Privacy Policy

When you use the Clinic Growth Readiness Score™ assessment, we collect:

• Assessment responses — your answers to 30 diagnostic questions across six growth pillars. These responses are used exclusively to calculate your scores, generate your report, and improve the assessment over time.
• Contact information — your name and email address, which you voluntarily provide on the lead capture form before receiving your results. We use this to send your personalized Growth Blueprint report and, if you choose, to schedule a strategy debrief call.
• Technical data — a minimal anonymous session identifier stored in your browser, used to maintain your progress during the assessment. This does not include your IP address, browser fingerprint, or tracking cookies.

Your information serves a single purpose: to generate your personalized growth readiness report and deliver it to you. Specifically:

• Assessment responses are scored by our server-side engine and combined into your overall score, pillar breakdowns, growth opportunities, and prioritized recommendations — all of which appear in your report and emailed PDF.
• Your email address is used to send the report you requested, and optionally to follow up if you book a strategy consultation call. We do not add you to marketing lists, newsletters, or any other distribution without your explicit opt-in.
• Aggregated, anonymized data (stripped of your name, clinic name, and email) may be used to improve the assessment's accuracy and benchmark scoring thresholds. No individual clinic's data is ever published or shared.

Your individual responses to assessment questions are private. They are stored in our database and associated with your session ID and email address solely for the purpose of generating your report. We do not share individual responses with anyone — not with other clinics, not with partners, not in aggregate form that could be traced back to you.

The only exception is if you explicitly share your results (e.g., by forwarding your email or PDF) — that is your choice, not ours.

Period. We do not sell, rent, trade, or otherwise transfer your personal information to third parties for their marketing or any other purpose. This is not negotiable and not hidden in fine print.

The Clinic Growth Readiness Score™ is a product of ConvertPrime LLC. It exists to help clinic owners understand and improve their growth systems. Selling data would be antithetical to that mission.

We retain your assessment data for as long as your account is active or as needed to provide you with your results. If you would like us to delete your data, simply email us and we will remove your assessment responses, contact information, and any associated records within 14 days.

Anonymized benchmark data (scores stripped of personal identifiers) may be retained indefinitely for product improvement purposes. This data cannot be traced back to you or your clinic.

• Assessment responses and lead data: retained until you request deletion, or 24 months of inactivity, whichever comes first.
• Anonymous session identifiers: cleared when you close your browser or start a new assessment.
• Email correspondence: retained as needed for customer support purposes.

We use industry-standard security practices to protect your information:

• All data transmitted between your browser and our servers is encrypted using HTTPS/TLS.
• Assessment sessions are protected by HMAC-SHA256 CSRF tokens to prevent unauthorized submissions.
• Anonymous assessments are protected by reCAPTCHA v3 to prevent automated abuse.
• Database access is restricted to server-side code via row-level security policies. Your data is stored in Supabase PostgreSQL, hosted in Sydney, Australia (us-east-1).
• We do not store credit card information, health information, or other sensitive personal data.

The assessment does not use tracking cookies, analytics scripts, or third-party tracking of any kind. The only browser storage used is localStorage, which holds your anonymous session identifier and cached answer data so you can resume the assessment if you leave. This data never leaves your browser unless you submit the assessment.

We do not use Google Analytics, Facebook pixels, or any other behavioral tracking tools on the assessment or results pages.

We use the following third-party services to deliver the product. Each has its own privacy policy governing data handling:

• Supabase (PostgreSQL database + authentication) — stores your assessment responses and contact information. Supabase is SOC 2 compliant. See supabase.com/privacy.
• Resend (email delivery) — sends your personalized report email and PDF. Resend processes your email address and name for delivery purposes only. See resend.com/privacy.
• Calendly (scheduling) — if you choose to book a strategy session, Calendly handles the scheduling interface. Calendly receives your name, email, and assessment context (score, grade). See calendly.com/privacy.
• Vercel (hosting) — serves the application pages. Vercel has access to standard web request data (URL, timestamp) for operational purposes. See vercel.com/privacy.

You have the right to:

• Access the data we hold about you (email us and we'll provide it within 7 days).
• Request correction of any inaccurate data.
• Request deletion of your data (we will delete everything within 14 days of your request).
• Export your assessment results (your PDF report is the canonical export — email us if you need a machine-readable copy).
• Withdraw consent at any time by ceasing use of the assessment and requesting data deletion.

To exercise any of these rights, email us at the address below. We will respond within 7 business days.

If we change how we handle your information, we will update this page and note the change at the top of the policy. For material changes (new data collection, new sharing practices), we will also notify you by email if we have one on file.

This policy was last updated on July 11, 2026.