interaction
Internet/network activity	Pages visited, links clicked, browser type, referring site	Automatically, via cookies/analytics	Up to 26 months (analytics retention setting)
Geolocation	Approximate location (e.g., city, based on IP)	Automatically	Up to 26 months
Audio/electronic communications	Text messages, chat transcripts, phone call notes (if applicable)	You, directly	As long as you remain opted in, then as required by carrier and legal requirements
Inferences	Interests inferred from site interaction, for site improvement	Automatically	Up to 26 months

Where a specific period is not practical, we retain information only as long as reasonably necessary for the purpose for which it was collected, and then delete or de-identify it. Patient dental/health records are retained in accordance with California dental recordkeeping requirements, which may extend well beyond these periods — particularly for minor patients.

C. Sensitive Personal Information

We do not collect sensitive personal information through our website for the purpose of inferring characteristics about you, and we do not use or disclose it for purposes that would trigger a right to limit its use under the CCPA. Health information you provide in the course of treatment is governed by Part I of this policy.

D. Purposes for Collection and Use

We use this information to: operate and improve the website; respond to inquiries and schedule appointments; send appointment-related and (with consent) marketing communications; maintain site security; and comply with legal obligations.

E. Categories of Third Parties We Share Information With

In the preceding 12 months we have disclosed the categories above for business purposes to service providers who help us operate the site and practice (for example, scheduling/booking platforms, hosting providers, analytics and advertising tools, and SMS/text messaging platforms). We do not sell personal information for money. Certain analytics/advertising cookies may constitute a “share” under the CCPA’s broad definition (see Part III) — you can opt out of this at any time. Sharing of information between Lollipop Dental and Sweet Smiles Modern Orthodontics is internal to one company and is not a sale or share to a third party.

F. Minors Under 16

We do not sell or share the personal information of consumers under 16 years of age. Our website and messaging programs are directed to parents and legal guardians, not to children. We do not knowingly collect personal information online from children under 13. If you believe a child has provided personal information through our website, please contact our Privacy Official and we will delete it.

G. Your California Privacy Rights

If you are a California resident, you have the right to:

• Know what personal information we have collected, used, disclosed, and shared about you.
• Delete personal information we’ve collected from you, subject to certain exceptions.
• Correct inaccurate personal information.
• Opt out of the sale or sharing of your personal information (see cookie controls in Part III).
• Limit the use of sensitive personal information, where applicable.
• Non-discrimination — we will not deny you services, charge you a different price, or provide a different level of service because you exercised any of these rights.

How to exercise your rights: Email Smile@lollipopdental.com, call 714-592-0039, or write to us at 2750 Harbor Blvd B6, Costa Mesa, CA 92626. A request made to either Lollipop Dental or Sweet Smiles Modern Orthodontics covers your information held under both brands. We will verify your identity before processing your request and will respond within the timeframes required by law. You may also designate an authorized agent to submit a request on your behalf.

H. “Shine the Light” (California Civil Code § 1798.83)

California residents may request information about our disclosure of personal information to third parties for those third parties’ own direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing purposes. To make a request, contact us using the details above.

---

Part III — Cookies, Tracking Technologies & Communications Notice

A. Cookies and Similar Technologies

Our website uses cookies and similar technologies, grouped into the categories shown in our cookie preference tool:

• Functional/Necessary — required for the site to operate (e.g., security, load balancing). These do not require consent and cannot be turned off.
• Preferences — remember choices you’ve made (e.g., display settings).
• Statistics/Analytics — help us understand how visitors use the site.
• Marketing/Advertising — used to deliver and measure the relevance of ads.

Non-essential cookies and tracking technologies (Statistics and Marketing categories) do not run until you affirmatively opt in through the cookie banner. You may change your choice at any time through the “Manage Consent” / cookie preferences link in the site footer, and you may withdraw consent as easily as you gave it. A detailed list of the cookies used on this site is available in our Cookie Policy.

B. Chat, Text Messaging, and Similar Communication Tools

If our website offers a live chat, chatbot, or similar messaging feature, that tool is operated by us or by a vendor acting solely on our behalf and under our instruction, as a direct channel for communicating with our office — not an independent third party listening in on your communications. By using chat or text messaging with our office, you consent to that communication being received, and in some cases recorded or retained, by the Practice and the vendor operating the tool for us, for purposes of providing you service, quality assurance, and recordkeeping.

We do not use session-replay or similar tools to capture your website interactions unless disclosed in our cookie preference tool and consented to in advance.

C. Consent, Recording & California Law

Under the California Invasion of Privacy Act, we do not intercept or record communications through this website (including chat) without appropriate notice and, where required, consent. If any page or feature involves call or session recording, we will disclose that at or before the point of collection and, where legally required, obtain your prior consent.

D. SMS / Text Messaging Terms

Text messaging terms, opt-in, and opt-out instructions are set out in our Terms & Conditions, which are incorporated here by reference. Mobile information and opt-in consent will not be shared with third parties or affiliates for marketing or promotional purposes. Mobile opt-in consent and originator data are never shared with third parties for marketing purposes. You may reply STOP at any time to opt out of receiving text messages, or HELP for assistance. Standard message and data rates may apply.

E. Opt-Out Preference Signals, Global Privacy Control, and Do Not Track

Our website recognizes and honors the Global Privacy Control (GPC) signal. If your browser or a browser extension sends a GPC signal, we treat it as a valid request to opt out of the sale or sharing of personal information for that browser or device, and non-essential tracking will not be enabled. Because this signal is tied to the browser or device you are using, you may need to enable it separately on each browser and device you use.

Separately, some browsers offer an older “Do Not Track” (DNT) signal. Because no common industry standard was ever adopted for responding to DNT, our site does not respond to DNT signals. Please use Global Privacy Control, or the cookie preference tool described above, to control tracking on this site.

F. Your Privacy Choices

To review or change your tracking choices at any time, use the “Manage Consent” link in the footer of any page on this site. To exercise your other California privacy rights, including the right to opt out of the sale or sharing of personal information, see Part II above or contact us using the details below.

---

Contact Us

Lollipop Dental Pediatric Dentistry & Orthodontics
2750 Harbor Blvd B6, Costa Mesa, CA 92626
Email: Smile@lollipopdental.com | Phone: 714-592-0039

Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by a new “Last Reviewed/Updated” date at the top of this page, and — where required by HIPAA or California law — communicated to you directly.