Privacy Policy

Information We Collect

We collect information in three ways:

Information you provide directly. When you apply for an engagement, book a strategy call, or contact us, you may share your name, email address, phone number, practice name, location, and any details you choose to include in messages or applications.

Information collected automatically. When you visit PracticeStory.io, we may collect basic technical information through cookies and analytics tools — including your IP address, browser type, device information, pages visited, and how you arrived at the site. This helps us understand how the site is used and improve it over time.

Information shared during an engagement. If you become a Practice Story partner, you may share clinical material, patient testimonials, case histories, internal documents, and other content related to your practice. This information is treated as confidential and used only for the purposes of the engagement.

How We Use Information

We use the information we collect to:

• Respond to inquiries and applications

• Schedule and conduct strategy calls

• Develop, refine, and deliver Practice Story books and the surrounding systems

• Communicate about your engagement, account, or new offerings

• Improve our website, services, and editorial processes

• Comply with legal obligations

We do not sell, rent, or trade your personal information to third parties.

Confidential Practice Material

Material shared during an engagement — clinical philosophy, patient stories, case histories, internal practice documents — is treated with discretion. We do not share, license, or reuse engagement-specific material outside the engagement without your explicit permission.

Patient identifying information (when shared with us) is handled with care and used only as needed to develop the book. Where appropriate, identifying details may be modified, composites may be used, and every patient story published in a finished book is reviewed and approved by you before publication.

If your engagement requires a Business Associate Agreement (BAA) or other formal data-handling arrangement under HIPAA or applicable state law, we will execute that agreement before any protected health information is shared.

Cookies and Analytics

We use cookies and similar technologies to operate the site, remember preferences, and understand how visitors use the site. You can disable cookies in your browser, but some parts of the site may not function as intended.

We may use third-party analytics services (such as Google Analytics) to understand site traffic. These services may collect information about your visits in accordance with their own privacy policies.

Sharing With Third Parties

We may share information with trusted service providers who help us operate our business — for example, email platforms, CRM software, payment processors, hosting providers, and fulfillment services. These providers are only authorized to use information as needed to perform their services for us.

We may disclose information if required by law, court order, or to protect the rights, property, or safety of Practice Story, our partners, or others.

Data Retention

We retain personal information for as long as needed to provide our services, fulfill the purposes described in this policy, comply with legal obligations, resolve disputes, and enforce agreements.

If you end your engagement with Practice Story, we retain records as needed for accounting, legal, and operational purposes, and then delete or anonymize information when no longer required.

Your Choices and Rights

You have the right to:

• Request access to the personal information we hold about you

• Request corrections to information that is inaccurate or incomplete

• Request deletion of your information (subject to legal and operational obligations)

• Unsubscribe from marketing communications at any time using the unsubscribe link or by contacting us

Depending on your location, you may have additional rights under laws such as the California Consumer Privacy Act (CCPA), the Colorado Privacy Act, or the General Data Protection Regulation (GDPR). Contact us at hello@practicestory.io for any privacy request.

Security

We use reasonable administrative, technical, and organizational measures to protect the information we collect. No method of transmission or storage is completely secure, but we take seriously our obligation to handle your information with care.

Children

PracticeStory.io is intended for adults. We do not knowingly collect information from anyone under 18.

Changes to This Policy

We may update this policy from time to time. Material changes will be posted on this page with an updated "Last updated" date. We encourage you to review this policy periodically.

Contact

Questions about this policy, requests about your information, or other privacy matters can be sent to:

Practice Story hello@practicestory.io

Three things worth flagging for an eventual lawyer pass:

1. The HIPAA/BAA paragraph under "Confidential Practice Material" is conservative — it commits to executing a BAA if needed. A lawyer may want to either strengthen this (commit to HIPAA-compliant handling for all healthcare-adjacent material) or specify the conditions more precisely.

2. The Colorado-specific reference under "Your Choices and Rights" is appropriate because that's where Practice Story is based, but if you're advertising or selling into California specifically, CCPA-specific language may need to be expanded.

3. The Data Retention section is intentionally vague. Some jurisdictions require specific retention periods to be stated. A lawyer can sharpen this.