Privacy Policy

1. Who we are, and what this covers

healthcareops.marshall.work is run by Consumer Mesh LLC, a Michigan limited liability company, doing business as Marshall. We are the controller of the personal information described here — the party that decides why it is held and what happens to it.

This policy covers healthcareops.marshall.work and the pages on it. It does not cover marshall.work, the apex site, which publishes its own privacy policy, and it does not cover sites we link to or services we use that run under their own policies.

The work we do for clients is governed by the agreement we sign with them, not by this policy.

Questions, requests and complaints all go to [email protected]. A person reads that address.

2. The short version

• Analytics is off until you turn it on. You are asked once, and until you answer, nothing is loaded and nothing is stored on your device.
• We collect two kinds of thing: what you type into the scorecard, an email address if you choose to give us one, and — if you accept — analytics about how the site is read.
• Declining analytics does not affect the scorecard or your report. They work the same either way.
• There are no accounts and no passwords, because there is nothing to log into.
• We take no payments on this site, so we never see your card details.
• We do not run advertising, we do not sell your information, and we do not buy it from anyone else.
• We do not use advertising cookies, and nothing on this site follows you to other websites.
• We ask you not to put patient information in the scorecard, and the questions are written so that you never need to.
• You can ask us what we hold about you and ask us to delete it, and we will.

3. What you give us

We hold personal information about you because you handed it over. In practice there are four ways that happens.

• The scorecard. The twenty answers you give, and — if you want the full report — your first name and your work email address. The section on what happens to a scorecard submission describes exactly where that goes. None of it depends on the analytics banner: the scorecard and the report work identically whether you accept or decline.
• The design gate. If you ask for one of our design documents, we ask for your email address. We use it to give you the document, to keep a record that you asked for it, and to reply if you write to us. This does not depend on the analytics banner: the document unlocks either way, and either way we keep the same record — that you asked us for something, which is not the same as measuring you.
• Booking a fit check. The booking page is a Calendly calendar. When you pick a time you give your name, your email address, and anything Calendly asks you for — usually a time zone and sometimes a note about the process you want to discuss.
• Writing to us. If you email [email protected], we hold your address and whatever you chose to tell us, for as long as the conversation and our records need it.

4. What we collect automatically

Nothing, until you accept analytics. If you decline the banner, or never answer it, this section does not apply to you: no analytics code is loaded, no cookie or local storage entry is written, and no request reaches our analytics provider at all. Your scorecard answers are added up in your browser and sent to our own endpoint, which is unaffected — that part of the site is not analytics and never waits on the banner.

If you do accept, the site records how it is used, and two parties do the recording: our analytics, which sees what happens on the page, and our host, which sees that a request arrived at all. What is collected is:

• the pages you view, and when you viewed them;
• the links, buttons and controls you click, and the elements you interact with;
• the page you arrived from, and any campaign parameters in the link you followed;
• your device and browser type, screen size, and language;
• the country your connection appears to come from;
• an identifier kept in your browser so a return visit is recognised as the same browser rather than a new stranger;
• if something breaks on the page, a report about the error, including the browser and page it happened on;
• at our host, Cloudflare: the request itself, including the IP address it came from, held in short-lived logs to deliver pages and keep the site free of abuse. This one is not subject to the banner — it happens for any request, because a page cannot be served without it — and those logs are not used to build a profile of you.

Nothing above is about what you type into a form. Your answers, your first name and your email address reach us because you chose to submit them — that is "What you give us", and it is the only reason we have them. What we do not do is record form input as you type: if session recording is ever switched on in our analytics project, the text in input fields is masked before it leaves your browser, and this section and the storage table below will be updated to say so plainly.

5. What happens to a scorecard submission

The assessment is the one place on this site where you give us something substantial, so here is the whole journey of a submission, in order.

• Your answers are added up in your browser. The total, the band and your highest-risk dimension are shown to you there, and you see them whether or not you give us anything.
• If you ask for the full report, your first name, your work email and your twenty answers are sent to our own submission endpoint on this site — not to a third party, and not through our analytics, so it does not wait on the banner — together with the summary your browser calculated, the page you were on, the page you came from, and the time you sent it.
• That endpoint checks the submission is well formed, then passes it to the system that builds your report, together with the country Cloudflare reports for your connection and your browser's user agent. It keeps a record of the time it arrived.
• Your report is generated and emailed to the address you gave us.
• We keep the submission so we can answer you about it, and so we can see whether the assessment is working. The summary your browser calculated is kept only so we can spot a disagreement between what you were shown and what the report says — the report is never built from it.
• Where the submission limit described below is switched on, your IP address is written to a counter so the limit can be applied. That counter is not part of your submission, it is not used for anything else, and it expires within the hour.

To stop the form being used as a way to flood us, we limit how many submissions can come from one connection in an hour — five, at the time of writing. Where that limit is switched on, the counter is held by our host for up to an hour and then expires on its own. And the questions are about how work moves, not about people: if you find yourself typing anything about a patient, stop, and read the section on health information before you go on.

6. What we do not collect

• No analytics at all, if you decline — not a page view, not a click, not a country.
• No account details and no passwords — the site has no login.
• No payment or card details — we take no payments here.
• No precise location. We may see the country a visit came from; we do not ask your device where you are.
• No advertising identifiers, no tracking pixels, and no data bought from data brokers.
• No protected health information. The section on health information asks you not to send it, and explains why.

7. Cookies and similar technologies

Cookies are small files a site asks your browser to keep. We use as few as we can, and we set none for advertising. This is the complete list for this site.

The scorecard is not on this list because it sets nothing of its own: your answers are held in the page while you work through it, and the per-IP submission counter described under "What happens to a scorecard submission" lives on our server, not in your browser.

8. The choice you are asked to make

A banner appears at the bottom of every page until you answer it. It has two buttons and no other way out: no close cross, no clicking outside it, nothing that expires. That is deliberate. A banner that can be waved away without answering looks like agreement while recording nothing of the sort, so the only two things you can do with it are the two things it asks.

It does not block the page. You can read, scroll, and take the whole assessment while it waits, and the site behaves identically whichever button you press — the scorecard scores the same and the report still arrives. Ignoring it is a valid answer, and it means no.

Your answer is remembered in your own browser, and only for the site you gave it on: accepting here does not switch analytics on for marshall.work, which will ask you separately. If we ever change what we are asking for — a new provider, a new purpose — the question is asked again rather than your old answer being stretched to cover it.

To change your mind, use Cookie settings in the footer of any page. Accepting again starts the analytics; declining stops it, clears the identifiers it left in your browser, and leaves the site working exactly as before. It cannot unsend what was already collected — for that, ask us to delete it, and we will.

9. Cookies: what we do with them, and what we do not

That table is the whole of it, and the analytics rows in it exist only after you accept. We set nothing else ourselves, and we use what we set to understand which pages are read and where they lose people — not to advertise to you, and not to follow you to other websites.

The analytics cookie is deliberately set across all of marshall.work, which means the apex site can see it too — that is the point of it, so a visit that moves between our two sites reads as one visit rather than as two unrelated strangers. It is only ever written by a site you accepted on: each of our sites asks separately, and one site's yes does not silently become another's.

We do not currently act on browser "Do Not Track" signals. There is no settled standard for what they mean, so honouring one browser's version and ignoring another's would be theatre rather than privacy. We do act on requests you send us directly, and because we do not sell or share personal information, there is no sale for a Global Privacy Control signal to switch off.

10. How we use what we collect

• To run the site and keep it working, secure and available.
• To add up your answers, show you your result, and build and email the report you asked for.
• To understand how the site is read — which pages help, which are ignored, where people give up — so we can improve it.
• To send you the document you asked for, and to send the few related resources the scorecard form promises. Every message has a way out.
• To answer you when you write, and to arrange and hold the call you booked.
• To find and fix faults, including errors that break a page, and to stop the forms being abused.
• To meet our legal and accounting obligations, and to enforce our terms.

We do not use your information to make automated decisions about you, and we do not profile you for advertising. The scorecard produces a number about an operation, not a judgement about a person.

11. What we rely on when the law requires a basis

We are based in the United States and this site is aimed at businesses there. If you are in the European Economic Area, the United Kingdom or Switzerland, this is the basis on which we hold your information.

• Your consent — for everything PostHog does here, and for the related resources we email you after a scorecard submission. It is not a basis we fall back on after the fact: the analytics does not run, and is not loaded, until you have actively agreed to it.
• Our legitimate interests — in keeping the site secure and free of abuse, and in running our business, balanced against your rights. This is what covers the hosting logs that a served page cannot avoid.
• Performance of a contract, or steps towards one — producing and sending the report you asked for, sending you a document you asked for, and holding the call you booked.
• Legal obligation — where we must keep or disclose something to comply with the law.

Where we rely on consent you can withdraw it at any time, and where we rely on legitimate interests you can object. Cookie settings in the footer is the quickest way for analytics; everything else goes to [email protected]. Unsubscribing from an email works too, and does not require you to explain yourself.

12. Who we share it with

We do not sell your personal information, and we do not share it for advertising. We use a small number of companies to run the site, and they see only what their part of it requires.

13. When else we disclose it

Beyond those companies, we disclose personal information only when we have to: to comply with the law or a valid legal request, to enforce our terms, to protect the rights, safety or property of anyone, or as part of a merger, acquisition or sale of assets — in which case the information would move with the business, under this policy, and we would tell you.

One of those providers is entitled to use what it receives for its own purposes, because of the way its service works — Calendly is the one that matters here. That is one more reason the calendar sits on its own page, behind a click.

14. How long we keep it

• Scorecard submissions, and the reports built from them: kept while we have a reason to — normally until you ask us to delete them, or until we have had no contact with you for 24 months.
• The per-IP submission counter: up to one hour, and then it expires. Only held where the submission limit is switched on.
• An email address you gave us for a document, and anything you wrote to us: kept on the same basis as a submission.
• Your answer to the banner: kept in your own browser until you clear site data or change your mind, and it never leaves your browser. We are not told what you chose.
• Analytics: kept according to the retention period set on our analytics account, and deleted or aggregated once it has served its purpose.
• Booking details: held by Calendly under its own settings, and by us for the same period as correspondence about it.
• Server and security logs at our host: short-lived, typically days, and kept only to keep the site up and free of abuse.
• Anything we must keep for tax, accounting or legal reasons: kept for as long as the law requires, and used for nothing else.

When you ask us to delete something, we delete it from our own systems — including the report system — and pass the request to the providers above. Some of them hold their own copies under their own policies; Calendly is the one to read if that matters to you.

15. Keeping it secure

The site is served over HTTPS. Submissions travel to our own endpoint on this domain rather than to a third party, and access to what we hold is limited to the people who need it to do their work, with the accounts that hold it protected by strong authentication.

No site can promise perfect security, and we will not pretend otherwise. What we can promise is that we hold as little as the work allows, and nothing we do not need. If a breach ever affected your information, we would tell you and the relevant authorities as the law requires.

16. Your choices and your rights

However you got here, you can ask us to do any of these, and we will not treat you differently for asking:

• tell you what we hold about you, and give you a copy — including your scorecard submission and the report built from it;
• correct anything that is wrong;
• delete what we hold, subject to the few things we must keep by law;
• give you what you gave us in a portable form;
• stop using it in a particular way, or object to our using it at all;
• withdraw any consent you gave, without it affecting what happened before. For analytics that is one click — Cookie settings, in the footer of any page — and it takes effect immediately, stopping collection and clearing the identifiers from your browser;
• stop emailing you. Every message we send has a way out, and replying 'stop' works.

17. How to make a request

Write to [email protected]. Tell us what you want and enough about who you are for us to find you — usually the email address you used. If we cannot identify you from what you send, we may ask for a little more, which is a protection rather than an obstacle. We answer within 45 days, and we will tell you if we need longer and why.

If we refuse a request, we will say so and explain the reason, and you can reply and ask us to look again — a different person will. If you are still unhappy you can complain to your local data protection authority. You can also use an authorised agent to make a request for you; we may ask them to prove you authorised them.

These rights are not identical everywhere. We offer them to everyone who asks, whatever jurisdiction they are in, because the alternative — deciding who deserves privacy based on where a request came from — is not a position we want to defend.

18. Health information: please do not send it

This site is aimed at healthcare operations, and this is the section that matters most on it. It is a marketing site. It is not a system for handling protected health information, it is not designed or secured for it, and we do not act as a business associate for anything sent through it.

Please do not enter protected health information anywhere on this site — not in the scorecard's answers, not in any field, not in an email to us. No patient records, no member identifiers, no clinical detail, no dates of service tied to a person.

The assessment is written so that you never need to. Its questions are about how work moves: who chases what, where a file waits, what happens when something unusual arrives. Describe the process, not the people in it.

If such information reaches us anyway, we may delete it without reading it or acting on it. If your work needs a business associate agreement, private infrastructure, or a specific commitment about where data lives, raise it with us directly: that belongs in a contract, and we will handle it there rather than through a website.

19. Children

This site is for people acting for a business, and it is not intended for anyone under 18. We do not knowingly collect information from children. If you believe a child has given us information, write to [email protected] and we will delete it.

20. Where your information is processed

We are in the United States, and the information described here is held there — including the scorecard submissions and the reports built from them, which stay in the report system we control.

Our analytics provider stores its data in the United States, and our booking calendar and our email are run by companies that may process data in the United States and elsewhere. Our host, Cloudflare, serves the site from a network that spans the world, so a request may be handled close to you wherever you are; the records we keep about you, as opposed to the passing of a request, are in the United States.

If you are in the European Economic Area, the United Kingdom or Switzerland, that means your information is transferred outside it. Our providers put the safeguards required for that transfer in place — standard contractual clauses, and where they apply, the frameworks that govern transfers to the United States.

21. Changes to this policy

When what we do changes, this policy changes with it, and the effective date at the top of the page changes too. We do not keep a backlog of old versions, because the only version that can mislead you is the current one.

The site has no accounts, so we cannot email you about a change. If this policy matters to you, read it on the date printed at the top, and ask us if anything in it is unclear.

22. Contact

Everything in this policy — questions, access and deletion requests, objections, complaints — goes to [email protected].

Consumer Mesh LLC, doing business as Marshall, Michigan, United States.