Legal
Privacy Policy
Version 1.0 · Effective Date: 6 August 2026 · Last Updated: 6 August 2026
Abridged Version: We collect only the business contact information you choose to give us and basic, aggregated site analytics. We don’t sell your data, we don’t run advertising trackers, and we never use client data to train AI. This website is not a channel for patient health information, never submit PHI through it. When we handle Protected Health Information for healthcare clients, it happens only under a signed Business Associate Agreement through secure channels, governed by HIPAA. The full policy below explains everything in detail.
On This Page
1. Introduction and Scope
GRACE Technologies LLC (“GRACE,” “we,” “us,” or “our”) respects your privacy and is committed to protecting the personal information entrusted to us. This Privacy Policy describes how we collect, use, disclose, retain, and protect information in connection with:
Our website, gracetechnologies.io, and any subdomains (the “Site”);
Our consulting, compliance advisory, and managed security services (“Professional Services”);
Our software products and subscription services, as and when they are made available (“Software Services”); and
Communications with us by email, phone, form submission, or other channels.
Together, these are the “Services.” This Policy applies to all visitors, prospective clients, clients, and users of the Services. Where a specific product, engagement agreement, Business Associate Agreement, or federal contract imposes different or additional terms, those terms govern to the extent of any conflict.
By using the Services, you acknowledge the practices described in this Policy. If you do not agree with this Policy, please do not use the Services.
2. Who We Are
GRACE Technologies LLC is a Colorado limited liability company headquartered in Colorado Springs, Colorado. We provide HIPAA compliance consulting, managed cybersecurity services, and compliance software for healthcare practices, small businesses, and government customers.
In the course of our work, GRACE may act in two distinct roles, and the rules that apply to your information depend on which role we are performing:
Controller of ordinary business data: As a business collecting information directly from you (for example, when you visit the Site, submit a contact form, or subscribe to communications), this Privacy Policy applies in full.
Business Associate under HIPAA: When we receive Protected Health Information (“PHI”) from or on behalf of a healthcare client that is a covered entity or business associate under the Health Insurance Portability and Accountability Act (“HIPAA”), our handling of that PHI is governed by HIPAA and the executed Business Associate Agreement (“BAA”) with that client, not by this Policy. Section 6 describes our HIPAA practices.
3. Important Notice: Do Not Submit Protected Health Information Through This Website
The Site is a general business website. It is not designed, intended, or authorized to collect, transmit, or store Protected Health Information, patient records, or any individually identifiable health information.
Do not include patient names, health conditions, treatment details, insurance information, or any other health information in the contact form, newsletter signup, email links, or any other feature of the Site.
Information submitted through the Site is processed by our website hosting and form infrastructure, which is not covered by a Business Associate Agreement and is not an appropriate channel for PHI.
If you are a healthcare practice and need to share PHI with GRACE as part of an engagement, we will establish a secure, BAA-covered transfer method with you before any PHI is exchanged. PHI is accepted only under an executed BAA and only through channels we designate for that purpose.
If you believe PHI has been submitted through the Site in error, contact us immediately at the address in Section 18 so we can securely delete it.
4. Information We Collect
4.1 Information You Provide Directly
Contact form submissions: Name, email address, company or practice name, phone number, and the contents of your message.
Newsletter and updates signup: Email address and any preference selections.
Email, phone, and scheduling communications: Name, title, organization, contact details, and the contents of correspondence.
Prospective client intake: Business contact information, engagement scoping details, and information reasonably necessary to prepare proposals and agreements.
4.2 Information Collected Automatically
When you visit the Site, our hosting and infrastructure providers automatically collect limited technical information:
Log and device data: IP address, approximate geographic region, browser type and version, device type, operating system, referring pages, pages viewed, and timestamps.
Analytics: Aggregated, privacy-focused site analytics provided by our website platform (page views, traffic sources, approximate visitor counts). We do not deploy third-party advertising pixels, cross-site behavioral trackers, or social media tracking pixels on the Site.
Cookies: Cookies strictly necessary for site operation and, where enabled, analytics cookies. See Section 7.
4.3 Information Related to Professional Services Engagements
When you engage GRACE for consulting or managed security services, we collect and process information necessary to deliver the engagement, which may include: business and organizational information; network, system, and security configuration data; compliance documentation, policies, and assessment responses; personnel contact information for designated points of contact; and vendor and business associate inventories. This information is handled under the confidentiality terms of your engagement agreement in addition to this Policy.
4.4 Software Services Account Information (As Products Launch)
When our Software Services become available, subscribers will provide account registration data (name, business email, organization, role), billing information processed by our payment processor, practice or organization profile information, and content submitted to the product (for example, questionnaire responses used to generate compliance documentation). Product-specific data practices will be described in the applicable subscription agreement and, where relevant, a product privacy notice supplementing this Policy.
4.5 Protected Health Information Received as a Business Associate
Certain GRACE services and products are designed to process PHI on behalf of healthcare clients. PHI is received only after execution of a BAA, only through designated secure channels, and is governed by Section 6 of this Policy, HIPAA, and the applicable BAA.
5. How We Use Information
We use the information described in Section 4 to:
Respond to inquiries, schedule consultations, and communicate with you;
Provide, administer, secure, and improve the Services;
Prepare proposals, execute agreements, and deliver contracted engagements;
Send newsletters and business communications you have requested (you may unsubscribe at any time, see Section 13);
Operate, maintain, and protect the security and integrity of the Site and our systems, including fraud and abuse prevention;
Comply with legal, regulatory, tax, and contractual obligations, including obligations arising under federal contracts; and
Establish, exercise, or defend legal claims.
AI Commitment: GRACE builds software using large language model APIs operated under enterprise agreements that contractually prohibit the use of our clients’ data to train the providers’ models. We do not use client data, engagement data, or PHI to train artificial intelligence or machine learning models, and we do not permit our AI subprocessors to do so. AI processing of PHI occurs exclusively through subprocessors with whom we maintain executed Business Associate Agreements.
6. HIPAA Compliance: Our Role as a Business Associate
GRACE Technologies provides services to HIPAA covered entities (such as dental and medical practices) and to other business associates. When we create, receive, maintain, or transmit PHI on behalf of a client, we do so as a business associate as defined in 45 C.F.R. § 160.103, and the following commitments apply:
6.1 Use and Disclosure Limits
We use and disclose PHI only as permitted by the executed BAA with the covered entity or upstream business associate, as required by law, or as otherwise permitted under 45 C.F.R. § 164.504(e).
We apply the minimum necessary standard to all uses, disclosures, and requests for PHI.
We do not sell PHI. We do not use PHI for marketing, advertising, or fundraising. We do not de-identify PHI for secondary commercial use except as expressly authorized by the applicable BAA.
6.2 Safeguards
We maintain administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of electronic PHI, consistent with the HIPAA Security Rule (45 C.F.R. Part 164, Subpart C).
Safeguards include encryption of PHI in transit and at rest, role-based access controls, endpoint detection and response, audit logging, workforce security training, and a documented security risk analysis and risk management program.
6.3 Subcontractors and Subprocessors
Any subcontractor that creates, receives, maintains, or transmits PHI on our behalf is bound by a written Business Associate Agreement imposing the same restrictions and conditions that apply to us, as required by 45 C.F.R. § 164.502(e).
PHI processed through cloud and AI infrastructure occurs exclusively within HIPAA-eligible services covered by executed BAAs with those providers.
6.4 Breach Notification
We report any use or disclosure of PHI not permitted by the applicable BAA, and any breach of unsecured PHI, to the affected covered entity without unreasonable delay and in no case later than sixty (60) days after discovery, consistent with 45 C.F.R. § 164.410, or within any shorter period specified in the applicable BAA.
For personal information that is not PHI, we comply with applicable state breach notification laws, including the Colorado Security Breach Notification Act (C.R.S. § 6-1-716), which requires notice to affected Colorado residents no later than thirty (30) days after determination that a breach occurred.
6.5 Individual Rights Regarding PHI
If you are a patient of a healthcare practice that uses GRACE services, your healthcare provider, the covered entity, remains responsible for your HIPAA rights, including access to your records, amendment, and an accounting of disclosures. Please direct requests about your health information to your healthcare provider. Where our BAA requires it, we will assist the covered entity in responding to such requests. GRACE does not maintain independent patient relationships and cannot act on patient record requests except through the covered entity.
7. Cookies, Analytics, and Tracking
Strictly necessary cookies: Cookies required to operate the Site, remember your cookie preference, and maintain security. These cannot be disabled through the Site.
Analytics: Our website platform’s built-in, privacy-focused analytics, which provide aggregated traffic statistics. Where consent is required, these operate only after you accept the cookie notice presented on your first visit.
What we do not use: We do not use third-party advertising cookies, remarketing pixels, social media pixels, cross-context behavioral advertising, or session-recording tools on the Site.
Your controls: You can manage or delete cookies through your browser settings. The Site’s cookie banner allows you to accept or dismiss non-essential cookies, and your choice is retained.
Universal opt-out signals: The Site recognizes the Global Privacy Control (GPC) browser signal as a valid request to opt out of the sale of personal data and targeted advertising, as provided by the Colorado Privacy Act and other applicable state laws. Because we do not sell personal data or engage in targeted advertising, the practical effect of the signal is confirmation of our default practice.
8. How We Share Information
We do not sell personal information, and we do not share personal information for cross-context behavioral advertising. We share information only in the following circumstances:
8.1 Service Providers
We use a limited set of vendors that process information on our behalf under contractual confidentiality and data protection obligations. Current categories include:
Category
Purpose
PHI Authorized?
Website hosting and forms
Hosting the Site; receiving contact form and newsletter submissions
No, see Section 3
DNS, CDN, and email routing
Domain, network, and email infrastructure
No
Business productivity and email
Business email, document storage, calendaring
No (engagement documents; PHI only via designated secure channels where covered)
Cloud infrastructure (as products launch)
Application hosting, storage, and processing for Software Services
Yes, HIPAA-eligible services under executed BAA only
AI model providers (as products launch)
Language model processing for compliance document generation
Yes, under executed BAA; no training on client data
Payment processing (as products launch)
Subscription billing for Software Services
No, payment data only
8.2 Legal and Protective Disclosures
We may disclose information when required by law, subpoena, or court order; to government authorities where legally compelled; to enforce our agreements; or to protect the rights, property, safety, or security of GRACE, our clients, or others. Where legally permitted, we will notify affected clients before disclosing their information in response to legal process.
8.3 Business Transfers
If GRACE is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to this Policy and, for PHI, subject to HIPAA and the applicable BAAs.
8.4 Federal Contract Requirements
Information related to federal contracts may be disclosed to the contracting agency, authorized government representatives, or prime contractors as required by the contract, the Federal Acquisition Regulation (FAR), the Defense Federal Acquisition Regulation Supplement (DFARS), or other applicable federal requirements.
9. Data Security
We apply the same security discipline to our own operations that we advise for our clients. Our program is aligned to the HIPAA Security Rule and the NIST Cybersecurity Framework and includes, as appropriate to the sensitivity of the data: encryption of data in transit (TLS) and at rest; multi-factor authentication and role-based access controls; managed endpoint detection and response; DNS-layer threat filtering; patch and configuration management; audit logging; workforce security awareness training; vendor security review; and a documented incident response plan.
No method of transmission or storage is completely secure. We cannot guarantee absolute security, but we are committed to promptly investigating and responding to any suspected incident, and to meeting the notification obligations described in Section 6.4.
10. Data Retention
We retain information only as long as reasonably necessary for the purposes described in this Policy, to satisfy legal, regulatory, tax, contractual, and audit obligations, and to resolve disputes. Representative retention practices:
Category
Retention Practice
Contact form and inquiry data
Duration of the inquiry and follow-up, then up to 24 months, unless a client relationship is established
Newsletter subscriptions
Until you unsubscribe or the list is retired
Client engagement records
Term of the engagement plus six (6) years, consistent with HIPAA documentation retention (45 C.F.R. § 164.316(b)(2)) and Colorado statute of limitations considerations
PHI held as a business associate
As specified in the applicable BAA; upon termination, PHI is returned or destroyed where feasible, per the BAA
Website analytics
Aggregated data retained per platform defaults; no persistent individual profiles are maintained
Federal contract records
As required by FAR Subpart 4.7 and applicable contract terms (generally three (3) years after final payment, longer where specified)
Billing and tax records
Seven (7) years
11. Your Privacy Rights
11.1 Colorado Residents: Colorado Privacy Act
The Colorado Privacy Act (C.R.S. § 6-1-1301 et seq.) grants Colorado residents specific rights over personal data. Although GRACE may fall below the CPA’s applicability thresholds, we voluntarily extend the following rights to all individuals whose personal data we hold as a controller:
Right of access: Confirm whether we process your personal data and access that data.
Right to correction: Correct inaccuracies in your personal data.
Right to deletion: Delete personal data concerning you, subject to legal retention obligations.
Right to data portability: Obtain a portable copy of personal data you provided to us.
Right to opt out: Opt out of the sale of personal data, targeted advertising, and profiling in furtherance of decisions producing legal or similarly significant effects. We do not engage in any of these activities.
Right of appeal: If we decline to act on your request, you may appeal by replying to our decision within a reasonable period. We will respond to your appeal within forty-five (45) days. If your appeal is denied, you may contact the Colorado Attorney General at coag.gov.
We will respond to verifiable requests within forty-five (45) days, extendable once by forty-five (45) days where reasonably necessary. These rights do not apply to PHI we hold as a business associate, see Section 6.5.
11.2 California Residents
GRACE does not currently meet the applicability thresholds of the California Consumer Privacy Act as amended by the CPRA. Nevertheless, we voluntarily extend to California residents the rights of access, correction, deletion, and portability described above, the right to opt out of sale or sharing of personal information (we do not sell or share personal information), and the right to limit use of sensitive personal information (we do not use sensitive personal information for purposes requiring such a limit). We do not discriminate against anyone for exercising privacy rights.
11.3 Residents of Other States
Residents of states with comprehensive privacy laws (including Virginia, Connecticut, Utah, Texas, Oregon, Montana, and others) may exercise the rights described in Section 11.1, which meet or exceed the rights available under those statutes. Where a specific state law grants an additional right that applies to us, we will honor it.
11.4 How to Exercise Your Rights
Submit requests to info@gracetechnologies.io with the subject line “Privacy Rights Request.” We will verify your identity using the information associated with your request (for example, confirming control of the email address on file) before acting. An authorized agent may submit a request on your behalf with proof of authorization. We will not deny services, charge different rates, or provide a different level of quality because you exercised a privacy right.
11.5 Health Information
Requests concerning PHI must be directed to your healthcare provider, as described in Section 6.5.
12. Federal Government Users and Contract Data
No CUI through the Site: The Site is a public-facing commercial website. Do not transmit Controlled Unclassified Information (CUI), classified information, export-controlled data, or any information subject to federal safeguarding requirements through the Site, its contact form, or unsecured email. Contract-related data exchange occurs only through channels designated in the applicable contract.
Contract terms govern: Where GRACE performs under a federal contract or subcontract, the handling of government data is governed by the contract terms, the FAR, DFARS (including DFARS 252.204-7012 where applicable), agency supplements, and applicable federal law, including the Privacy Act of 1974 where records are maintained in a system of records on behalf of an agency. Those requirements supersede this Policy to the extent of any conflict.
Government product deployments: Software Services deployed for government customers in dedicated environments (for example, GovCloud deployments) will carry system-specific privacy documentation, and this Policy applies to those systems only where not superseded.
Government points of contact: Business contact information of government personnel (name, official title, agency, official email and phone) is processed for contract administration and business development consistent with federal ethics rules and this Policy.
13. Email Communications and Text Messaging
Marketing emails comply with the CAN-SPAM Act: every message identifies GRACE as the sender, includes our physical mailing address, and contains a functioning unsubscribe mechanism honored within ten (10) business days. Transactional and engagement-related emails (for example, responses to your inquiry or service communications) are not marketing and do not require opt-in.
GRACE does not currently send SMS or text message communications. If future products include text messaging, messages will be sent only with prior express written consent as required by the Telephone Consumer Protection Act (TCPA), with clear opt-out instructions in every message, and this Policy will be updated before any such feature launches.
14. Children’s Privacy
The Services are business services directed to adults and organizations. They are not directed to children under the age of thirteen (13), and we do not knowingly collect personal information from children under 13. If you believe a child has provided personal information to us, contact us at the address in Section 18 and we will delete it.
15. Third-Party Links
The Site may link to third-party websites, including partner tools, government resources, and professional profiles. We are not responsible for the privacy practices of third parties, and this Policy does not apply to their sites. Review the privacy policy of any site you visit.
16. International Users
The Services are operated from the United States and are intended for users in the United States. If you access the Services from outside the U.S., you understand that your information will be transferred to, processed, and stored in the U.S., where privacy laws may differ from those of your jurisdiction. We do not target our Services to individuals in the European Economic Area or the United Kingdom.
17. Changes to This Policy
We may update this Policy to reflect changes in our practices, Services, or legal requirements. The “Last Updated” date at the top of this Policy shows the most recent revision. Material changes will be announced by a notice on the Site (and, for Software Services subscribers, by email or in-product notice) before they take effect. Each version of this Policy is retained in our records.
18. Contact Us
Questions, concerns, or requests regarding this Policy or our privacy practices:
GRACE Technologies LLC
Attn: Privacy
13560 Roller Coaster Rd, Ste 120 Box 117, Colorado Springs, CO 80921
Email: info@gracetechnologies.io · Subject line: “Privacy Rights Request” or “Privacy Question”
Phone: 719.661.7883
We respond to privacy inquiries within one (1) business day of receipt and resolve verifiable rights requests within the timeframes stated in Section 11.