How we handle your information, written plainly.

Keystone Scaling Co (“Keystone,” “we,” “us,” or “our”) operates keystonescaling.com and provides patient acquisition services to independent medical practices. We take privacy seriously because the people who trust us with their practice data are often trusting us with their patients' data too.

This policy covers information collected through our website, discovery-call forms, and the ongoing work we do with clients. If you only ever browse the site, the vast majority of this policy will not apply to you.

We collect information in three ways: directly from you, through standard web analytics, and through the tools we use to deliver services to our clients.

Information you give us

• Names, email addresses, phone numbers, and practice names from our discovery-call form
• Practice type, monthly revenue range, and the main thing you want to solve on the call — context we use to prepare
• Calendar booking data, handled by our scheduling provider (GoHighLevel)
• Anything you send us by email, text, or during a call we're on together

Information collected automatically

• IP address, browser type, device type, pages visited, and referring URLs — standard web analytics, used only in aggregate
• Essential cookies that keep the site working. No third-party advertising or cross-site tracking cookies.

Information from ongoing client work

When we work with a practice, we store operational data inside a CRM (GoHighLevel) so we can build, monitor, and improve the acquisition systems we've been hired to deliver. That data is owned by the client, governed by a separate service agreement, and segmented per practice.

We use the information we collect to:

• Schedule and conduct discovery calls
• Send proposals, contracts, invoices, and service communications
• Deliver the marketing, automation, and CRM services we've been engaged to deliver
• Improve our website and measure what's working
• Respond to questions, fulfill requests, and keep existing engagements running smoothly

We share information only with the vendors that help us run the business. Each of them has been vetted and is bound by their own privacy and security terms.

• GoHighLevel — CRM, calendar, email, and SMS infrastructure
• Google Workspace — email and document collaboration
• Vercel — the hosting infrastructure for this website
• Meta & Google Ads — ad platforms we manage on behalf of clients (practice-side data only, under each client's account)

We may disclose information if required by law or to protect the safety, rights, or property of Keystone, our clients, or the public. Otherwise, your information stays with us and the vendors above.

This website uses only essential cookies — the ones that keep the site running and remember basic preferences. We do not deploy third-party advertising cookies, pixels, or cross-site tracking of any kind on this site.

You can disable cookies entirely through your browser settings. If you do, some parts of the site may not function, but nothing we do here requires them to identify you.

Regardless of where you live, you can ask us to access, correct, or delete any personal information we hold about you. Email us at hello@keystonescaling.com and we'll respond within a reasonable window (usually under 72 hours).

California residents (CCPA / CPRA)

You have the right to know what personal information we collect, to request deletion, to correct inaccurate information, and to opt out of any sale or sharing of your personal information. We do not sell personal information, so the opt-out is effectively already active, but you're welcome to confirm that in writing.

EU / UK residents (GDPR / UK GDPR)

You have the right to access, correct, delete, restrict, or object to our processing of your personal data, and the right to data portability. You can also lodge a complaint with your local supervisory authority. Our lawful basis for processing is either your consent or the legitimate interest of delivering a service you've asked us to deliver.

Opting out of marketing

Every email we send has an unsubscribe link. You can also just reply and tell us to stop — we will.

We use industry-standard encryption in transit (TLS) and at rest. Access to client data is limited to the founder and authorized contractors who need it to deliver the work, and we audit access on a rolling basis.

No system is unbreakable, so we treat security as a practice, not a product. If we ever experience a breach involving your personal information, we will notify affected parties within 72 hoursof discovery, along with what happened and what we're doing about it.

Keystone's services are built for business owners and their operators. They are not directed at anyone under 18. We do not knowingly collect personal information from minors. If you believe a minor has submitted information to us, email us and we will delete it.

We may update this policy as our business and the regulatory landscape evolve. If a change is material, we'll communicate it by email (to active contacts) or a visible notice on the site before it takes effect. The “Effective” date at the top of the page always reflects the current version.

Questions, corrections, or a deletion request? Email hello@keystonescaling.com. We're based in New York, United States, and we read every message that lands in the inbox.