— Legal & Governance

Privacy Policy

Information that is gathered from visitors

In common with other websites, log files are stored on the web server saving details such as the visitor’s IP address, browser type, referring page and time of visit.

Cookies may be used to remember visitor preferences when interacting with the website.

Where registration is required, the visitor’s email and a username will be stored on the server.

How the Information is used

The information is used to enhance the vistor’s experience when using the website to display personalised content and possibly advertising.

E-mail addresses will not be sold, rented or leased to 3rd parties.

E-mail may be sent to inform you of news of our services or offers by us or our affiliates.

Visitor Options

If you have subscribed to one of our services, you may unsubscribe by following the instructions which are included in e-mail that you receive.

You may be able to block cookies via your browser settings but this may prevent you from access to certain features of the website.

Cookies

Cookies are small digital signature files that are stored by your web browser that allow your preferences to be recorded when visiting the website. Also they may be used to track your return visits to the website.

3rd party advertising companies may also use cookies for tracking purposes.

Google Ads

Google, as a third party vendor, uses cookies to serve ads.

Google’s use of the DART cookie enables it to serve ads to visitors based on their visit to sites they visit on the Internet.

Website visitors may opt out of the use of the DART cookie by visiting the Google ad and content network privacy policy.

Google API Services & User Data Policy Disclosure

This section specifically governs our access, usage, storage, and retention of user data accessed via Google API Services in connection with the Client Marketing Suite SaaS platform by Elevated Medical Marketing.

1. Google Data Accessed:

Our application requests access to Google user data strictly on a least-privilege, need-to-know basis to provide automated client reporting, campaign performance tracking, and communication features. The exact scopes requested include:

Google Analytics (GA4) (https://www.googleapis.com/auth/analytics.readonly): Read-only access to property metadata, web traffic statistics, user sessions, pageviews, event counts, and conversion metrics. We do not manage accounts or edit user permissions.
Google Ads (https://www.googleapis.com/auth/adwords): Read-only access to campaign performance metrics including impressions, clicks, cost, click-through rates (CTR), and conversion actions for client marketing reporting.
Gmail API (https://www.googleapis.com/auth/gmail.send): Outbound sending permission to transmit automated client monthly reports, onboarding milestone notifications, and operational system alerts directly from the agency's connected Gmail address.
User Identity (https://www.googleapis.com/auth/userinfo.email): Access to the email address of the authenticated Google account, used solely to verify and display the active sender profile in agency settings.

2. How Google Data Is Used:

Monthly Client Reporting & Dashboards: Google Analytics and Google Ads metrics are retrieved solely to generate monthly client marketing performance reports, automated PDF summaries, and unified dashboard views.
Outbound Email Dispatch: Gmail permissions are used strictly to deliver client report emails, error notifications, and onboarding alerts directly from the agency's connected address.
Explicit Operational Boundaries: We never read inbox messages, parse message bodies, scan personal contacts, delete messages from your Google account, or alter Google Analytics or Google Ads configurations.

3. Sensitive Data Protection & Security Safeguards:

Encryption at Rest: All OAuth access tokens and refresh tokens are encrypted at rest using AES-256 encryption within isolated PostgreSQL storage.
Encryption in Transit: All data transmitted between user browsers, our platform servers, and Google APIs is strictly encrypted using TLS 1.3.
Credential Management: Master cryptographic keys and OAuth client credentials are isolated within Google Cloud Secret Manager with strict IAM role bindings.
Tenant Isolation: Data is logically partitioned by tenant ID, preventing cross-tenant access or data leakage.

4. Data Retention and Deletion:

Retention Duration: OAuth credentials (tokens) are stored only as long as the integration remains active. Aggregated metrics required for historical monthly client reporting are retained for active client reporting periods.
User-Initiated Disconnection: Users and agency administrators may disconnect Google integrations at any time directly through the platform interface (under Settings > Integrations). Disconnecting immediately and permanently purges all stored OAuth tokens from our database.
Google Account Revocation: Users may also immediately revoke our application's access at any time through Google Account Security Settings (https://myaccount.google.com/permissions). Upon revocation, our platform can no longer access any Google services.

5. Google Workspace API Limited Use & AI Policy Compliance:

Elevated Medical Marketing's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Prohibition on Model Training: Google user data—including all data obtained from Google Analytics, Google Ads, and Google Workspace APIs (Gmail)—is never used, transferred, or sold to train, improve, fine-tune, or develop foundational or generalized artificial intelligence (AI) or machine learning (ML) models.
AI Architecture Isolation: Artificial intelligence models utilized within our platform (such as Google Gemini via enterprise Vertex AI) are strictly employed for generative on-site SEO content drafting and topic suggestions based on public medical literature and user-provided prompts. Google Workspace and analytics data are completely isolated and are never passed to AI models.
Zero Data Retention: All enterprise AI API integrations operate under Zero Data Retention agreements where prompt inputs and completions are not logged or stored by the model provider.