ARCLYFT Health Privacy Policy

Effective date: October 21, 2026. This version replaces the Privacy Policy dated September 2, 2026.

This Privacy Policy explains how ARCLYFT LLC, a California limited liability company doing business as ARCLYFT Health ("ARCLYFT," "we," "us," or "our"), collects, uses, shares, and protects information in connection with the website arclyfthealth.com (the "Site"), the online forms and questionnaires we make available through the Site or by invitation, our market intelligence and research activities, and our communications with prospective clients, clients, and industry participants. By using the Site or submitting information to us, you agree to the practices described in this Policy. If you do not agree, please do not use the Site or submit information.

WHO WE ARE

ARCLYFT Health is a specialized DME and O&P market intelligence and advisory company serving health plans, risk-bearing organizations, and other buyers of durable medical equipment, prosthetic, orthotic, and supply (DMEPOS) services. We build and maintain ARCLYFT™ DME/O&P Market Intelligence, a research database about the organizations that provide and manufacture these products and services, and we deliver reports and advisory work to our clients under written agreements. ARCLYFT is the controller of the information described in this Policy.

INFORMATION WE COLLECT

We collect information in four ways: directly from you, automatically when you use the Site, from public and third-party sources in the course of our research, and from our clients in the course of an engagement.

Information you provide directly. When you contact us, request a complimentary introductory conversation, submit a request for an ARCLYFT™ Explore, Select, or Complete engagement, submit a general inquiry, or correspond with us by email, we collect the information you choose to give us. This typically includes your name, title or role, organization, work email address, work phone number, the subject of your inquiry, and any other details you include. Our website inquiry forms are not designed to receive confidential information. Please do not submit patient or member information, claims data, contract terms, rates, or other confidential material through the Site. Information of that kind is exchanged only under the written agreement that governs an engagement.

Information you provide through participation questionnaires. ARCLYFT invites DME and O&P providers, manufacturers, and other industry organizations to confirm, correct, and add to the profile we hold about their organization through online questionnaires. When a representative completes a questionnaire, we collect the representative's name, role or title, organization, work email address (which we verify), and optional phone number, together with the organization-level information the questionnaire asks for, such as services offered, locations, hours, capabilities, delivery model, plan-level payer participation, and contracting interests. We also keep a record of the acceptance of the participation terms presented with the questionnaire, including the date and time, submission identifier, terms version, the respondent's confirmations, and the submission IP address. Participation is voluntary. Our questionnaires state that protected health information, patient- or member-level data, negotiated rates, fee schedules, contract terms, and confidential third-party material must not be submitted, and we isolate any such material from use if it is submitted in error.

Information we collect automatically. When you visit the Site, our hosting provider's systems and cookies automatically record technical information such as your IP address, browser type and version, device type and operating system, the pages you view, the time and duration of your visit, the website that referred you, and general location derived from your IP address. The Cookies and Analytics section below describes cookies in more detail.

Information from public and third-party sources. As part of building ARCLYFT™ Market Intelligence, we research organizations using lawfully available public sources, including organization websites, government and regulatory records such as the National Plan and Provider Enumeration System (NPPES), Medicare supplier and provider directories, state licensing and business-entity records, accreditation and certification locators, publicly filed documents, business directories and listings, news and press materials, and commercial data services. In doing so we may collect the business contact details of individuals who are publicly identified with those organizations, such as the names, titles, work email addresses, and work phone numbers of owners, executives, clinical leaders, and designated contacts. We collect this information for business-to-business purposes only and we do not use it to build profiles of individuals as consumers.

Information from clients. When a client engages us, the client may provide information needed for the engagement. That information is governed by the written agreement for that engagement, including any business associate agreement the client requires, and not by this Policy, except that this Policy applies to the contact details of client personnel.

HOW WE USE INFORMATION

We use the information we collect to:

Respond to inquiries and requests, schedule conversations, and evaluate whether and how we can assist a prospective client.

Prepare, negotiate, and perform engagements, including Client Services Agreements, Statements of Work, nondisclosure agreements, and Explore engagement terms, and to invoice and collect payment.

Build, verify, maintain, and improve ARCLYFT™ Market Intelligence and the reports, analyses, and advisory work we deliver to clients, including identifying and contacting organizations and their appropriate representatives, inviting participation in questionnaires, verifying the authority and work email of a respondent, recording acceptance of participation terms, and processing correction requests.

Communicate with questionnaire participants about their submissions, including sending confirmation copies, follow-up questions, invitations to further rounds, and correction outcomes.

Share, with the organization's explicit opt-in, a vendor-designated contracting contact with clients who may have a relevant opportunity.

Operate, secure, maintain, and improve the Site, understand how visitors use it, and diagnose technical problems.

Send information about ARCLYFT services, publications, and industry developments to people who have inquired with us or who are professionally relevant to our work, subject to your right to opt out.

Comply with legal obligations, enforce our agreements and these terms, protect our rights and the rights of others, and prevent fraud, abuse, and security incidents.

We use software tools from service providers, including analytical and AI-assisted tools, to help organize, screen, and analyze information. These tools operate under our instructions and contractual restrictions, and submitted questionnaire material is reviewed by a person before any automated analysis.

HOW WE SHARE INFORMATION

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising. We share information only as follows:

Service providers. We use third parties to host the Site (Squarespace), host and process our online forms and questionnaires (Jotform, in a HIPAA-enabled environment), provide email and productivity services, store files, process payments, send communications, and provide analytical tools. These providers may access information only to perform services for us and are bound by contractual obligations to protect it.

Clients. Organization-level information, including information an organization supplies through a participation questionnaire, may be included in ARCLYFT™ Market Intelligence, Vendor Reports, other client deliverables, and advisory work delivered to our clients. Vendor-supplied information is identified as self-reported. The personal contact details of a questionnaire respondent are not published as part of an organization's profile and are shared with a client only where the organization has opted in to be contacted about network opportunities, or where the same details are already publicly available as the organization's designated business contact.

Public-facing materials. Organization-level information may appear in ARCLYFT's public-facing materials, with or without naming the organization, as described in the participation terms accepted at submission. We do not broadly publish the personal contact details of individual employees.

Professional advisors. We share information with our attorneys, accountants, insurers, and other professional advisors as needed to obtain their services.

Legal and protective purposes. We disclose information when required by law, subpoena, court order, or governmental request; to enforce our agreements; to protect the rights, property, or safety of ARCLYFT, our clients, or others; or to investigate fraud or security issues.

Business transfers. If ARCLYFT or substantially all of its assets, including ARCLYFT™ Market Intelligence, are sold, merged, licensed, reorganized, or financed, information may be transferred to the successor or counterparty, which will be bound by this Policy with respect to that information.

With your direction. We share information when you ask us to or otherwise consent.

COOKIES AND ANALYTICS

The Site is hosted on Squarespace, which places cookies and similar technologies on your device. Some are necessary for the Site to function and to keep it secure. Others support analytics that give us aggregate information about visits, traffic sources, and page performance. You can control cookies through your browser settings, including blocking or deleting them; some Site features may not work correctly if cookies are disabled. Where a cookie banner is displayed, you may also manage non-essential cookies there. We treat a Global Privacy Control signal sent by your browser as a request to opt out of any sale or sharing of personal information. Because we do not sell or share personal information, no further action is required on our part.

EMAIL COMMUNICATIONS

If you inquire with us, participate in a questionnaire, or are professionally relevant to our work, we may send you emails about your request or submission and about ARCLYFT services and industry developments. Transactional messages, such as confirmation of a submission or a response to your inquiry, are sent as part of our business relationship. You may opt out of non-transactional emails at any time by using the unsubscribe link in the message or by emailing spencer@arclyfthealth.com. We honor opt-out requests promptly, and we comply with the CAN-SPAM Act and California law in our commercial email practices.

INFORMATION ABOUT ORGANIZATIONS AND THEIR REPRESENTATIVES

Most of the information in ARCLYFT™ Market Intelligence describes organizations, not individuals. Where business contact details of individuals are included, we use them only to identify the appropriate representative of an organization, to invite and administer participation, and to communicate about our work. If you are an individual whose business contact details we hold, you may ask us to correct them, to stop contacting you, or to remove your personal contact details from our records. We will honor such requests except where we need to retain the information to maintain the record of a participation acceptance, to comply with law, or to perform an existing agreement. Removing an individual's contact details does not remove organization-level information about the organization itself, which organizations may ask us to correct through the correction process described in the participation terms or by email.

YOUR PRIVACY RIGHTS

You may, at any time, ask to access the personal information we hold about you, ask us to correct information that is inaccurate, ask us to delete your personal information, or opt out of marketing communications. To make a request, email spencer@arclyfthealth.com with the subject line "Privacy Request" and tell us what you are asking for. We will confirm receipt, verify your identity by matching the information in your request to the information we hold and, where needed, by corresponding with you at the email address on file, and respond within 45 days. If we need more time, we will tell you why and when to expect a response. You may authorize an agent to make a request on your behalf; we will ask for proof of that authorization and may still confirm the request with you directly. We will not discriminate against you for exercising your privacy rights.

California residents. If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the "CCPA"), may give you additional rights: the right to know the categories and specific pieces of personal information we have collected about you, the categories of sources, the business purposes for collecting it, and the categories of third parties to whom we disclose it; the right to request deletion; the right to request correction; the right to opt out of the sale or sharing of personal information; the right to limit the use of sensitive personal information; and the right not to be discriminated against for exercising these rights. We do not sell or share personal information as the CCPA defines those terms, and we do not collect sensitive personal information through the Site. In the preceding twelve months we have collected the categories of personal information described in the Information We Collect section, from the sources described there, for the purposes described in the How We Use Information section, and disclosed them to the categories of recipients described in the How We Share Information section. Personal information that is lawfully made available from government records, or that an organization has itself published as its business contact information, is treated as publicly available information. ARCLYFT may not meet the thresholds that make the CCPA mandatory for a business; we nevertheless honor the requests described in this section as a matter of practice.

Residents of other states and countries. If you reside in another state that grants privacy rights, or outside the United States, you may use the same contact method, and we will respond according to the law that applies to you. The Site is operated from the United States, and information you submit is stored and processed in the United States.

DATA RETENTION

We keep personal information for as long as needed for the purposes described in this Policy. In general: inquiry and correspondence records are kept for as long as the inquiry is active and for a reasonable period afterward to document our communications; engagement records are kept for the term of the agreement and for the period required by our professional, tax, and legal obligations; questionnaire submissions and acceptance records are kept for as long as the submitted information remains part of ARCLYFT™ Market Intelligence and the outputs built on it, together with the record of the terms accepted; and Site log data is kept for the period our hosting provider retains it. When personal information is no longer needed, we delete it or de-identify it so that it no longer identifies an individual.

SECURITY

We use reasonable administrative, technical, and physical safeguards designed to protect the information we hold, including access controls, hosting and form platforms with security certifications, and restrictions on who may access questionnaire submissions. Our online questionnaires are hosted in a HIPAA-enabled environment as an added safeguard, but they are not intended to receive protected health information and nothing in this Policy makes the Site a channel for it. No method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security. If we learn of a security incident affecting your personal information, we will notify you and the appropriate authorities as required by law.

PROTECTED HEALTH INFORMATION

ARCLYFT does not provide clinical services and does not collect protected health information through the Site or its questionnaires. If a client engagement requires ARCLYFT to receive protected health information, that information is handled under the written agreement for the engagement, including a business associate agreement where one is required, and not under this Policy.

CHILDREN

The Site is intended for business professionals. We do not knowingly collect personal information from anyone under 18 years of age. If you believe a minor has provided us with personal information, please contact us and we will delete it.

THIRD-PARTY WEBSITES AND SERVICES

The Site contains links to websites and services we do not control, including spencerdoty.com, government and regulatory resources, industry organizations, and the organizations described in our materials. Our forms and questionnaires are hosted by Jotform, and the Site is hosted by Squarespace; those providers' own privacy policies govern their collection of information as independent businesses. We are not responsible for the privacy practices or content of third parties, and we encourage you to review their policies.

EXPERT WITNESS AND LITIGATION SUPPORT SERVICES

Spencer Doty provides expert witness and litigation support services, described at spencerdoty.com, which are contracted through ARCLYFT LLC. Information received in connection with those services is handled under the retention agreement for the matter, applicable court rules and protective orders, and professional obligations, and not under this Policy.

CHANGES TO THIS POLICY

We may update this Policy from time to time. When we do, we will post the revised Policy on the Site and update the effective date at the top. If a change materially affects how we use personal information already collected, we will provide additional notice, such as by email to affected individuals or a prominent notice on the Site. Your continued use of the Site after a revised Policy is posted means you accept the changes.

CONTACT US

Questions, requests, and complaints about this Policy or our privacy practices may be sent to:

ARCLYFT LLC, doing business as ARCLYFT Health

Attention: Privacy

16956 Via de Santa Fe #1437, Rancho Santa Fe, CA 92067

spencer@arclyfthealth.com