Describe data collected, purpose, storage, rights, and contact. Note HIPAA considerations; recommend HIPAA-compliant tools if PHI is collected. Include cookie & analytics disclosure.