This Privacy Policy explains how Tony N Nakhla, DO Inc., doing business as OC Skin Institute (“OC Skin Institute,” “we,” “us,” or “our”), collects, uses, and discloses information when you visit https://www.ocskininstitute.com and our blog at /blog/ (together, the “Site”). By using the Site, you agree to the practices described here. If you do not agree, please do not use the Site.
This policy covers information collected through this website. It does not cover protected health information (PHI) that we maintain as a healthcare provider — see “Health information (HIPAA)” below.
Information we collect
Information you give us. When you use a contact or appointment-request form, email us, or otherwise communicate with us through the Site, we collect the information you choose to provide — typically your name, email address, phone number, and the contents of your message or request. Please do not submit sensitive medical details or full medical history through website forms; use them only to request contact or an appointment.
Information collected automatically. When you visit the Site, we and our analytics provider (and, if we enable advertising in the future, our advertising providers) may automatically collect technical information such as your IP address, device and browser type, operating system, the pages you view, the links you click, the referring website or URL, and approximate (city or region level) location derived from your IP address. We collect this through cookies and similar technologies, as described below. We do not collect precise geolocation through the Site.
How we use information
We use the information we collect to: operate, secure, maintain, and improve the Site; respond to your inquiries and appointment requests and provide customer support; understand and analyze how the Site is used, in aggregate; and, where you have not opted out and if we enable advertising in the future, to market our services and measure that advertising. We do not use website form submissions to make medical decisions.
Cookies, analytics & your privacy choices
We use cookies and similar technologies on the Site in four categories:
- Strictly necessary (always active) — security, sign-in, remembering your privacy choice, and our accessibility tool (accessiBe). These never track you for advertising.
- Preferences — remembers functional choices, such as blog comment details.
- Statistics — Google Analytics, to understand Site usage in aggregate.
- Marketing — Google advertising, to measure campaigns and personalize ads, including retargeting. Not currently active; reserved for if we enable advertising in the future.
Necessary cookies are always on. Statistics cookies (Google Analytics) are used by default unless you opt out. We do not currently use Preferences or Marketing cookies; if we enable them in the future, they would follow the same choice. You can turn any category off at any time using the choices described below.
We describe cookies by category rather than listing each one by name: the specific cookies and their durations are set by us and by our service providers (such as Google) and can change over time. How long cookies and analytics data are kept is described in “How long we keep it” below. You can view or delete cookies at any time through your browser settings, in addition to using the privacy choices described here.
We use a third-party accessibility tool (accessiBe) that loads for all visitors so its accessibility features are available to anyone who needs them; if you adjust its settings, it stores your choices in cookies for that purpose. Because this is an accessibility accommodation and is not used for advertising or to sell or share your information, it is treated as strictly necessary and is not turned off by the choices below. Apart from that, we do not set Preferences or Marketing cookies at this time; if we later enable such features (for example, blog comments, or Google advertising and remarketing), the corresponding cookies would be controlled by the choices described here. Strictly necessary cookies for security, sign-in, and forms are set only when you use those features.
Categories of personal information we collect
Through Google Analytics (deployed via Google Tag Manager) — and through Google advertising if we enable it in the future — we and Google LLC collect the following categories of personal information:
- Identifiers — online and device identifiers, including cookie IDs, a randomly assigned analytics ID, and IP address.
- Internet or other electronic network activity — pages viewed, links clicked, and the referring website or URL.
- Geolocation data — approximate, coarse (city or region level) location derived from your IP address. We do not collect precise geolocation.
- Inferences — inferences drawn from the above to measure Site usage and, if marketing cookies are enabled in the future, to gauge advertising interest.
We do not collect sensitive personal information (as defined by California Civil Code §1798.140(ae)) through these cookies — no Social Security or government ID numbers, precise geolocation, log-in credentials, contents of your communications, or data about health, race, religion, sexual orientation, or similar categories. Information you voluntarily type into a contact or appointment form is used only to respond to you.
We do not intend to collect sensitive personal information through cookies, and we do not use analytics to infer any individual’s specific health condition. Because this is a dermatology website, the pages you view (for example, a page about a particular skin concern) may indicate a general interest in a topic; we do not treat this page-view data as a medical record, do not combine it with your identity, and do not use it to make any medical, insurance, or eligibility decision about you.
Sources of this information. We collect it directly from you and your device or browser as you interact with the Site, through cookies and similar technologies set by us and through the Google Tag Manager container we load. We do not purchase your personal information from data brokers.
Categories of third parties we disclose to. We disclose the categories above to our analytics and tag-management provider (Google LLC) and, if we enable advertising in the future, to advertising networks and partners. We also rely on service providers that host, secure, and maintain the Site. We do not disclose your personal information to data brokers.
Why we collect it (purposes). To (1) operate, secure, and maintain the Site (strictly necessary); (2) remember your functional preferences; (3) measure and analyze Site traffic and performance in aggregate (statistics); and (4) if and when we enable marketing cookies, market our services and show relevant ads, which may include cross-context behavioral advertising and remarketing (marketing).
“Selling” and “sharing” of personal information
When you allow Statistics cookies (and Marketing cookies, if we enable advertising in the future), we disclose Identifiers, Internet/network activity, and Inferences to Google LLC. Under some US state privacy laws, disclosing this information to Google for analytics — and, if we enable advertising, for cross-context behavioral advertising (remarketing) — may be considered “sharing,” and, because we receive these services in return even though no money changes hands, it may also be considered a “sale.” We treat it that way and let you opt out. We do not exchange your personal information for money, and we do not knowingly sell or share the personal information of consumers under 16 years of age.
How long we keep it
We retain each category only as long as needed for its purpose: analytics data is retained for the period we configure in Google Analytics (up to a maximum of 14 months for user- and event-level data); if we enable advertising in the future, marketing and advertising cookies would persist for the durations Google sets (commonly up to about 2 years); and your consent choice is stored in a first-party cookie for up to about a year (on some browsers, such as Safari, it may be retained for a shorter period, in which case we will ask for your choice again). Information you submit through a contact or appointment-request form is kept only as long as needed to respond to and document your inquiry and to meet our legal and recordkeeping obligations, after which it is deleted or de-identified. OC Skin Institute does not separately store visitor personal information from these analytics cookies on its own servers.
Your privacy rights
Depending on where you live, US state privacy laws — including the California CCPA/CPRA and the comprehensive privacy laws of Virginia, Colorado, Connecticut, Texas, Oregon, Montana, and other states — may give you the right to: (1) know or access the personal information we collect, use, and disclose; (2) delete it; (3) correct inaccurate information; (4) opt out of its sale or sharing and of targeted advertising; (5) limit the use of sensitive personal information; and (6) not receive discriminatory treatment for exercising these rights. Because we do not collect or use sensitive personal information through the Site, no separate “Limit the Use of My Sensitive Personal Information” option is needed.
How to opt out of sale/sharing and targeted advertising
You can opt out at any time by any of these methods:
- Select “Your Privacy Choices” in the footer and turn off Marketing (and, if you wish, Statistics), then Save;
- Click Reject on the cookie banner; or
- Enable the Global Privacy Control (GPC) in your browser or a browser extension.
We recognize and honor GPC as a valid request to opt out of the sale and sharing of personal information and of targeted advertising for that browser or device, and we apply it automatically. When you opt out, we disable Google Analytics, stop setting new analytics cookies, and clear analytics cookies already placed (you can also delete cookies at any time through your browser); strictly necessary cookies remain. Your choice is remembered on your device so we do not ask again.
How to exercise your other rights (know, delete, correct)
Email us at privacy@ocskininstitute.com or use our contact form. We will acknowledge your request within 10 business days and respond within 45 calendar days (we may extend once by an additional 45 days and will tell you if we do). To protect your information, we will take reasonable steps to verify your identity before acting, and we may ask you to confirm information we already hold. You may use an authorized agent to submit a request on your behalf; if you do, we may require the agent to provide proof of your written permission and may still ask you to verify your identity directly.
Right to appeal
If we decline to act on your request, you may appeal by replying to privacy@ocskininstitute.com with the subject line “Privacy Appeal.” We will inform you in writing of the outcome and, where applicable, how to contact your state attorney general.
Health information (HIPAA)
OC Skin Institute is a healthcare provider. Protected health information that we create or maintain as part of your care — such as medical records, treatment information, and information collected in our offices or patient portal — is governed by the Health Insurance Portability and Accountability Act (HIPAA) and by our separate Notice of Privacy Practices, not by this website Privacy Policy. The Site’s contact and appointment forms are for general inquiries and scheduling only and should not be used to transmit medical history or other sensitive health details. If you have a medical emergency, call 911.
Security
We take reasonable administrative, technical, and physical measures to protect information submitted to us, both during transmission and after we receive it. However, no method of transmission over the Internet or electronic storage is completely secure, and we cannot guarantee absolute security.
Links to other sites
The Site may contain links to third-party websites. We are not responsible for the content or privacy practices of those sites. We encourage you to review the privacy statements of any site you visit that collects personal information.
Children’s privacy
The Site is intended for a general adult audience and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, please contact us and we will delete it.
Do Not Track
Some browsers offer a “Do Not Track” (DNT) signal. Because there is no common industry standard for DNT, we do not respond to DNT signals; however, we do honor the Global Privacy Control (GPC) as described above.
Changes to this policy
We may update this Privacy Policy from time to time. When we do, we will revise the “last updated” date below and post the new version on this page. Your continued use of the Site after changes take effect means you accept the updated policy. We review this policy at least every 12 months.
Contact us
This website is operated by Tony N Nakhla, DO Inc. (OC Skin Institute). For any privacy question or request, email privacy@ocskininstitute.com, use our contact form, call (714) 547-6111, or write to us at: OC Skin Institute, ATTN: Privacy Officer, 800 N. Tustin Ave., Suite G, Santa Ana, CA 92705.
Last updated: July 9, 2026.