Privacy Policy

01Scope and Application

This Privacy Policy ("Policy") describes how Engage Ads LLC, a Georgia limited liability company ("Engage Ads," "we," "us," or "our"), collects, uses, discloses, retains, and protects information when you:

• visit, browse, or interact with our website located at https://EngageAds.io and any subdomains, pages, microsites, or successor properties (collectively, the "Site");
• request information about our services, schedule a discovery or strategy call, complete a form, subscribe to a newsletter, or otherwise communicate with us;
• engage us as a service provider for paid advertising, patient acquisition, or related digital marketing services (collectively, the "Services"); or
• receive marketing or transactional communications from us.

This Policy does not govern: (i) Protected Health Information ("PHI") that may be processed under a Business Associate Agreement ("BAA") executed between Engage Ads and a covered entity client, which is governed exclusively by the BAA and HIPAA; (ii) personal information processed by our clients on their own systems, websites, or platforms; or (iii) personal information collected by third parties whose products, services, or websites you may access through links or integrations referenced on the Site.

By accessing the Site or providing personal information to us, you acknowledge that you have read and understood this Policy. If you do not agree with this Policy, you must not access the Site or provide personal information to us.

02Notice Regarding Protected Health Information (PHI) and HIPAA

Engage Ads provides paid advertising and patient-acquisition services to medical and elective healthcare practices that may be "covered entities" or "business associates" under the Health Insurance Portability and Accountability Act of 1996, as amended, and its implementing regulations (collectively, "HIPAA"). The Site and the information we collect through it are intended for prospective and existing business clients (medical practice owners and operators) — not for patients.

We do not solicit, collect, or knowingly process PHI through the Site, our public-facing forms, our marketing email, or our general business communications. You should not submit any patient identifiers, medical records, treatment information, billing information tied to a patient, or any other PHI through any channel on the Site.

When Engage Ads is engaged as a Business Associate of a covered entity client, the parties execute a Business Associate Agreement that governs all permitted uses, disclosures, safeguards, breach notification obligations, subcontractor flow-down requirements, and termination duties with respect to PHI. In the event of any conflict between this Policy and an executed BAA with respect to PHI, the BAA controls.

If you believe PHI has been transmitted to us inadvertently, please contact our Privacy Officer immediately using the contact information in Section 27 so that we may securely delete the information and document the incident.

03Definitions

For purposes of this Policy:

• "Personal Information" means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household, as such terms are defined under applicable law (including the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act ("CCPA/CPRA")). "Personal Information" includes "Personal Data" as that term is used in the EU General Data Protection Regulation 2016/679 ("GDPR") and the UK General Data Protection Regulation ("UK GDPR").
• "Sensitive Personal Information" means the subset of Personal Information identified as sensitive, sensitive personal data, or special category data under applicable law, including (without limitation) precise geolocation, racial or ethnic origin, religious or philosophical beliefs, union membership, genetic data, biometric data processed for unique identification, data concerning health, data concerning a person's sex life or sexual orientation, government identifiers, financial account credentials, and the contents of private communications.
• "Process" or "Processing" means any operation or set of operations performed on Personal Information, whether or not by automated means, including collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure, dissemination, alignment, restriction, erasure, or destruction.
• "Sell" and "Share" have the meanings given to them under the CCPA/CPRA, including (with respect to "sharing") cross-context behavioral advertising.
• "Service Provider," "Processor," and "Contractor" have the meanings given to them under applicable U.S. state privacy laws and the GDPR/UK GDPR, as applicable.

04Information We Collect

4.1 Categories of Information

The following table summarizes the categories of Personal Information we collect, examples of each, and how we obtain the information. The categories track the enumerated categories under California Civil Code § 1798.140, Virginia Code § 59.1-575, and analogous state statutes.

We do not knowingly collect: (i) Social Security numbers, driver's license numbers, state ID numbers, or passport numbers from Site visitors; (ii) financial account numbers, credit card numbers, or debit card numbers from visitors (payment card information for clients is collected and tokenized by our PCI-DSS compliant third-party payment processor and is not stored by Engage Ads in plaintext); (iii) precise geolocation data; (iv) genetic or biometric information; (v) information about racial or ethnic origin, religious beliefs, philosophical beliefs, or union membership; (vi) information regarding sex life or sexual orientation; (vii) the contents of mail, email, or text messages not addressed to us; or (viii) PHI.

05Sources of Information

We collect information from the following categories of sources:

• Directly from you, when you submit forms, schedule calls, send emails, communicate with our team, attend meetings, sign agreements, or otherwise interact with us.
• Automatically from your device or browser, through cookies, web beacons, pixels, software development kits, server logs, and similar technologies described in Section 8.
• From third-party business and prospect databases, including Apollo, Clay, ZoomInfo, LinkedIn Sales Navigator, public business records, professional licensing databases, practice directories, and analogous services we use for B2B prospect research.
• From advertising and analytics platforms, including Google (Google Ads, Google Analytics, YouTube), Meta (Facebook, Instagram), and other platforms we use to deliver, measure, and optimize marketing campaigns.
• From referral partners and existing clients who introduce you to us.
• From service providers and processors we engage to support our operations (CRM, email, calendaring, hosting, e-signature, payment processing, analytics, call recording, transcription, etc.).
• From publicly available sources, including business websites, regulatory filings, social media posts you have made publicly available, news media, and similar sources.

06How and Why We Use Information

We use the information described in Sections 4 and 5 for the following business and commercial purposes:

6.1 Provide and Administer the Site and Services

• Operate, maintain, secure, and improve the Site and the Services;
• Respond to inquiries, schedule and conduct discovery and strategy calls, deliver audits and proposals, and execute service agreements;
• Onboard clients, build and operate advertising campaigns, manage attribution, generate reports, and provide customer support;
• Process payments, issue invoices, and administer accounts.

6.2 Marketing, Sales, and Business Development

• Identify, research, and contact prospective clients in our target market (elective medical and high-ticket healthcare practices);
• Send marketing communications, newsletters, case studies, event invitations, and promotional content (you may opt out at any time);
• Personalize content, tailor outreach, and measure campaign performance;
• Conduct surveys, request feedback, and develop testimonials with consent.

6.3 Analytics, Research, and Improvement

• Analyze Site traffic, conversion paths, and user behavior;
• Conduct internal research, develop new services, and improve existing offerings;
• Train and improve internal tools and processes (without using PHI for any AI training).

6.4 Security, Fraud Prevention, and Legal Compliance

• Detect, investigate, and prevent fraud, abuse, security incidents, and unauthorized activity;
• Enforce our Terms of Service, contracts, and policies;
• Comply with applicable laws, regulations, court orders, and lawful requests from public authorities;
• Establish, exercise, or defend legal claims;
• Maintain records required by tax, accounting, employment, or other applicable law.

6.5 Corporate Transactions

If we become involved in a merger, acquisition, financing, restructuring, sale of assets, bankruptcy, or similar corporate transaction, we may use and transfer Personal Information in connection with the evaluation and consummation of the transaction, subject to appropriate confidentiality protections.

07Legal Bases for Processing (GDPR / UK GDPR)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, our legal bases for processing Personal Data are:

• Performance of a contract (GDPR Art. 6(1)(b)) — to provide Services you have requested or to take pre-contractual steps at your request.
• Legitimate interests (GDPR Art. 6(1)(f)) — for B2B prospecting, marketing to business contacts, fraud prevention, network and information security, internal administration, and analytics. We balance our interests against your fundamental rights and freedoms and you have the right to object (see Section 15).
• Consent (GDPR Art. 6(1)(a)) — where you have given clear consent for a specific purpose, including for non-essential cookies and certain marketing.
• Legal obligation (GDPR Art. 6(1)(c)) — where processing is necessary to comply with a legal obligation.
• Vital interests (GDPR Art. 6(1)(d)) — in rare circumstances to protect vital interests.

We do not rely on Special Category Data processing (GDPR Art. 9) as we do not collect such data through the Site.

08Cookies, Pixels, and Similar Technologies

8.1 What These Technologies Are

A "cookie" is a small text file stored on your device when you visit a website. A "pixel" or "web beacon" is a small piece of code embedded in a page that records that the page was loaded. We and our service providers use these and similar technologies (collectively, "Tracking Technologies") to recognize you across pages, remember your preferences, measure performance, and deliver advertising.

8.2 Categories of Tracking Technologies We Use

• Strictly necessary: required for the Site to function (session management, security, load balancing). These cannot be disabled through our consent banner.
• Functional / preferences: remember settings such as language and region.
• Analytics / performance: aggregate usage measurement.
• Advertising / targeting: deliver and measure marketing campaigns across platforms.

8.3 Specific Technologies Currently Deployed

The current third-party Tracking Technologies on the Site include the following. We may add, remove, or replace technologies and will update this Policy when we do.

• Google Analytics 4 (GA4) — operated by Google LLC, used for aggregate analytics and traffic-source measurement. Privacy notice: policies.google.com/privacy. Browser opt-out: tools.google.com/dlpage/gaoptout.
• Meta Pixel — operated by Meta Platforms, Inc., used to measure conversions and to support advertising on Facebook and Instagram. Privacy notice: facebook.com/privacy/policy. Ad preferences: facebook.com/settings?tab=ads.

We do not currently deploy Google Ads remarketing tags, LinkedIn Insight Tag, TikTok Pixel, or X (Twitter) tracking pixels on the Site, but reserve the right to add such technologies, with notice, in the future.

8.4 How to Manage Tracking Technologies

• Use the cookie consent banner displayed when you first visit the Site to accept or decline categories of non-essential cookies.
• Adjust your browser settings to block, delete, or warn about cookies (note: blocking strictly necessary cookies may impair Site function).
• Use industry opt-out tools at optout.aboutads.info (Digital Advertising Alliance) and youronlinechoices.eu (European Interactive Digital Advertising Alliance).
• Send a Global Privacy Control (GPC) signal from your browser. We treat a GPC signal as a valid request to opt out of "sale" and "sharing" for cross-context behavioral advertising under applicable U.S. state law (see Section 24).

09How We Disclose Information

We disclose Personal Information to the following categories of recipients, in each case subject to appropriate contractual safeguards (including data processing addenda where required by law):

• Service providers and processors that help us operate our business, including: hosting and infrastructure providers; CRM and marketing automation platforms (including GoHighLevel); email and calendar providers; analytics providers (including Google); advertising platforms (including Meta and Google); call tracking and recording providers; payment processors; e-signature providers; document storage providers; transcription providers; and professional advisors such as accountants and attorneys.
• Advertising partners, strictly as needed to deliver, measure, and improve our marketing. Where applicable law requires consent for such disclosures (including the CCPA/CPRA concept of "sharing" for cross-context behavioral advertising), we honor opt-out requests as described in Sections 10, 14, and 24.
• Government authorities and law enforcement, when required by subpoena, court order, statute, regulation, or other legal process, or where we believe in good faith that disclosure is necessary to protect rights, property, or safety.
• Acquirers and successors in connection with a merger, acquisition, financing, restructuring, asset sale, or similar transaction, subject to confidentiality protections.
• Affiliates under common ownership or control with us (currently none, but reserved).
• Third parties with your consent or at your direction.

We do not disclose Personal Information to data brokers for resale, and we do not knowingly sell Personal Information for monetary consideration.

10Sale and Sharing of Personal Information; Targeted Advertising

Under the CCPA/CPRA and analogous state privacy laws, certain disclosures of Personal Information for cross-context behavioral advertising — including the use of cookies and pixels operated by Meta and Google — may constitute "sharing" or "targeted advertising." For transparency:

• We have not "sold" Personal Information for monetary consideration in the past 12 months and do not intend to do so;
• We have "shared" identifiers, internet activity, and inferences with advertising platforms (Meta, Google) for cross-context behavioral advertising in the past 12 months;
• We do not knowingly "sell" or "share" Personal Information of consumers under 16 years of age.

To opt out of "sharing" or targeted advertising, you may: (i) submit a request as described in Section 16; (ii) toggle off non-essential cookies in our consent banner; (iii) enable a Global Privacy Control signal in your browser; or (iv) use the platform-specific controls referenced in Section 8.

11Data Retention

We retain Personal Information only for as long as is reasonably necessary to fulfill the purposes for which it was collected, including to satisfy legal, accounting, tax, regulatory, and reporting requirements; to enforce contracts; to resolve disputes; and to protect our rights and the rights of others. To determine the appropriate retention period, we consider the nature, volume, and sensitivity of the information, the potential risk of harm from unauthorized use or disclosure, the purposes for which we process it, applicable legal requirements, and whether we can achieve those purposes through other means.

General retention guidelines (subject to extension where required by law or by ongoing legal claims):

• Inquiry and prospect data: up to 24 months from last meaningful contact, after which the record is deleted or de-identified, except where you remain in our active outreach pipeline.
• Client engagement records (contracts, invoices, deliverables, correspondence): for the duration of the engagement plus seven (7) years, consistent with U.S. tax and statute-of-limitations periods.
• Marketing list membership: until you unsubscribe, plus a suppression record retained indefinitely to honor your unsubscribe request.
• Server, security, and access logs: typically 90 days to 24 months, depending on the system.
• Analytics data: subject to GA4 default retention of 2 to 14 months (configurable) and Meta retention defaults.
• Recorded calls (where applicable): up to 24 months unless deleted earlier on request.

When the retention period expires, we securely delete or de-identify the information so that it can no longer reasonably be associated with you.

12Information Security

We implement and maintain reasonable and appropriate administrative, technical, physical, and organizational safeguards designed to protect Personal Information against unauthorized access, disclosure, alteration, destruction, and loss. These safeguards include, without limitation: encryption of data in transit using industry-standard TLS; encryption at rest for sensitive systems; role-based access controls and least-privilege provisioning; multi-factor authentication for administrative access; vendor due diligence and contractual data protection terms; security awareness training; periodic review of security controls; logging and monitoring; and an incident response process.

No system or transmission is perfectly secure, however, and we cannot guarantee absolute security. You are responsible for maintaining the security of any account credentials, devices, and networks you use. If you believe Personal Information you have provided to us has been compromised, please contact our Privacy Officer immediately (Section 27). Where required by applicable law, we will notify affected individuals and regulators of a security incident within the timeframes mandated by law.

13International Data Transfers

Engage Ads is based in the United States, and the Personal Information we collect is processed in the United States and in other jurisdictions where our service providers operate. If you are located outside the United States, please be aware that the data protection laws of the United States and other jurisdictions may differ from the laws of your country.

When we transfer Personal Data from the EEA, the United Kingdom, or Switzerland to a country that has not received an adequacy decision, we rely on appropriate safeguards permitted by applicable law, including the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum, where applicable), supplemented as needed by additional technical and organizational measures. You may request a copy of the relevant transfer mechanism by contacting our Privacy Officer.

14Your Privacy Rights — United States

Subject to applicable law and verification, residents of certain U.S. states have the following rights:

14.1 Right to Know / Access

You have the right to confirm whether we are processing your Personal Information and to request access to: (i) the categories of Personal Information we have collected; (ii) the categories of sources; (iii) the business or commercial purposes for collection or sale/sharing; (iv) the categories of third parties to whom we have disclosed Personal Information; and (v) the specific pieces of Personal Information we have collected.

14.2 Right to Correct

You have the right to request that we correct inaccurate Personal Information, taking into account the nature of the information and the purposes of processing.

14.3 Right to Delete

You have the right to request deletion of Personal Information we have collected from you, subject to exceptions including completion of transactions, security, debugging, free speech, legal compliance, and internal uses reasonably aligned with your expectations.

14.4 Right to Opt Out of Sale, Sharing, and Targeted Advertising

You have the right to opt out of the "sale" or "sharing" of Personal Information and of "targeted advertising" or "cross-context behavioral advertising," as those terms are defined under applicable law. We honor Global Privacy Control signals as opt-out requests.

14.5 Right to Limit Use of Sensitive Personal Information

California residents have the right to limit our use and disclosure of Sensitive Personal Information to purposes specified under the CCPA/CPRA. We do not currently use Sensitive Personal Information for purposes that would require this right.

14.6 Right to Data Portability

Where required by law, you have the right to receive a copy of the Personal Information you have provided to us in a portable, readily usable format.

14.7 Right to Opt Out of Profiling

Where applicable law provides this right, you may opt out of profiling in furtherance of decisions that produce legal or similarly significant effects. We do not currently engage in such profiling.

14.8 Right to Non-Discrimination

We will not discriminate against you for exercising any of these rights. We will not deny services, charge different prices, or provide a different level of quality solely because you exercised a privacy right.

15Your Privacy Rights — EU, UK, EEA, and Switzerland

If you are located in the EEA, the United Kingdom, or Switzerland, you have the rights set out below, exercisable to the extent provided by GDPR Articles 12–22, the UK GDPR, and the Swiss Federal Act on Data Protection ("FADP"):

• Right of access (GDPR Art. 15);
• Right to rectification (GDPR Art. 16);
• Right to erasure / 'right to be forgotten' (GDPR Art. 17);
• Right to restriction of processing (GDPR Art. 18);
• Right to data portability (GDPR Art. 20);
• Right to object to processing (GDPR Art. 21), including a specific right to object to direct marketing at any time;
• Right not to be subject to automated decision-making with legal or similarly significant effects (GDPR Art. 22);
• Right to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal;
• Right to lodge a complaint with your local supervisory authority. EU contact details: edpb.europa.eu/about-edpb/members. UK residents: ico.org.uk.

16How to Exercise Your Rights

To exercise any of the rights described above, please submit a verifiable request using one of the following methods:

• Email: [email protected] with the subject line "Privacy Rights Request";
• Mail: Privacy Officer, Engage Ads LLC, [physical mailing address as displayed in the Site footer];
• Phone: 404-480-3042.

We will need information sufficient to verify your identity and confirm that the request relates to you, which generally includes confirming the email address, phone number, or business name on record. We may need to ask for additional information to verify the request, but we will use any information you provide solely to process the request. We will respond within the timeframes required by applicable law (generally 45 days under U.S. state laws, 30 days under GDPR/UK GDPR), with one extension where permitted.

We do not charge a fee for processing or responding to a verifiable request unless the request is excessive, repetitive, or manifestly unfounded, in which case we may charge a reasonable fee or decline the request, as permitted by applicable law.

17Authorized Agents

You may use an authorized agent to submit a request on your behalf. The authorized agent must provide us with: (i) signed, written permission from you authorizing the agent to act on your behalf; or (ii) proof of a power of attorney under applicable state law. We may require you to verify your identity directly with us before processing the request, even if it is submitted by an authorized agent.

18Appeals and Complaints

If we deny your privacy rights request, you may appeal our decision by replying to our denial response or by submitting a new request to [email protected] with the subject line "Privacy Rights Appeal." We will review the appeal and respond in writing within the timeframe required by applicable law (generally 45 to 60 days). If we deny the appeal, we will provide a written explanation and inform you of any additional remedies available under applicable law, including the right to contact your state attorney general or supervisory authority.

Virginia residents may contact the Virginia Attorney General at oag.state.va.us. Colorado residents may contact the Colorado Attorney General at coag.gov. Other state residents should consult their state's attorney general.

19Children and Minors

The Site is not directed to children under the age of 16, and we do not knowingly collect Personal Information from children under 16. If we learn that we have collected Personal Information from a child under 16 without verifiable parental consent, we will delete the information promptly. Parents or guardians who believe their child has provided Personal Information to us may contact our Privacy Officer.

Consistent with the CCPA/CPRA, we do not "sell" or "share" Personal Information of consumers under 16 years of age without affirmative authorization (opt-in for ages 13–15; parental opt-in for ages under 13).

20Automated Decision-Making and Profiling

We do not engage in automated decision-making, including profiling, that produces legal or similarly significant effects concerning you within the meaning of GDPR Article 22 or analogous U.S. state laws. Internal lead-scoring tools we use for sales qualification do not produce legal or similarly significant effects on you and remain subject to human review before any meaningful action is taken.

21Sensitive Personal Information

We do not collect, use, or disclose Sensitive Personal Information for purposes that require an opt-out or limit-use right under applicable law. Where any element of Sensitive Personal Information is incidentally collected (for example, account credentials transmitted to support staff), we use it only for the purposes for which it was provided and apply heightened safeguards consistent with industry practice.

22De-Identified, Aggregated, and Anonymous Information

We may de-identify or aggregate Personal Information so that it is no longer reasonably capable of identifying any individual or household. We use de-identified and aggregated information for analytics, research, benchmarking, marketing, and product improvement. We commit to: (i) maintaining and using such information in de-identified form; (ii) not attempting to reidentify the information; and (iii) contractually obligating any recipient to comply with these commitments.

23Email Marketing and CAN-SPAM

Our email marketing complies with the CAN-SPAM Act of 2003 and analogous laws. Every commercial email we send: (i) accurately identifies Engage Ads as the sender; (ii) uses a non-deceptive subject line; (iii) discloses that it is an advertisement (where required); (iv) includes our valid postal address; and (v) provides a clear, conspicuous, and functioning opt-out mechanism that we honor within 10 business days. To unsubscribe, click the "unsubscribe" link in any marketing email or send a request to [email protected] with the subject line "Unsubscribe." Even after you opt out of marketing, we may continue to send transactional or relationship communications (such as account, billing, or service notices).

24Do Not Track Signals and Global Privacy Control

Most browsers offer a "Do Not Track" ("DNT") setting. Because there is no industry-accepted standard for how to interpret DNT signals, we do not currently respond to DNT signals. Where required by applicable law, we honor opt-out preference signals such as the Global Privacy Control ("GPC") as a valid request to opt out of the "sale" or "sharing" of Personal Information for cross-context behavioral advertising.

25Third-Party Websites and Services

The Site may contain links to, or integrate features of, third-party websites, applications, and services, including social media platforms, advertising platforms, partner websites, and client websites. This Policy does not apply to those third parties, and we are not responsible for their privacy practices. We encourage you to review the privacy policies of any third party with whom you interact.

26Notice of Material Changes

We may update this Policy from time to time. When we make material changes, we will revise the "Effective Date" and "Last Updated" date above and provide additional notice as appropriate (for example, by posting a banner on the Site, by email to active clients, or by other reasonable means). Your continued use of the Site after the revised Policy takes effect constitutes acceptance of the revised Policy. We encourage you to review this Policy periodically.

27Contact Information and Privacy Officer

If you have questions, requests, or concerns about this Policy or our privacy practices, please contact our Privacy Officer:

We strive to respond to legitimate inquiries within thirty (30) days, or sooner where required by applicable law.

28State-Specific Disclosures and Metrics

28.1 California 'Shine the Light' (Cal. Civ. Code § 1798.83)

California residents may request information regarding our disclosures of Personal Information to third parties for direct marketing purposes during the immediately preceding calendar year. We do not currently disclose Personal Information to third parties for their own direct marketing purposes.

28.2 California Right-to-Know Metrics

Where required, we publish annual metrics regarding right-to-know, deletion, correction, and opt-out requests received and processed. Until our first reporting period closes, no historical metrics are available; updated metrics will be published in this section.

28.3 Nevada Sale Opt-Out (NRS 603A.340)

Nevada residents have the right to opt out of the "sale" of certain covered information for monetary consideration. We do not sell covered information for monetary consideration. To submit a verified request, contact [email protected].

28.4 Washington 'My Health My Data' Act

We do not knowingly collect "consumer health data" as defined in the Washington My Health My Data Act through the Site. PHI handled in connection with healthcare client engagements is governed by the BAA, not this Policy.

29Accessibility

We are committed to making this Policy accessible. If you require this Policy in an alternative format (large print, plain text, or screen-reader-compatible), please contact [email protected] and we will provide an accessible version.