Privacy Policy

PraxisSpan Advisory LLC

Effective: September 20, 2026 · Last updated: September 28, 2026

PraxisSpan Advisory LLC ("PraxisSpan," "we," "us," or "our") is a Virginia limited liability company providing enterprise strategy and business architecture advisory services. This policy explains how we handle personal information in connection with praxisspanadvisory.com, its www address, booking an Alignment Call, and inquiries sent through the website's contact methods.

Information handled on a client's behalf during a consulting engagement is governed by the applicable services agreement, confidentiality terms, and any required data-processing or business associate agreement. This policy does not replace those agreements or the privacy policies of independent services you choose to use.

Summary of our practices

PraxisSpan does not sell booking or inquiry records or run targeted advertising campaigns. Optional Clarity processing is described in Section 4. We do not build profiles to make decisions that produce legal or similarly significant effects. We do not knowingly collect sensitive personal information such as health, biometric, genetic, precise geolocation, financial account, government identifier, racial or ethnic origin, religious belief, sexual orientation, citizenship or immigration data, or information about children.

1. Information you provide

When you select “Book an Alignment Call,” Microsoft Bookings opens in a new tab. It collects your name, work email address, organization, role or title, the priority or decision you need to move, and where work is getting disconnected. You may optionally provide a target decision date or milestone. We use these details to schedule and prepare for your call and communicate about it. Microsoft Bookings, our business Outlook calendar and Microsoft Teams process appointment details to check availability, reserve your time, generate meeting access, and send confirmations and reminders. You can reschedule or cancel using the appointment’s management options.

We maintain a limited internal Microsoft 365 conversion record containing appointment reference, creation and appointment dates, contact details, organization when available, service, status, source category, and CRM-entry status. Power Automate updates this record from Bookings notifications and business-calendar changes. This record measures confirmed appointments and preserves cancellation history; a website click is not a confirmed booking. We use our internal customer relationship management system, HubSpot, for relevant contact, organization, opportunity, next-action and business-correspondence records. Scheduling remains in Microsoft Bookings, Outlook and Teams.

Earlier website-issued appointment-management links may remain available for existing appointments. Records supporting those links retain the expiry and cleanup practices described in Section 8. A personal-coordination request is stored and sent to our business mailbox; it does not reserve an appointment by itself.

If you send an inquiry by email, we receive your sender address, message contents, any attachments you choose to send, and ordinary email details such as the subject and date. We also receive information you provide in subsequent correspondence. Your browser or email provider may retain autofill information or drafts under your settings and its own practices.

Please share only information needed to explain the business question. Do not include passwords, payment-card details, Social Security numbers, patient or member information, employee records, or confidential information you are not authorized to disclose. Contact us first to arrange an appropriate method for sharing sensitive project information.

2. Health information and HIPAA

PraxisSpan provides enterprise advisory services. This website is not designed to receive protected health information (PHI). Do not send PHI through the inquiry form or by email. If an engagement ever requires access to PHI, it will be handled only under a written business associate agreement and the safeguards that agreement requires, not under this website policy. If PHI is sent to us in error, we will limit its use, will not further disclose it except as the law requires, and will delete it where we reasonably can.

3. Visiting the website

Our hosting and network providers process technical information to deliver and protect the website. This can include your IP address, browser and device details, requested pages or files, request dates and times, referring-page information when supplied by your browser, and security or error information. Providers may retain operational logs under their service settings and policies.

The website has no visitor accounts, payment checkout, newsletter signup, or online assessment. Alignment Call scheduling takes place in Microsoft Bookings. Booking a call does not subscribe you to a mailing list. Existing appointment-management and coordination features use temporary request counters based on hashed network identifiers to limit automated or repeated submissions.

4. Cookies, analytics, and tracking choices

Our network security provider protects the website and sets a security cookie called __cf_bm to help distinguish automated traffic from legitimate visitors. The provider states that this cookie expires after 30 minutes of continuous inactivity. The provider may also use challenge-related security technologies when needed to protect access. These security functions are strictly necessary and are separate from advertising tracking.

Optional Google Analytics. With your permission, we use Google Analytics 4, provided by Google, to understand use of our public website and improve its content and services. Analytics may process cookie-based identifiers, public page views, browser and device information, approximate geographic location, referral source, and limited interactions such as selecting a scheduling link, meaningfully viewing the Diagnostic or Founder section, opening the Enterprise Alignment Check when available, or selecting our contact email link. Confirmed bookings are measured in our internal Microsoft 365 conversion log, separately from website analytics. Google receives technical connection information when your browser contacts its servers. This includes processing your IP address, including to derive approximate location, under Google’s applicable regional data-handling practices. This information is pseudonymous, not necessarily anonymous.

Optional Microsoft Clarity. With your permission, we use Microsoft Clarity to understand how visitors use our public website through interaction measurements, heatmaps and masked session recordings. These can include clicks, scrolling, page addresses, browser and device information, and session identifiers. Microsoft receives this information and technical connection information under the Microsoft Privacy Statement. Microsoft acts as an independent controller. Its terms allow use of Clarity data to provide Microsoft Advertising and create advertising profiles; see the Microsoft Privacy Statement. We use these reports to improve website usability. We mask page text and do not intentionally send names, email addresses, organization names, qualification answers, appointment identifiers or private meeting links to Clarity. Private appointment-management and coordination pages are excluded. Pages with query strings or fragments are also excluded.

Your choice comes first. We load neither Google Analytics nor Clarity, and send neither provider analytics measurements, before you select “Accept analytics.” “Reject analytics” leaves optional analytics off. Both choices allow you to use our website and book a call. Use Cookie preferences in the footer to change or withdraw your choice at any time. Withdrawal stops future collection by this website, removes accessible analytics cookies, and reloads the page to stop already-loaded measurement scripts; it does not automatically erase information already received by either provider. See Section 10 for deletion requests.

We remember your choice in this browser’s local storage for 180 days. After it expires, or if you clear browser storage, we ask again. If Clarity is introduced after an earlier Google Analytics-only choice, we ask for a new choice before enabling either provider. If browser storage is unavailable, your choice may not persist between pages. When accepted, the first-party cookies _ga and _ga_WEKSNCE56V help distinguish visits and sessions. We configure their expiration to 180 days without renewal on each visit. Browser restrictions may shorten that period. Clarity uses cookies such as _clck and _clsk to distinguish visits and connect page views into sessions. Necessary security and booking functions remain separate from optional analytics.

Limited measurement. Our Google Analytics configuration disables advertising storage, advertising personalization, Google signals, and advertising user-data consent. We send Clarity a denied advertising-storage signal and grant analytics storage only after your choice. This setting does not establish a separate contractual limit on Microsoft’s data uses. We do not send names, email addresses, organization names, inquiry text, appointment identifiers, or private meeting links as analytics event parameters. We remove query strings and fragments from reported page addresses, limit Google Analytics referrers to their site origin, and exclude private appointment-management and coordination pages from analytics. Pages with query strings or fragments are also excluded. Automatic enhanced measurement of forms, outbound links, searches, downloads, and videos is disabled. We do not use this integration for remarketing, cross-context behavioral advertising, or decisions with legal or similarly significant effects.

Browser privacy signals. We treat a Global Privacy Control signal or a Do Not Track value of “1” as a request to keep optional analytics off, even if an earlier choice allowed it. Necessary hosting, security, and requested booking processing continues. You can prevent this website’s optional analytics collection by rejecting or withdrawing analytics consent. Other websites and Google and Microsoft services may process information under their own policies.

Learn more about how Google uses information from sites that use its services, Google’s Privacy Policy, and the optional Google Analytics browser opt-out add-on. Our Cookie preferences control works without installing an add-on.

5. How we use information

We use personal information to:

• Respond to your inquiry and communicate about services or materials you request.
• Evaluate whether our advisory services fit your needs and prepare for or arrange a conversation.
• Maintain relevant business correspondence and administer the relationship.
• Operate, troubleshoot, and protect the website and communications from misuse.
• With your consent, measure public website use and service interest to improve our content and services.
• Meet applicable legal obligations and establish, exercise, or defend legal rights.

We limit collection to what is adequate, relevant and reasonably necessary for these purposes, and we will not use personal information for a materially different purpose without telling you and, where the law requires it, obtaining your consent.

The website does not make automated decisions about eligibility for employment, credit, insurance, health care, or similar services.

6. Email communications

Sending an inquiry is not consent to unrelated marketing. If we send you a commercial email, it will identify PraxisSpan as the sender, use an accurate subject line, include our valid postal address, and give you a clear way to opt out. We honor opt-out requests promptly and in any event within 10 business days, as the federal CAN-SPAM Act requires. Necessary messages about a service you requested or an existing engagement may continue.

7. Service providers and other disclosures

We disclose personal information to the following categories of providers for the purposes described below. The summary above identifies the information involved; these categories describe provider functions rather than an exhaustive list of company names.

• Website hosting, network, and security providers: process requested pages, IP addresses, browser and device details, request times, and security or error records to deliver, store, protect, and troubleshoot the website. Hosting services also process submitted inquiry and booking records to operate the requested features.
• Appointment scheduling and calendar providers: process attendee and organizer contact details, organization, role or title, time zone, selected appointment, priority and disconnection context, optional milestone, and booking references to check availability, reserve and manage appointments, and send calendar invitations.
• Email-delivery and business communications providers: process sender and recipient details, message contents, and delivery records to deliver and manage inquiries, appointment confirmations, organizer updates, and business correspondence. Please avoid sensitive or confidential information in scheduling responses and messages.
• Optional website analytics: Google provides Google Analytics 4 and Microsoft provides Clarity. They receive the respective measurement data described in Section 4 only after you accept analytics. Microsoft’s controller role and permitted uses are described in Section 4.
• Internal relationship management and workflow providers: HubSpot and our Microsoft 365 workflow services process relevant contact and organization details, inquiry context, opportunity status, business correspondence, appointment status and next actions to prepare for calls and administer business relationships. Scheduling notifications populate a limited internal Microsoft 365 conversion log.
• Professional advisers: may receive relevant contact details, correspondence, and business records when needed for legal, accounting, insurance, or related professional advice.

Providers processing information on our behalf receive it for the functions described here. Applicable agreements and law govern their permitted processing and safeguards. A provider’s role depends on the service and its actual use of information; describing a provider category does not authorize unrelated marketing or advertising.

We may also disclose relevant information to a successor in a merger, acquisition, financing, or sale of all or part of the business, subject to applicable law and this policy; or to authorities and other parties where required by law or reasonably necessary to protect rights, safety, or service security. We do not provide inquiry information to third parties for their own direct marketing.

Contact us using Section 15 with questions about the providers involved in handling your information or to request recipient information available under applicable law. If you follow an external link or communicate on an independent social platform, that service’s privacy policy governs its own collection and use.

8. Retention

For existing website-managed appointments, website appointment details, management access, and related notification records expire 30 days after the scheduled call. Personal-coordination records are eligible for cleanup 30 days after submission. Expired records are removed during subsequent booking or coordination requests. Temporary rate-limit records are also removed during those requests. Appointment and correspondence records remain in the relevant business calendar and mailbox under the retention practices below. Internal conversion-log and relationship-management records also follow the general business-record practices below. Website cleanup does not automatically delete records held in those other systems.

We keep inquiry correspondence only as long as reasonably needed to respond, manage an ongoing business relationship, keep appropriate business records, and meet legal obligations. As a general rule, an inquiry that does not lead to an engagement is deleted within 48 months of our last contact with you. Records connected to an engagement are kept for the period stated in the services agreement or required by law. We may keep information longer where a dispute or legal preservation duty requires it. When information is no longer needed, we delete or de-identify it, subject to routine backup cycles. If we hold de-identified information, we will not attempt to re-identify it. Providers' operational logs are subject to their own retention practices.

Your analytics choice and the configured analytics cookies have the periods described in Section 4. Our Google Analytics property is configured to retain event and user data for 2 months, without resetting user-data retention when you return. Standard aggregated reports may remain longer. We periodically review these settings and delete data that is no longer reasonably needed. Contact us to request deletion. We do not associate analytics cookie identifiers with the personal details in your booking or inquiry.

Microsoft’s published Clarity retention schedule lists 30 days for recording playback and 9 months for heatmaps, click data, and labeled or favorited sessions. These periods describe Clarity’s published schedule, not a custom retention setting configured by PraxisSpan. Withdrawal stops future collection from this website and does not itself erase previously collected data.

9. Security and breach notification

We use administrative, technical and physical safeguards that are reasonable for the nature of the information we hold, including HTTPS for data in transit, an encrypted business mailbox, multi-factor authentication on business accounts, and access limited to those who need it. Email protection also depends on the services used by the sender and recipient. No website, email system, or storage method can guarantee absolute security, and this inquiry channel is not a secure client document portal.

If we learn of a breach of security affecting your personal information, we will notify you, and the Virginia Office of the Attorney General and any other regulator, as required by applicable breach-notification laws, including those of Virginia, North Carolina, and Maryland when applicable, within the required deadlines and without unreasonable delay.

10. Your privacy rights and how to use them

Regardless of where you live, and whether or not a particular privacy statute applies to us, you may ask us to:

• confirm whether we hold personal information about you and give you access to it;
• correct inaccurate information;
• delete information you provided or that we obtained about you;
• provide a copy of your personal information in a portable, readily usable format; and
• stop any marketing email.

Reject or withdraw optional analytics through Cookie preferences to stop future analytics collection on this website. You may also send us an opt-out or other privacy request using the process below. We honor browser privacy signals as described in Section 4.

How to make a request. Email hello@praxisspanadvisory.com with the subject "Privacy request." Describe your request and, if possible, write from the address used in your inquiry. Do not send an identity document or sensitive identification number with the initial request. We may ask for information reasonably needed to verify your identity and locate relevant records. An authorized agent may submit a request on your behalf with proof of authority.

For an analytics deletion request, we may need your browser’s analytics cookie identifier to locate the relevant record because we do not link that identifier to your name or email. Contact us first for instructions; do not send private booking links or sensitive identifiers. You can withdraw future analytics collection immediately through Cookie preferences. For Clarity, Microsoft currently documents project-wide deletion rather than individual-user deletion; contact us to discuss available request options.

Our timeline. We respond within 45 days of receiving your request, subject to verification where appropriate. If a request is complex we may extend once by up to 45 additional days, and we will tell you why within the first 45 days. Requests are free of charge up to twice in any 12-month period. Any fee, refusal, verification requirement, or extension is subject to applicable law; we honor any additional rights or shorter deadlines it requires.

Appeals. If we decline to act on your request, we will explain why and how to appeal. To appeal, reply to our decision or email hello@praxisspanadvisory.com with the subject "Privacy appeal." We will respond in writing within 60 days of receiving the appeal. If the appeal is denied, you may contact the attorney general of your state. Virginia residents may contact the Office of the Attorney General of Virginia, Consumer Protection Section, at oag.state.va.us. North Carolina residents may contact ncdoj.gov, and Maryland residents may contact oag.maryland.gov.

No retaliation. We will not deny services, change prices or quality, or otherwise discriminate against you for exercising a privacy right.

11. State-specific information

PraxisSpan primarily serves organizations in Virginia and North Carolina, with Maryland as a potential additional service area. We do not currently target customers in other states. Our public website can nevertheless be visited from elsewhere; our service area does not restrict any privacy rights that apply to a visitor.

Virginia. Where the Virginia Consumer Data Protection Act applies to our processing, eligible residents may confirm processing, access, correct, delete, and obtain a portable copy of personal data, and opt out of sales, targeted advertising, and profiling used for decisions with legal or similarly significant effects. Use Section 10 to submit a request or appeal. Applicability depends on statutory thresholds, exclusions, and the context of the information, including the Act’s exclusion for individuals acting in a commercial or employment context.

North Carolina. We provide the request and appeal process in Section 10 to North Carolina residents as a business commitment, without representing that every listed right is required by North Carolina law. Applicable identity-theft protection, secure disposal, breach-notification, and consumer-protection requirements remain applicable to our handling of information.

Maryland. Where the Maryland Online Data Privacy Act applies to our processing, eligible residents may confirm processing, access, correct, delete, and obtain a portable copy of personal data, obtain a list of categories of third parties receiving their data, and opt out of sales, targeted advertising, and profiling used for decisions with legal or similarly significant effects. Use Section 10 to submit a request, including through an authorized agent where permitted, or to appeal a decision. Applicability depends on the Act’s thresholds, exclusions, and the context of processing.

PraxisSpan does not run targeted advertising campaigns or profile people for significant decisions. Optional Clarity processing is described in Section 4. Optional analytics can be declined or withdrawn as described in Section 4. We provide the Section 10 request process regardless of residence and honor any additional protections required by applicable law.

12. Children and teens

The website is intended for adults seeking business advisory information. It is not directed to children under 13, and we do not knowingly collect personal information from children under 13, consistent with the Children's Online Privacy Protection Act. We also do not knowingly collect, sell, or use for advertising the personal information of anyone under 18. If you believe a minor has sent us personal information, contact us and we will delete it.

13. Visitors outside the United States

PraxisSpan operates from Virginia, United States, and our intended customer service area is Virginia and North Carolina, with potential service in Maryland. Our service providers and hosting infrastructure operate internationally. Information may be processed outside your state or country, where laws may differ. Visiting the website does not waive applicable privacy rights or itself provide consent to a transfer where separate consent is legally required.

14. Changes to this policy

We will post changes on this page and revise the last-updated date. For a material change to how we handle personal information, we will provide a prominent website notice or direct notice as appropriate, and obtain consent when required by law before applying the change. New collection methods, such as an online assessment, email signup, scheduling tool, analytics, or advertising integration, require an updated notice before use.

15. Contact

PraxisSpan Advisory LLC
Virginia, United States
hello@praxisspanadvisory.com