Legal
Privacy policy
Draft — not yet in effect.
This document is a working draft.
It has been written against how Basemarks actually intends to operate, but it has not yet been reviewed by counsel and it is not yet in effect. Basemarks is not taking bookings and is not collecting customer health information. This page is published so the structure is in place and can be reviewed; the final version will carry an effective date.
Written against our actual data flows. This is not a template. Every category of information described below is one we genuinely handle, and every third party named below is one that genuinely processes data on our behalf. When that list changes, this page changes.
1. Who we are
Basemarks operates a body composition and bone density measurement studio in Duluth, GA. In this policy, "we" and "us" mean Basemarks, and "you" means anyone using this website or our services.
For any privacy question, contact legal@basemarks.health.
2. What we collect
From this website, today
If you submit your email address to our opening-updates list, we collect that email address. That is the only personal information this website collects.
This website sets no cookies, runs no advertising trackers, no analytics tags, no session recorders, and loads no third-party scripts. There is no pixel here from any advertising network. Standard web server logs are generated by our hosting provider in the course of serving the page.
When booking opens
Booking a scan will require additional information, and we are describing it now so there are no surprises:
- Identity and contact: name, email address, phone number.
- Date of birth, height, weight and sex: required inputs to the scan analysis itself.
- Health screening answers: a short set of questions covering pregnancy status, recent contrast or nuclear medicine studies, and implanted devices. These determine whether a scan is appropriate for you.
- Scan results: the measurements produced by your scan and the report generated from them.
- Payment information: processed by our payment processor. We do not receive or store your full card number.
3. Why we use it
- To determine whether a scan is appropriate and safe for you.
- To perform the scan and produce your report.
- To take payment and provide a receipt.
- To send appointment confirmations, reminders and preparation instructions.
- To let you compare a scan against your own previous scans.
- To comply with legal and regulatory obligations that apply to us.
4. What we will never do
These are commitments, not aspirations:
- We do not sell your personal information.
- We do not share your personal information with advertisers, ad networks, or data brokers.
- We do not place advertising or analytics trackers on booking pages, screening forms, or confirmation pages.
- We do not transmit health information — including the type of test you booked — to any advertising platform, in any form, at any time.
- We do not put health-revealing information in web addresses or in the subject lines of emails.
5. Who processes data on our behalf
We use a small number of service providers. Each one is listed here by name and by what it actually touches.
| Provider | Purpose | What it touches |
|---|---|---|
| Cloudflare | Website hosting, DNS, and inbound email routing | Server logs; email you send to our published addresses |
| Scheduling provider | Appointments, intake forms, consent records | Contact details, screening answers, appointment history |
| Payment processor | Card payments | Payment details and transaction records |
| Email delivery provider | Confirmations, reminders, list mail | Name and email address |
6. How long we keep it
Retention periods will be set out here specifically — by category, in months or years — following review by counsel. They will not be described as "as long as necessary," which tells you nothing.
Our intent is that opening-list email addresses are deleted on request or when the list has served its purpose, and that scan records are retained long enough to be useful to you for longitudinal comparison and to satisfy any applicable record retention requirement.
7. Your choices
- Access. Ask us for a copy of what we hold about you.
- Correction. Ask us to fix anything inaccurate.
- Deletion. Ask us to delete your information, subject to any record we are legally required to keep.
- Unsubscribe. Every marketing email carries an unsubscribe link, and we will honour it.
- Withdraw consent to text messages at any time, without affecting your ability to book.
To exercise any of these, email legal@basemarks.health. We will not charge you for it and we will not make you justify the request.
8. Residents of states with consumer health data laws
Some states — Washington and Nevada in particular — have laws that attach to their residents rather than to where a business is located, and that define consumer health data broadly.
Rather than maintain two standards, we have written this policy to the stricter one. The commitments in section 4 apply to everyone we serve, wherever you live.
9. Security
Information is encrypted in transit and at rest. Access to customer information is limited to people who need it to do their job. This website is a static site with no database and no login, which means there is no customer data stored on it to compromise.
10. Children
Our services are not directed to children under 13, and we do not knowingly collect their personal information.
11. Changes
If we change this policy in a way that materially affects how we handle your information, we will say so here and, where we have your email address and the change warrants it, tell you directly.
Questions about this document? Email legal@basemarks.health.