AudiologySync Website Privacy Policy

The API Guys LLC Version: 1.5 Effective Date: 9 September 2026

1. What this policy covers, and what it does not

This policy describes what happens to personal information when you visit audiologysync.com, ask us a question, or book a call with us. For that information, The API Guys LLC is the controller — we decide what is collected and why, and this policy is the one that applies.

This policy does not apply to patient data we handle for a practice

AudiologySync is also the name of a service we operate for audiology practices: we move patient records out of a practice’s own systems and into that practice’s own CRM.

In that work we are a processor, not a controller. The practice decides what moves and why; we act on their instructions under a written agreement — typically a Master Services Agreement and a Business Associate Agreement. If a practice holds information about you and we handle it on their behalf, that practice’s privacy notice applies to it, not this one. Their agreement with us governs how we may use it, and we may not use it for our own purposes.

So if you are a patient, this policy is almost certainly not about you. This website is for practice owners and managers evaluating our service. It is not a patient portal, it accepts no patient information, and no patient data reaches it. For a question about your own records, contact your practice — they hold them, and we are not permitted to act on them for you.

(This is the same division a hosting provider or CRM draws. Our own vendors do it too: where we use a supplier to process information for us, their policy covers their own customers and ours covers you.)

2. Who is responsible

The API Guys LLC, a Massachusetts limited liability company with its principal office in Brookline, Massachusetts, United States, is the controller of the information described in this policy.

Contact details are in §11.

3. What we collect, and when

There is no account to create and no form on the pages themselves. If you decline analytics, or ignore the banner, reading this website collects nothing about you at all.

Two things collect information, and only when you choose to use them:

3.1 Booking a call

Every page carries a link to a scheduling page operated by HighLevel Inc. (the GoHighLevel / LeadConnector platform) on our behalf. Following it takes you to their page. If you book, you provide:

• your name
• your email address
• your phone number
• which practice management system your clinic uses
• the appointment slot you choose
• anything else you type into the booking form

This information goes to HighLevel’s systems and into the customer-relationship account we maintain there. We use it to hold the call, to prepare for it, and to follow up afterwards about your enquiry.

Two optional tick-boxes about text messages. The booking form offers two separate consent boxes — one for messages about your appointment (confirmations, reminders, scheduling changes) and one for marketing messages (offers, product updates, integration news). Both are unticked by default and entirely optional: you can book without ticking either, and we will not make consent a condition of getting a call.

If you tick one, you can withdraw at any time by replying STOP to any message, or by asking us — see §8. Reply HELP for assistance. Message frequency varies, and message and data rates may apply.

3.2 Emailing or calling us

If you email contact@audiologysync.com or call the number on our contact page, we receive whatever you choose to tell us — at minimum your email address or phone number, and the contents of your message. Email reaches a shared address monitored by our team rather than one individual.

3.3 What we do not collect

To be explicit, because the absence is deliberate:

• No advertising. No retargeting, no social pixels, no ad networks. Analytics, if you agree to it, is Google Analytics 4 and nothing else — see §4.
• No server access logs. Request logging on the content-delivery network serving this site is switched off, so we do not retain a record of who requested which page.
• No forms of our own. The contact page offers an email address rather than a form, specifically so that reaching us does not require handing us data first.
• No health information. We neither ask for nor want any patient or health information through this website. Please do not send any.

4. Cookies

This website sets no cookies unless you agree to analytics.

When you first visit, a banner asks whether we may use analytics cookies. Until you say yes, nothing is stored on your device by us — and Google Analytics does not run at all. It is not merely restricted: the tag does not load, no measurement is sent, and no cookie is written. If you decline, or ignore the banner entirely, it stays that way.

If you do agree, Google Analytics 4 sets two cookies (_ga and one beginning _ga_) so we can tell which pages help people find us. It does not tell us who you are, and we never send Google your name or email address.

We use no advertising cookies, no retargeting, and no social media pixels — agreeing to analytics does not switch advertising on, because we do not do it.

Google Tag Manager itself loads on every page, since it is the switch that turns analytics on when you agree. That means your browser contacts Google, but it carries no measurement and sets no cookie of its own.

Full detail, including how to change your mind, is in our Cookie Policy.

Booking a call is different, because it hands you to someone else — under our name.

The “book a call” button is an ordinary link. Following it takes you to a scheduling page at links.audiologysync.com. That address is ours, but the page is not: it is operated by HighLevel Inc. on our behalf, and we point our own subdomain at their systems so the link looks like the rest of our site.

We are telling you this because you could not otherwise tell. The address bar will still say audiologysync.com.

That page sets a security cookie. It is called __cf_bm, it comes from Cloudflare, and its job is to tell real visitors from automated traffic so the booking page keeps working. It lasts about half an hour and cannot be read by any script. Because the web address is ours, it is stored against our domain name — but it is HighLevel’s cookie, set for that purpose as our service provider.

Whatever that page sets is governed by HighLevel’s own privacy and cookie policies, which are linked from it. We do not run it and we do not control what it loads, which is exactly why we are pointing you at their policies rather than summarising them here.

Nothing about any of that happens unless you click.

Draft note, for the reviewer. The site points at the branded host (tag-marketing consts.ts, 2026-08-18), so this describes what happens rather than an intention.

This section is deliberately written not to need re-verifying. It states what we control precisely — our pages set nothing — and describes the booking page structurally: it is theirs, it sets a security cookie, their policies govern it. An earlier draft added “we checked and there are no analytics cookies on it”, which was true when measured (2026-08-18: only __cf_bm, on both hosts, nothing else) and would have become a standing obligation to keep re-measuring someone else’s page. A published policy should not contain a claim that decays silently.

The measurement is in plans/audiologysync-counsel-brief.md instead, where it belongs: point-in-time evidence for a decision, not a durable public promise.

5. Who else sees your information

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We have never done either.

Your mobile number, specifically. If you give us a phone number and tick a consent box, that number stays with us and the providers who deliver the message for us.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information sharing to subcontractors in support services, such as customer service, is permitted.

Those subcontractors — the messaging platform that actually sends the text, for example — may use it only to deliver the service to us, and for nothing of their own.

One provider we name, because it is the one that matters. Booking a call sends your details to HighLevel Inc. (the GoHighLevel / LeadConnector platform), which runs our scheduling and our record of your enquiry. It is named here rather than left to a category because it receives everything anyone submits through this site, and you should be able to look them up before deciding to book.

Otherwise we use service providers in the ordinary categories — website hosting and content delivery, business email, and IT and security tooling. They handle information only as needed to provide those services to us, under contracts that limit what they may do with it and require them to protect it.

We may also disclose information where the law requires it, or where we need to establish, exercise or defend a legal claim.

6. Links to other websites

Some links on this site take you somewhere we do not run. The main one is the book a call button, which hands you to a scheduling page operated by HighLevel. There are also photographer credits linking to Pexels.

Once you follow a link, you are on someone else’s website and their privacy policy applies, not ours. They may set their own cookies and collect their own information, and we do not control that.

We mention it because a link can be easy to miss: the scheduling page may carry a web address that looks like ours, and it is still HighLevel’s page and HighLevel’s policy.

7. How long we keep it

If you enquire and do not become a client, we delete your record 24 months after your last contact with us. If you do become a client, your information is kept for the life of that relationship and then under the retention terms of our services agreement.

That period is not set here. It comes from our Data Retention & Destruction Policy, which is the single place every retention period at The API Guys LLC is maintained — this document restates one row of it for you. If the two ever disagree, the Data Retention & Destruction Policy is correct and the restatement here is a bug.

If you would like your record deleted sooner, ask — see §8.

8. Your rights

We extend these rights to everyone, wherever you live. Some of them are required of us in some places and not others; rather than making you work out which apply to you, we apply them all. Where a specific law gives you something additional, that law still wins.

You can ask us to:

• Know and access — what we hold, where we got it, and who we shared it with.
• Correct — have inaccurate information fixed.
• Delete — have your information erased, subject to records we are required to keep.
• Portability — receive your information in a portable form.
• Opt out of sale or sharing — we do not sell or share personal information for behavioural advertising, so there is nothing to opt out of; the right stands regardless.
• Non-discrimination — we will not treat you differently for exercising any right.

Where we rely on your consent, you may withdraw it at any time. Withdrawing consent does not affect anything done before you withdrew it.

How to exercise a right

Use our request form: compliance.theapiguys.com/dsar-form

It is the same form we use for every privacy request across our business, and it is the fastest route because it opens a tracked record the moment you submit it. You can also email us (§11) if you would rather — we log those the same way.

What happens then:

We run one process for everyone rather than a different clock per jurisdiction. Some laws allow longer than 30 days; we do not take it as a matter of course.

If you think we have got it wrong, you can complain to a regulator. In Canada that is the Office of the Privacy Commissioner of Canada, or your provincial commissioner. In the EEA or UK it is your national supervisory authority. In California it is the California Privacy Protection Agency or the Attorney General. We would rather you raised it with us first so we can put it right, but that is your choice and not a precondition.

9. Why we are allowed to do this

We only handle your information for a reason we can point to:

(In GDPR terms these are pre-contractual steps, legitimate interests, and legal obligation. Under Canadian law they rest on your implied or express consent, which you may withdraw. We have written the table in plain terms because the label matters less than the reason.)

10. Children

This website is directed at businesses. It is not intended for anyone under 16, and we do not knowingly collect information from anyone under 16. If you believe a child has provided us information, contact us and we will delete it.

11. How to reach us

We identify our Privacy Officer by role rather than by name so that this policy stays accurate when the role changes hands. The addresses above are AudiologySync’s own. They are answered by the same privacy desk that handles requests for every part of The API Guys LLC — a branded address, not a separate team — so writing to either reaches the same people. The request form is shared for the same reason: it opens a tracked record whichever brand you came from.

12. Changes to this policy

If we change this policy we will update the version and effective date above. Where a change materially affects how we handle information you have already given us, we will take reasonable steps to tell you directly rather than relying on you to re-read this page.

The version you are reading is published from our compliance repository, which is the single source of truth for it. Superseded versions are retained there.