Privacy Policy

GRAYS™ Strategy LLC (“we,” “us,” “our”) operates the website graysstrategy.com (the “Website”). This Privacy Policy explains how we collect, use, disclose, and protect information when you visit our Website or contact us.

By using our Website, you consent to the practices described in this Privacy Policy.

GRAYS™ Strategy LLC is a Wyoming limited liability company providing strategic consulting services to healthcare organizations. This Privacy Policy applies only to information collected through our Website.

We collect limited information necessary to respond to inquiries and improve our Website.

Information You Provide Directly

When you contact us via email at info@graysstrategy.com, we receive:

• Your email address

• Your message content

• Any information you choose to include in your email (such as name, organization, role)

Providing this information is voluntary. You may choose not to contact us if you prefer not to share this information.

Information Collected Automatically

When you visit our Website, our website host, Squarespace, processes certain technical information to deliver and secure the Website, and its built-in analytics report on how the Website is used. We have restricted non-essential cookies. The information reported to us includes:

• Usage information (pages visited and traffic trends)

• Approximate geographic location, as reported by the analytics dashboard

• Traffic source (how you found our Website)

Squarespace may also process your IP address to deliver and secure the Website. We have turned off the Squarespace setting that logs visitor IP addresses for our review. We use the information reported to us in aggregate, and we do not use it to identify individual visitors.

We use the information we collect for the following purposes:

Email Inquiries

• To respond to your inquiries

• To provide information about our services

• To schedule consultations or discovery calls

• To pursue legitimate business development activities

Website Analytics

• To understand how visitors use our Website

• To improve Website functionality and user experience

• To analyze traffic patterns and content engagement

• To optimize Website performance

We do NOT use your information for:

• Marketing to third parties

• Selling or renting your personal information

• Targeted advertising

• Purposes unrelated to our consulting services

We use the following third-party services that may process your information:

Squarespace (Website Hosting and Analytics)

Purpose: Website hosting, content delivery, security, and built-in traffic analytics

Data collected: Technical logs, IP addresses for service delivery, and aggregate usage data

Privacy Policy: https://www.squarespace.com/privacy

Squarespace may process technical data such as your IP address to deliver and secure the Website, under its own privacy policy.

Microsoft 365 (Email Service)

Purpose: Receiving and managing email inquiries sent to info@graysstrategy.com, privacy@graysstrategy.com, and accessibility@graysstrategy.com

• Data collected: Email content you send to us

• Privacy Policy: https://privacy.microsoft.com/privacystatement

These third-party services maintain their own data protection practices. We are not responsible for their privacy practices. We encourage you to review their privacy policies.

Email Security and Limitations

When you send email to info@graysstrategy.com, privacy@graysstrategy.com, or accessibility@graysstrategy.com:

• Your email is transmitted using your email provider’s infrastructure

• We receive your email via Microsoft 365

• Email security depends on both your email provider and our email service

• We cannot guarantee the security of information sent via standard email

• Email is not encrypted end-to-end unless you use encrypted email services

We are not responsible for the security practices of your email provider or the transmission of email over the internet.

The Website contains direct email links and contact buttons. Use of these links does not guarantee that you will have read the HIPAA notice above. Do not include PHI in any email to us under any circumstances. We will arrange an appropriate secure channel under a formal engagement agreement before any PHI is discussed.

Our Website is hosted by Squarespace. We have configured the Website to restrict non-essential cookies.

What Are Cookies?

Cookies are small text files stored on your device that help websites function and analyze usage.

Cookies We Use

Squarespace may set strictly necessary cookies that keep the Website secure and working. We do not add third-party analytics, advertising or tracking tools to the Website.

We do not add any of the following:

• Analytics cookies

• Advertising cookies

• Social media tracking cookies

• Third-party marketing cookies

Managing Cookies

You can control cookies through your browser settings. However, disabling cookies may affect Website functionality.

Browser instructions:

• Chrome: Settings > Privacy and Security > Cookies

• Firefox: Settings > Privacy & Security > Cookies and Site Data

• Safari: Preferences > Privacy > Cookies and Website Data

• Edge: Settings > Privacy, Search, and Services > Cookies

Social Links

Articles in Clarity Defined include a LinkedIn share button.

• The button is a plain link. It loads no code from LinkedIn and sets no cookies.

• Selecting it takes you to LinkedIn, and LinkedIn’s privacy policy then applies.

We implement reasonable security measures to protect your information from unauthorized access, use, alteration, or disclosure.

Technical Measures

• SSL/TLS encryption (HTTPS) for traffic between your browser and the Website

• Website hosting with Squarespace, a managed hosting provider

• Email received through Microsoft 365, which supports encryption in transit when the sender’s email provider also supports it

Access Controls

• Limited access to email inquiries

• Email inquiries processed and stored in Microsoft 365

Security Limitations

No method of transmission over the internet or electronic storage is 100% secure. While we maintain commercially reasonable safeguards, we cannot guarantee absolute security.

Email Security Considerations

Standard email is not encrypted end-to-end. When you email us:

• Your email provider’s security practices apply to transmission

• Our email service (Microsoft 365) applies its security practices to storage

• We cannot control security of email in transit over the internet

• For sensitive communications, we recommend waiting until formal engagement begins and secure communication channels are established

Data Breach Notification

If a data breach affects your personal information, we will notify you as required by applicable law. The notice will describe the nature of the breach and the steps we are taking to address it.

We retain your information only as long as necessary for legitimate business purposes.

Email Inquiries (Prospects)

We retain email inquiries for up to 2 years unless an active business relationship exists. After 2 years, if no engagement has materialized, we generally delete the information.

You may request earlier deletion at any time (see “Your Privacy Rights” below).

Active Client Relationships

For clients with whom we have executed service agreements, we retain contact information and project records for the duration of the engagement plus 7 years thereafter.

This retention period is:

• Required for professional liability and contractual obligations

• Necessary for tax and legal compliance

• Consistent with professional services industry standards

Website Analytics Data

Squarespace holds website analytics data under its own retention practices and reports it to us in aggregate. This data does not identify individual visitors to us.

Retention Flexibility

We may retain data longer when required for legal compliance, dispute resolution, or legitimate business purposes.

We periodically review and delete data that is no longer necessary.

Our Website and services are not directed to individuals under the age of 18.

We do not knowingly collect personal information from anyone under 18 years of age.

If you are under 18, do not use this Website or submit any information through email.

If we become aware that we have collected information from a person under 18, we will delete that information promptly.

Parents or guardians who believe we may have collected information from someone under 18 should contact us at info@graysstrategy.com.

The Website is operated from the United States and is directed to organizations in the United States. If you visit from another country, your information is processed in the United States, where privacy laws may differ from those where you live.

All Users (Regardless of Location)

All users have the following rights:

Right to Access

Request information about what personal data we hold about you.

Right to Correction

Request correction of inaccurate information.

Right to Deletion

Request deletion of your information (subject to legal retention requirements).

Right to Opt-Out of Communications

Opt out of future communications from us.

How to Exercise Your Rights

Contact us at: privacy@graysstrategy.com

Subject line: “Privacy Rights Request”

We will respond promptly, and within any time the law requires.

We may update this Privacy Policy periodically to reflect changes in our practices, legal requirements, or business operations.

When we make changes:

• We will update the “Last Updated” date at the top of this policy

• Material changes will be indicated with a notice on our Website

• Continued use of our Website after changes constitutes acceptance of the updated policy

We encourage you to review this Privacy Policy periodically.