Privacy policy · Last updated 17 April 2026
This policy covers both the public website (forms, optional analytics, cookies) and data VitaCoreX processes during engagements (operator data governed by the Data Processing Addendum). See Sub-processors & DPA and Security & Compliance for the full procurement posture.
This policy covers two distinct data streams that are handled differently:
Unless otherwise stated, sections below apply to site data. Operator-data sections are marked explicitly.
The public forms are designed for general business documents and non-regulated materials. Do not upload highly sensitive regulated records, medical records subject to HIPAA, financial records subject to GLBA, or other materials that require a dedicated secure workflow unless secure coordination has been arranged first. For regulated-data engagements the correct intake path is the Structured Case Intake followed by an engagement letter and, where applicable, a Business Associate Agreement.
The site uses a consent banner that distinguishes essential functionality from optional analytics or marketing measurement. Visitors can choose essential only, analytics only, or full consent where available. See the Cookie Policy for the specific cookie inventory.
VitaCoreX may upload hashed business-contact email addresses to Google Ads Customer Match for the sole purpose of creating matched audiences for our own advertising on Google Search, Display, and YouTube networks. Hashing is performed before transmission; Google receives a one-way SHA-256 hash, not the plaintext email.
Form delivery, calendar scheduling, analytics, email infrastructure, CRM, document signature, and optional campaign measurement rely on named third-party services. The complete list — vendor, purpose, data categories touched, and region — is published on the Sub-processors & DPA page and is updated when vendors are added, changed, or removed (30-day standard notice; 15-day objection window; 5-day emergency notice for security-driven swaps).
Applies to engagement data, not site data. Operator data processed during engagements is used only for the purposes named in the engagement letter. It is not repurposed for marketing, training of general-purpose AI models, or use on other engagements. Operator data stays isolated in engagement-scoped storage with access limited to the named engagement team.
Site data: form submissions are retained while the inquiry is open plus 36 months for pattern analysis, then aggregated or deleted. Analytics data follows the GA4 default 14-month window unless you opt out.
Operator data: default retention is engagement duration plus 90 days unless the operator requests extended retention in writing. Certificates of destruction are issued at close and list what was destroyed and the method used. Operator-environment engagements require no destruction action on our side — access is revoked at close. Full retention matrix on the Security & Compliance page.
If VitaCoreX becomes aware of a personal-data or operator-data breach, the affected operator (for engagement data) or the affected individual (for site data, where individual notice is appropriate) is notified without undue delay and in no case later than 72 hours of becoming aware. Notification includes scope of data affected, systems affected, initial containment actions, and a named point of contact for the remediation thread. See the incident-response posture on the Security & Compliance page and the DPA clause on the Sub-processors & DPA page.
Individuals whose data is held on site forms or in engagement records may request, within limits imposed by legal hold or ongoing litigation:
Submit requests to (888) 794-8292 or through the contact form with subject line "privacy request." Standard response time is 10 business days; verification of requester identity may be required for non-trivial requests. For engagement data, requests run through the operator (data controller) rather than VitaCoreX directly.
All site data and all operator data are stored and processed on US-based infrastructure with US-based cloud vendors. No client or site data is stored in, processed in, or transits through jurisdictions outside the United States in ordinary operation. If a future engagement requires a different posture, it is documented in the engagement letter with the controlling transfer mechanism named in writing.
Site-data handling is governed by the laws of the State of Florida, United States, without regard to conflict-of-laws principles. Engagement-data handling is governed by the engagement letter and its DPA where applicable.
Material changes are announced on this page with a new "Last updated" date at the top. For engagements under a signed DPA, changes to data handling that materially affect operator data are communicated directly to the named operator contact with a 30-day notice window unless the change is security-driven, in which case the emergency 5-day notice applies.
Privacy-related questions: contact form (subject line "privacy") or call/text (888) 794-8292. Procurement contacts can also reach the designated procurement point of contact named in the engagement letter.
