Privacy Policy

This Privacy Policy describes how Marsa Health (“we”, “us”) handles personal information collected through the marsahealth.com website, including the demo-request and contact forms, blog, calculators, and other public pages (the “Site”), and the account information of people our customers ask us to provision for the Marsa Health workspace.

It does not cover the operational data our customers process in production deployments of the Marsa Health workspace. That data is governed by the customer’s agreement with us, including a business associate agreement where protected health information is involved; the customer controls that data and we process it only on the customer’s behalf.

We collect information you choose to give us through the Site, and account information for provisioned workspace users:

• Demo and contact requests — the option you choose (free appeal drafts, a records-request response packet, or a demo), your work email, organization name, role, how you heard about us, and the business details you include about your operation (for example, team size or the workflows you want to see).
• Email correspondence — the contents of messages you send us and the address you send them from.
• Workspace accounts — for pilot organizations, the name, work email, organization membership, and sign-in records of users the organization asks us to provision. There is no self-service signup.

The Site is not a channel for patient data. Our forms instruct visitors not to enter patient data or protected health information, and we ask that you never submit PHI through the marketing site.

Although our Site is about behavioral-health operations, we do not collect consumer health data about Site visitors. Our analytics (Section 4) measure how the Site is used; they are not linked to your name or email, and we do not use them to draw inferences about any visitor’s health, treatment, or interest in care. The information our forms request is business information about an organization, not information about an individual’s health.

If that ever changes, health-data privacy laws such as Washington’s My Health My Data Act require separate notice and consent, and we would provide both before collecting any such data. For clarity on HIPAA: information you submit through the Site is not protected health information, and we handle PHI only inside production customer deployments under a business associate agreement, as described in our Terms of Service.

We use three analytics tools on the public Site to understand which pages and tools are useful and whether visitors reach our demo form. We do not use them for advertising, and we do not combine them with the contact details you send through our forms. The signed-in workspace loads none of them.

• Google Analytics 4 (Google LLC) records the pages you view, how you arrived, engagement such as scrolling, outbound clicks, and time on page, your approximate location, and your device and browser type. It sets first-party cookies (for example, _ga) that give your browser a random identifier so repeat visits can be counted. When you submit the demo form, we send Google Analytics an event naming the option you chose — never your name, email, organization, or anything you typed. Google states that Google Analytics 4 does not log or store IP addresses. Google describes its handling of this data in How Google uses information from sites or apps that use our services.
• Vercel Web Analytics counts page views, referrers, approximate location, and device type without cookies. It also records named events for a few actions: which button or menu link you selected (for example, the one that led you to the demo form), that you used a calculator, how far you read a guide, and whether a demo request was sent or failed, along with the option you chose and how you heard about us. These events carry only fixed labels and page addresses, never anything you type. Vercel identifies a visit with a hash of the incoming request that it discards after 24 hours, and it does not track you across other sites.
• Our own content counters record anonymous, daily aggregate counts of guide and tool activity, with no visitor identifier, cookie, or IP address.

You can stop Google Analytics from collecting data about your visits by installing Google’s opt-out browser add-on or by blocking cookies for this Site in your browser settings. We do not sell personal information, and we do not share it for cross-context behavioral advertising.

The public Site sets the Google Analytics cookies described in Section 4, which distinguish returning browsers. It sets no advertising cookies. The only other cookies are strictly necessary ones: a session cookie and a security (CSRF) cookie used to keep provisioned workspace users signed in.

We use your browser’s local or session storage for a few interface preferences — for example, remembering that you dismissed an announcement, completed a demo-workspace onboarding card, or already saw the logo’s introductory draw. These values are non-identifying labels and never leave your device.

We do not sell personal information or share it for cross-context behavioral advertising, so there is no sale or sharing for browser signals such as Global Privacy Control or Do Not Track to switch off. Browsers that send those signals are measured by our analytics the same way as other browsers; the opt-out add-on and cookie controls in Section 4 stop Google Analytics collection.

We use the information described above to:

• respond to demo requests and route your inquiry to the right person;
• communicate with you about the Service, including scheduling and follow-up you have asked for;
• provision, secure, and support workspace accounts our customers ask us to create;
• understand which Site content is useful and how visitors reach our demo form, using the analytics described in Section 4;
• operate, secure, and improve the Site;
• comply with legal obligations and enforce our terms.

We share personal information only with:

• Service providers that host our infrastructure, deliver form submissions and email, measure Site usage (Google Analytics and Vercel Web Analytics, as described in Section 4), or otherwise help us operate the Site and respond to inquiries;
• Professional advisers and authorities where required by law, to protect our rights, or in connection with a corporate transaction, with notice where legally permitted.

We do not sell personal information and have not done so.

Demo requests are not stored in our application database or function logs. Our form-delivery provider temporarily stores submissions while delivering them to our operator mailbox (currently 30 days on its free plan or one year on its Pro plan). We keep the resulting correspondence only as long as needed to handle your inquiry and maintain our business relationship. If no active relationship develops, our mailbox retention rule deletes inquiry records no later than twenty-four months after our last interaction with you, except where a longer period is required for legal, accounting, or audit purposes.

Workspace account records are kept for the life of the account and for a limited period afterward to meet the customer’s export rights and our legal obligations. Google Analytics keeps event-level data for the retention period set in our Google Analytics property; aggregate reports and our anonymous content counters contain no personal information and may be retained indefinitely. You may request deletion at any time as described in Section 10.

We protect information in transit with encryption and limit access to the systems that store inquiry data to the people who need it to respond to you. Our broader security posture — access controls, audit history, retention, and incident response — is described on the security page. No method of transmission or storage is perfectly secure, but we work to protect the information you share with us.

You can ask us to access, correct, or delete the personal information we hold about you, or to stop contacting you, through the contact page. We will take reasonable steps to verify your request — normally by corresponding with the email address on file — and respond within the time required by applicable law. Where local law allows an authorized agent to act for you, or gives you the right to appeal a decision we make on your request, we honor those processes too.

Depending on where you live, you may have additional rights. California residents may request disclosure of the categories of personal information we collect (for the Site, these are identifiers and professional information you provide, plus online identifiers, internet activity, and approximate location collected by the analytics in Section 4, used for the purposes in Section 6), request deletion or correction, and are entitled not to be discriminated against for exercising those rights; we do not sell or share personal information as those terms are defined in the CCPA/CPRA. Residents of other U.S. states with comprehensive privacy laws have similar access, correction, deletion, and portability rights. Residents of the European Economic Area and the United Kingdom may also have rights to restrict or object to processing, to data portability, and to lodge a complaint with a supervisory authority; where GDPR-style laws apply, we process the information described in this policy to perform contracts, pursue legitimate interests such as responding to business inquiries, and comply with law.

The Site is a business-to-business service directed at healthcare organizations. It is not directed to children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has provided us personal information, contact us and we will delete it.

We are based in the United States and process information there. If you access the Site from outside the United States, you understand that your information will be transferred to and processed in the United States, where privacy laws may differ from those in your jurisdiction. Where required, we use appropriate safeguards for such transfers.

We may update this policy as the Site and the Service evolve. When we do, we will revise the “Last updated” date above, and for material changes we will provide more prominent notice, such as a note on this page or an email where we have an address for you.

Privacy questions and requests can be sent through the contact page.