Privacy Policy

Desired State IT LLC ("Desired State IT," "DSIT," "we," "us," or "our") operates the ClinicFlow marketing website located at clinicflow.desiredstateit.com and associated subdomains (the "Site"). This Privacy Policy explains how we collect, use, disclose, and safeguard information when you visit our Site or interact with our services. Please read this policy carefully. If you disagree with its terms, please discontinue use of the Site.

1. Information We Collect

1.1 Information You Provide Directly

When you fill out a contact form, strategy call request, or any other form on this Site, we may collect:

• First and last name
• Business email address
• Phone number (if provided)
• Clinic or business name
• Any additional information you voluntarily include in a message field

1.2 SMS and Text Message Opt-In

If you provide your phone number and opt in to receive SMS communications from Desired State IT, we collect your mobile phone number and your expressed consent to receive text messages. We do not share, sell, rent, or disclose your mobile phone number or SMS opt-in data to third parties or affiliates for marketing or promotional purposes. SMS opt-in data is used solely to send messages related to the program you enrolled in, such as appointment confirmations, follow-up communications, or service-related updates from Desired State IT.

Mobile information collected for SMS communications will not be shared with third parties or affiliates for marketing or promotional purposes. All other categories of personal data may be shared with third parties only as described in this Privacy Policy.

1.3 Information Collected Automatically

When you visit the Site, we may automatically collect certain technical data, including:

• IP address
• Browser type and version
• Operating system
• Referring URLs
• Pages viewed and time spent on the Site
• Date and time of your visit

This data is collected through cookies and similar tracking technologies, including Google Analytics 4 (GA4). See Section 5 for more information on cookies.

1.4 Information We Do Not Collect

This Site does not collect, process, or store any of the following:

• Protected Health Information (PHI) as defined under HIPAA
• Payment card or financial account information
• Government-issued identification numbers
• Sensitive personal information beyond what is described above

2. How We Use Your Information

We use the information we collect for the following purposes:

• To respond to inquiries — to follow up on contact form submissions and strategy call requests
• To send SMS communications — only to individuals who have explicitly opted in, and only for the stated program purpose
• To improve the Site — using aggregated analytics data to understand how visitors interact with our content
• To send service-related communications — including onboarding information, updates, and transactional messages related to ClinicFlow or Clinic Insight Manager
• To comply with legal obligations — where required by applicable law

We do not use your personal information for automated decision-making or profiling that produces legal or similarly significant effects.

3. SMS / Text Messaging Program

3.1 Opt-In and Consent

By providing your phone number and checking the SMS consent box on any form on this Site, you expressly consent to receive text messages from Desired State IT at the number provided. Consent is not a condition of purchasing any product or service. You may opt out at any time (see Section 3.3).

3.2 Message Frequency and Rates

Message frequency varies based on your interaction with our services. Standard message and data rates may apply depending on your mobile carrier plan.

3.3 Opt-Out Instructions

You may opt out of SMS communications at any time by replying STOP to any message you receive from us. After opting out, you will receive one final confirmation message and no further SMS messages will be sent. To re-enroll, you must provide express consent again.

3.4 Help

Reply HELP to any SMS message for assistance, or contact us at hello@desiredstateit.com. Carriers are not liable for delayed or undelivered messages.

3.5 No Third-Party Sharing of SMS Data

Mobile opt-in data and phone numbers collected for SMS communications will not be shared with, sold to, or transferred to any third party or affiliate for marketing or promotional purposes. This is a firm policy with no exceptions.

4. How We Share Your Information

We do not sell your personal information. We may share your information in the following limited circumstances:

• Service providers — we work with trusted third-party vendors who assist in operating the Site and delivering services, including Google Analytics, Google Cloud Platform, and scheduling tools. These vendors are contractually obligated to protect your data and may not use it for their own purposes.
• Business transfers — if Desired State IT is acquired, merged, or transfers its assets, your information may be transferred as part of that transaction. You will be notified via prominent notice on the Site.
• Legal requirements — we may disclose information if required by law, subpoena, or governmental authority, or if we believe in good faith that disclosure is necessary to protect the rights, safety, or property of Desired State IT, our users, or the public.
• With your consent — for any other purpose with your explicit prior consent.

We expressly do not share mobile phone numbers or SMS opt-in data with third parties or affiliates for marketing or promotional purposes under any circumstances.

5. Cookies and Tracking Technologies

We use cookies and similar technologies to operate and improve the Site. These include:

• Essential cookies — necessary for the Site to function
• Analytics cookies — Google Analytics 4 (GA4), which collects anonymized usage data to help us understand how the Site is used. Google's data practices are governed by Google's Privacy Policy.

You may disable cookies through your browser settings. Disabling analytics cookies will not affect your ability to use the Site. For visitors from the European Economic Area (EEA) or United Kingdom, we honor cookie consent preferences in accordance with applicable law.

6. Data Retention

We retain personal information only as long as necessary for the purposes described in this Policy, or as required by applicable law. Contact form submissions are retained for up to 24 months. SMS opt-in records are retained for a minimum of 4 years to comply with carrier and regulatory requirements. Analytics data is subject to Google Analytics' retention settings.

7. Your Rights — GDPR (EEA / UK Residents)

If you are located in the European Economic Area or the United Kingdom, you have the following rights under the General Data Protection Regulation (GDPR) or UK GDPR:

• Right of access — to request a copy of the personal data we hold about you
• Right to rectification — to request correction of inaccurate or incomplete data
• Right to erasure — to request deletion of your personal data, subject to legal retention obligations
• Right to restrict processing — to request that we limit how we use your data
• Right to data portability — to receive your data in a structured, machine-readable format
• Right to object — to object to processing based on legitimate interests or for direct marketing purposes
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting prior lawful processing

Our lawful basis for processing personal data is: (a) your consent, for SMS communications and analytics; (b) legitimate interests, for responding to business inquiries; and (c) legal obligation, where applicable.

To exercise any of these rights, contact us at hello@desiredstateit.com. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.

8. Your Rights — California Residents (CCPA)

If you are a California resident, you have the right to:

• Know what personal information we collect and how it is used
• Request deletion of your personal information
• Opt out of the sale of personal information — we do not sell personal information
• Non-discrimination for exercising your privacy rights

To submit a request, contact us at hello@desiredstateit.com.

9. Data Security

We implement commercially reasonable administrative, technical, and physical safeguards to protect your personal information against unauthorized access, alteration, disclosure, or destruction. However, no method of internet transmission or electronic storage is 100% secure. We cannot guarantee absolute security.

10. Third-Party Links

This Site may contain links to third-party websites, including scheduling tools and external resources. We are not responsible for the privacy practices of those sites. We encourage you to review their privacy policies before providing any personal information.

11. Children's Privacy

This Site is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a minor, we will take steps to delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last Updated" date at the top of this page. We encourage you to review this Policy periodically. Continued use of the Site after changes are posted constitutes your acceptance of the revised Policy.

13. Contact Us

If you have questions or concerns about this Privacy Policy or your personal data, please contact us: