Privacy Policy

BrandKlout, Inc. ("BrandKlout," "we," "us," or "our") provides marketing, website, reputation, and communication services to dental and medical practices in the United States and Canada. This Privacy Policy explains how we collect, use, disclose, and protect personal information when you visit brandklout.com, brandklout.ai, or our related sites (the "Sites"), contact us, use our services, or receive text messages from us or through us. It also explains your privacy rights and how to use them.

Patient information we handle for practices. When a practice uses BrandKlout to communicate with its patients, for example to send a feedback request after a visit, we process that information on the practice's behalf as its service provider and, where HIPAA applies, as its business associate. The practice's own privacy notice governs that information. Section 9 explains how we handle it.

At a glance

• We do not sell personal information in exchange for money.
• We use advertising cookies and pixels on our Sites only after you consent. California law may treat this as a "sale" or "sharing." You can opt out at any time, and we honor Global Privacy Control (GPC) signals.
• We never share mobile phone numbers or text-messaging opt-in data with third parties for their marketing.
• We never use patient information for our own marketing or to build advertising audiences.
• You can access, correct, or delete your information by emailing [email protected] or calling (949) 620-6929.

1. Information we collect

1.1 Information you give us

• Contact details: name, email address, phone number (including mobile number), and mailing address.
• Business and professional details: practice name, your role, specialties, locations, website, and the marketing goals and details you share in forms, audits, or calls.
• Account and transaction information: login credentials, billing contact, services purchased, payment plan details, and payment history. Card payments are handled by our payment processor; we do not store full card numbers.
• Communications: emails, chat conversations, call recordings and transcripts (with notice), survey responses, and your text-messaging consent and opt-out history.
• Content you provide for our services: logos, photos, testimonials, and other materials.

1.2 Information collected automatically

• Device and usage data: IP address, browser and device type, operating system, referring pages, pages viewed, clicks, time on page, and approximate location derived from your IP address.
• Cookies, pixels, and similar technologies: including advertising, analytics, chat, and session-replay tools. See Section 5.

1.3 Information from other sources

• Advertising and analytics partners, such as information about the ad or search that brought you to our Sites.
• Publicly available business information, such as Google Business Profiles, practice websites, review sites, and licensing boards, which we use to prepare AI visibility audits and proposals.
• Referral partners and event organizers.
• Practices that use our services (see Section 9).

1.4 Sensitive personal information

The only sensitive personal information we collect about our clients and website visitors is account login credentials, which we use to provide secure account access. We do not use or disclose sensitive personal information for purposes that would require a right to limit under California law. Health information we receive is patient information handled for practices under Section 9.

2. How we use personal information

• Provide, operate, and support our services, including websites, reputation programs, AI visibility audits, and reporting.
• Communicate with you about your account, projects, payments, and support requests.
• Send marketing about our services by email and, with your consent, by text message. You can opt out at any time.
• Advertise our services, including measuring ad performance and showing our ads to visitors of our Sites on other platforms (see Section 5).
• Analyze and improve our Sites and services and develop new features.
• Process payments and payment plans and collect amounts owed.
• Protect our systems, prevent fraud and abuse, and keep records of consent and opt-outs.
• Comply with law, enforce our agreements, and protect rights and safety.

Artificial intelligence. We use AI tools to help deliver our services, for example to draft content or analyze search visibility. Our AI vendors are contractually prohibited from using our customers' confidential information to train their general-purpose models. We do not use personal information to make decisions that produce legal or similarly significant effects about you solely by automated means.

3. Text messages (SMS/MMS)

BrandKlout operates two text-messaging programs. Full program terms are at https://brandklout.ai/legal/sms.

• BrandKlout Business Messages: sent by BrandKlout to practice owners, staff, and prospective clients who opt in. These may include marketing messages about our services, call scheduling, onboarding, project updates, and account and billing messages.
• BrandKlout Patient Survey: sent by BrandKlout on behalf of a dental or medical practice to that practice's patients. These are limited to visit-related messages, such as a feedback request after a visit and one-time sign-in verification codes. Every message names the practice. We do not send marketing messages in this program.

Consent. We send marketing text messages only to people who have given prior express written consent, for example by checking an unchecked consent box on our form. Consent is not a condition of any purchase. Patients consent through their practice when they provide their mobile number and agree to receive visit-related texts. For recipients in Canada, we send commercial electronic messages only with consent as required by Canada's Anti-Spam Legislation (CASL).

Frequency, cost, and timing. Message frequency varies. Message and data rates may apply. We send marketing text messages only between 8 a.m. and 8 p.m. in the recipient's local time.

Opting out. Reply STOP to any message to stop receiving messages from that program. You can also use words such as CANCEL, END, QUIT, UNSUBSCRIBE, REVOKE, or OPT OUT, or tell us by email or phone. A STOP reply takes effect immediately, and we send one message confirming your opt-out. We honor opt-out requests made in other ways within 10 business days at most. Where the law requires, an opt-out applies to all of our text messages. Reply START to resubscribe. Reply HELP for help, or contact [email protected] or (949) 620-6929.

How we use and protect mobile information. We use mobile phone numbers and text-messaging consent only to send the messages you agreed to receive, to keep records of consent and opt-outs, and to comply with law. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All text messaging originator opt-in data and consent will not be shared with any third parties, excluding aggregators and providers of the text message services. Our messaging providers and wireless carriers receive phone numbers only to deliver messages for us and may not use them for any other purpose. We never upload mobile phone numbers or patient information to advertising platforms, and we configure our advertising tools not to send phone numbers.

Wireless carriers are not liable for delayed or undelivered messages.

4. How we disclose personal information

• Service providers and contractors that help us operate our business, such as cloud hosting, CRM and marketing automation, messaging and telephony, email delivery, payment processing, analytics, customer support, AI tools, and professional advisors. They may use personal information only to provide services to us.
• Advertising partners, such as Google, Meta, and LinkedIn, which collect identifiers and online activity through cookies and pixels on our Sites to measure and target our ads. California law may treat this as "sharing" (see Section 6).
• Practices that request patient programs receive the results, such as patient feedback, for their own patients.
• Business transfers: in connection with a merger, acquisition, financing, or sale of all or part of our business, subject to this Privacy Policy.
• Legal and safety: when required by law or legal process, or to protect the rights, property, or safety of BrandKlout, our clients, or others.
• With your consent or at your direction.

Mobile phone numbers and text-messaging opt-in information are never shared with or sold to third parties or affiliates for their marketing or promotional purposes.

5. Cookies, pixels, and similar technologies

We and our partners use these technologies on our Sites:

• Strictly necessary: to run the Sites, keep them secure, and remember your privacy choices.
• Analytics: to understand how visitors use the Sites.
• Advertising and remarketing: to measure ad performance and show our ads to Site visitors on other platforms.
• Chat and session replay: to provide live chat and to record clicks, scrolling, and page interactions so we can improve the Sites. We configure session-replay tools to mask form fields.

Chat and calls. If you use chat on our Sites, the conversation is recorded and stored by us and our chat provider. Calls with us may be recorded; we tell you at the start of the call.

Your choices. We ask for your consent in our cookie banner before turning on advertising, session-replay, and other non-essential technologies, and you can change your choice at any time using the "Your Privacy Choices" link (shown with the opt-out icon) in our footer. We treat a Global Privacy Control (GPC) signal as a request to opt out of the sale and sharing of personal information for that browser and, if you are logged in or we otherwise know who you are, for your account as well. We show that your opt-out was honored. We do not respond to other "Do Not Track" browser signals. You can also block cookies in your browser settings, though some features may not work.

6. Sale and sharing of personal information

We do not sell personal information in exchange for money. However, when you allow advertising cookies and pixels, advertising partners receive identifiers (such as cookie IDs, IP addresses, and hashed email addresses), internet activity, approximate location, and related inferences, which California law may treat as a "sale" or as "sharing" for cross-context behavioral advertising. In the past 12 months, we may have sold or shared these categories with advertising partners. You can opt out of both using the "Your Privacy Choices" link or a GPC signal. We do not sell or share mobile phone numbers, text-messaging opt-in data, or patient information, and we do not knowingly sell or share personal information of anyone under 16.

7. Categories of personal information (U.S. state privacy disclosures)

In the past 12 months, we collected the following categories of personal information:

|  | Examples | Sources | Purposes | Disclosed to | Sold or shared for advertising? |
| --- | --- | --- | --- | --- | --- |
| Identifiers | Name, email, phone, IP address, cookie IDs, account ID | You; automatic collection; advertising partners | Services, communications, marketing, advertising, security | Service providers; advertising partners (cookie IDs, IP addresses, hashed emails) | Cookie IDs, IP addresses, and hashed emails only, with consent |
| Customer records (Cal. Civ. Code § 1798.80(e)) | Name, address, phone, billing details | You | Services, billing, communications | Service providers, including payment processors | No |
| Commercial information | Services purchased, payment plans, transaction history | You; our records | Services, billing, analytics | Service providers | No |
| Internet or network activity | Pages viewed, clicks, ad interactions, session replays | Automatic collection | Analytics, advertising, security | Service providers; advertising partners | Yes, with consent |
| Approximate geolocation | City or region derived from IP address | Automatic collection | Analytics, advertising, security | Service providers; advertising partners | Yes, with consent |
| Audio and electronic information | Call recordings, chat transcripts | You | Support, quality, records | Service providers | No |
| Professional information | Practice name, role, locations | You; public sources; referral partners | Services, sales, audits | Service providers | No |
| Inferences | Interest in our services | Derived from the categories above | Marketing, advertising | Service providers; advertising partners | Yes, with consent |
| Sensitive personal information | Account login credentials | You | Account access and security | Service providers | No |

Patient information we process as a HIPAA business associate is exempt from the California Consumer Privacy Act and is covered by Section 9.

8. How long we keep personal information

We keep personal information only as long as needed for the purposes in this Privacy Policy, then securely destroy or anonymize it. Our standard periods are:

| **Information** | **Retention period** |
| --- | --- |
| Prospective client information | Up to 3 years after our last interaction, unless you ask us to delete it sooner |
| Client account and transaction records | The length of the relationship plus 7 years, for tax, accounting, and legal purposes |
| Call recordings and chat transcripts | Up to 12 months, unless needed for a dispute |
| Text-message consent and opt-out records | 5 years after the last message; opt-out records may be kept longer so we never text you again |
| Website analytics and advertising data | Up to 26 months |
| Professional information and inferences | Same as the prospective client or client records they relate to |
| Account login credentials | While your account is active, then deleted within 90 days after it closes |
| Security logs | Up to 12 months |
| Patient information processed for practices | As our agreement with the practice requires; generally returned or deleted within 30 days after services end |

9. Patient information we handle for practices

When we send messages or provide services to a practice's patients, we act on the practice's behalf. The practice decides what information we receive, and its Notice of Privacy Practices governs that information.

• We use patient information only to deliver the services the practice requested, such as feedback requests, verification codes, and reports to the practice.
• We never sell patient information, use it for our own marketing, add it to advertising audiences, or use it to train general-purpose AI models.
• Our Business Associate Addendum with the practice and, where applicable, California's Confidentiality of Medical Information Act govern our handling of this information.
• If you are a patient and want to access, correct, or delete your information, please contact your practice. If you contact us, we will forward your request to the practice and help it respond.

10. Your privacy rights (United States)

Depending on where you live, including California and other states with comprehensive privacy laws, you may have the right to:

• Know and access the categories and specific pieces of personal information we have collected about you. California residents may request information collected on or after January 1, 2022.
• Correct inaccurate personal information.
• Delete personal information, subject to legal exceptions.
• Receive a portable copy of your personal information.
• Opt out of the sale or sharing of personal information and of targeted advertising.
• Not be discriminated or retaliated against for exercising your rights.
• Appeal our decision on your request, where state law provides that right.

We honor access, correction, and deletion requests from all clients and Site visitors, wherever they live, when we reasonably can.

How to make a request. Email [email protected], call (949) 620-6929. We will confirm receipt within 10 business days and respond within 45 days. If we need more time, we will tell you, and we may take up to 45 more days.

Verification. To protect your information, we will ask you to confirm details we already have, such as your email address or phone number. Opt-out requests do not require verification.

Authorized agents. You may use an authorized agent. We may ask the agent for your signed permission and ask you to verify your identity directly, unless the agent holds a valid power of attorney.

Appeals. If we decline your request, reply to our decision with the word "Appeal." We will respond within the time your state's law requires. If you disagree with our appeal decision, you may contact your state attorney general.

Exceptions. We may keep information when the law requires it, to complete a transaction you requested, to protect security, to resolve disputes, or to honor opt-outs.

11. Additional notices for California residents

• Notice at collection. Sections 1, 2, 4, 6, and 8 of this Privacy Policy are our notice at collection, and we link to it wherever we collect personal information.
• Shine the Light. We do not disclose personal information to third parties for their own direct marketing purposes (Cal. Civ. Code § 1798.83).
• Financial incentives. We do not offer discounts or other financial incentives in exchange for personal information.

12. Notice for residents of Canada

We handle personal information of Canadian residents in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws, including Quebec's Act respecting the protection of personal information in the private sector (as amended by Law 25).

• Consent. We collect, use, and disclose personal information with your consent, which may be express or implied depending on the information and context. You may withdraw consent at any time, subject to legal or contractual limits, and we will explain the effect of withdrawing.
• Your rights. You may request access to and correction of your personal information, and we will respond within 30 days, as Canadian law requires. In Quebec, you may also request a copy in a structured, commonly used technological format, ask to be informed when a decision about you is made solely by automated processing, and ask us to stop disseminating your information where the law allows.
• Storage outside your province or Canada. We and our service providers store and process personal information in the United States and other countries, where it may be accessible to authorities under local law. Before transferring personal information outside Quebec, we assess whether it will receive adequate protection, as Quebec law requires.
• Messages. We send commercial electronic messages, including texts and emails, only in compliance with CASL. Each message identifies BrandKlout and includes a way to unsubscribe, and we process unsubscribe requests within 10 business days.
• Privacy Officer. Our person in charge of the protection of personal information is Jessica Acosta, Head of Success, reachable at [email protected], by phone at (949) 620-6929, or at our mailing address below.
• Complaints. Send privacy complaints to our Privacy Officer. We will acknowledge your complaint, investigate it, and give you a written response within 30 days. If you are not satisfied, you may contact the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information.

13. Security

We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit, multi-factor authentication and access controls for systems that hold patient information, and contracts with vendors that require them to protect it. No system is completely secure. If a breach affects your personal information, we will notify you and the authorities as the law requires.

14. Children

Our Sites and services are intended for businesses and are not directed to children under 16. We do not knowingly collect personal information from children under 16 through our Sites. If you believe we have, contact us and we will delete it. This does not apply to patient information we process for practices, which may include minors and is handled under Section 9.

15. Where we operate

We provide our services in the United States and Canada and store information primarily in the United States. If you access our Sites from elsewhere, your information will be transferred to and processed in the United States.

16. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated version with a new "Last Updated" date. If we make material changes, we will notify you by email or by a prominent notice on our Sites before the changes take effect.

17. Contact us

If you have questions about this Privacy Policy or our privacy practices, or need this policy in an alternative format, contact us:

BrandKlout, Inc.

15911 Pomona Rincon Rd, Suite 120B

Chino Hills, CA 91709

Phone: (949) 620-6929Email: [email protected]

Privacy Officer: Jessica Acosta, Head of Success