PRIVACY POLICY
Remedy & Root, LLC
Effective Date: September 7, 2026
Last Updated: September 7, 2026
The short version. We collect your email address only if you give it to us. We use it to send our writing and occasional news about our work, and you can unsubscribe from any email in one click. We do not sell, rent, or trade your information, and we run no advertising or ad tracking. Please do not send us medical information through this site. The full policy below explains all of it, including how to ask what we hold about you or to have it deleted. Questions: tracy@remedyandroot.com.
1. Who We Are and What This Covers
Remedy & Root, LLC (“Remedy & Root,” “we,” “us,” “our”) is a Virginia limited liability company providing systems change consulting to health care systems, non-profit organizations, coalitions, community-based organizations, and public sector agencies.
This Policy covers www.remedyandroot.com (the “Site”) and the email, scheduling, and inquiry communications that begin there. It does not cover information governed by a signed client agreement, statement of work, business associate agreement, or data processing agreement, each of which controls on its own terms, and it does not cover third-party platforms such as Substack and LinkedIn, which maintain their own policies.
By using the Site, you agree to what is described here.
2. What We Collect
When you give it to us. Subscribing to the email list gives us your email address, first name, and optionally your organization and role. Submitting the contact form gives us your name, email address, organization, role, and the content of your message. Booking a call gives us your name, email address, organization, meeting topic, and any notes you enter. Downloading a resource gives us your email address and name. Emailing us gives us everything in your message and any attachments. Registering for an event we host gives us your name, email address, organization, and registration responses.
We do not ask you to create an account, and we do not collect payment card information through the Site.
Automatically. Like nearly every website, the Site logs technical information when you visit: IP address, browser and device type, operating system, referring URL, pages viewed, time and date, and approximate region derived from IP address. We use it in aggregate to understand traffic, fix problems, and protect the Site against abuse.
Cookies. The Site uses cookies that are strictly necessary for it to function, and analytics cookies that tell us which content is useful. We do not use advertising or retargeting cookies, and we do not permit advertising networks to track you across other websites through our Site. You can control cookies in your browser settings, though blocking all of them may break parts of the Site.
From others. We may receive limited information from professional networks such as LinkedIn, from event organizers where you chose to share your details with speakers, and from public business sources used for research and outreach. Every business development message we send includes a way to ask us to stop.
Do Not Track. There is no common standard for interpreting a browser’s Do Not Track signal, so the Site does not respond to it. Where state law requires, we honor an opt-out preference signal such as Global Privacy Control, though as stated below we have nothing to sell or share.
3. What We Do With It, and What We Do Not
We use what we collect to respond to you, to operate the email list, to deliver resources you request, to understand in aggregate which content is useful, to run the business (recordkeeping, invoicing under separate client agreements), to protect the Site against fraud and abuse, and to meet legal, tax, and regulatory obligations. Those are the only purposes.
We do not sell your personal information. We do not share it for cross-context behavioral advertising. We do not rent, trade, or license our email list. We do not quote your inquiry, name you, or use your situation as a case example without your written permission. We do not use your information to make automated decisions that affect you legally or similarly significantly.
4. The Email List, and How to Leave It
Opting in. We add you only when you act: entering your address in a subscribe field, checking a consent box on a download, or asking us in writing. We do not add people we meet at conferences, connect with on LinkedIn, or are introduced to.
What you get. Essays and analysis on health system integration, oncology care delivery, and systems change practice; announcements of new frameworks, publications, and tools; notice of speaking engagements and events; and occasionally news about our services.
Opting out. Click unsubscribe at the bottom of any email, which takes effect immediately, or email tracy@remedyandroot.com with “Unsubscribe” in the subject line. We process every request within ten (10) business days as required by the CAN-SPAM Act, 15 U.S.C. sec. 7701 et seq. No fee, no login, no explanation required.
What continues. Unsubscribing ends marketing email. It does not end replies to questions you send us, messages about an active engagement, delivery of something you specifically requested, or legally required notices. If you want no contact at all, say so and we will honor it.
After you leave. We keep a suppression record consisting of your email address and the date of your request, so that we do not add you back by mistake. That is a compliance record, not a marketing one.
5. Who Else Sees It
Service providers, each under contract, each processing on our behalf, none permitted to use your information for its own marketing: Squarespace (hosting, forms, site analytics), Substack (publishing and newsletter), Mailchimp (email marketing), Google Analytics (site usage), Google Workspace (business email and file storage), and Stripe (payment processing, where applicable, which handles payment data that we never store).
Professional advisors such as accountants, attorneys, and insurers, who are bound by their own duties of confidentiality.
Legal process, where we reasonably believe disclosure is required by law, subpoena, or court order, or is necessary to protect the rights, property, or safety of Remedy & Root, our clients, or the public. Where we may lawfully tell you about such a request, we will.
A business transfer, if Remedy & Root is ever merged, acquired, reorganized, or sold. Any recipient is bound by this Policy or must give you notice and a choice before changing it materially.
Anyone you direct us to, for example when you ask for an introduction.
We do not sell personal information, and we have not sold or shared personal information for cross-context behavioral advertising in the preceding twelve (12) months.
6. Do Not Send Us Health Information
The Site is not a secure or HIPAA-compliant channel, and Remedy & Root is not acting as a covered entity or as your business associate when you use it.
Please do not submit protected health information, medical details, diagnoses, treatment records, or patient identifiers through the Site, its forms, its scheduling tool, or ordinary email, whether the information is about you or about someone else. If you send it anyway, we will delete it as soon as practicable and will not use it, though we cannot control what happened to it in transit.
Where Remedy & Root handles protected health information during a consulting engagement, it does so only under a separately executed business associate agreement and through the secure channels that agreement designates, consistent with the HIPAA Privacy and Security Rules, 45 C.F.R. Parts 160 and 164. Client organizational data is governed by the confidentiality terms of the applicable consulting agreement, not by this Policy.
7. How Long We Keep It
Subscriber data stays until you unsubscribe, after which only the suppression record remains. Subscribers with no engagement are reviewed every twenty-four (24) months and may be removed. Contact and inquiry submissions are kept twenty-four (24) months from last contact unless a client relationship results. Scheduling records are kept twelve (12) months. Analytics and server logs follow the platform’s retention, typically fourteen (14) months or less. Business and financial records are kept as long as tax, insurance, and professional obligations require, generally seven (7) years.
When we no longer need information, we delete it or de-identify it so that it cannot reasonably be linked back to you.
8. Security
We maintain safeguards appropriate to the size of this practice and the sensitivity of what it holds: access controls, multi-factor authentication on business accounts, encrypted transmission, device encryption, established vendors with published security practices, and collecting as little as possible in the first place, which is the most effective control available to a firm this size. No method is completely secure, so we cannot guarantee absolute security. If we learn of an incident affecting your personal information, we will notify you and any applicable regulator as the law requires.
9. Your Rights
Some states give residents specific privacy rights. We extend the following to every visitor regardless of where you live, because uniform handling is simpler to administer and it is the posture a health care client expects of a partner:
To know what personal information we hold about you and receive a copy of it
To correct it if it is wrong
To have it deleted, subject to legal exceptions
To receive it in a portable format where technically feasible
To opt out of sale, sharing, targeted advertising, and profiling, none of which we do
To limit the use of sensitive personal information, which we do not intentionally collect
To be free of retaliation for exercising any of these rights
To appeal if we say no, by replying to our decision. We answer appeals in writing within forty-five (45) days, and if we deny yours you may contact your state Attorney General.
How to ask. Email tracy@remedyandroot.com with “Privacy Request” in the subject line and tell us which right you are exercising. We verify identity by matching your request against our records, usually by confirming it comes from the email address in question. No account required. We respond within forty-five (45) days, and may extend once by another forty-five (45) days with notice to you. You may use an authorized agent, in which case we will ask for written proof of authorization.
These rights track the California Consumer Privacy Act as amended by the California Privacy Rights Act, Cal. Civ. Code sec. 1798.100 et seq., and the Virginia Consumer Data Protection Act, Va. Code sec. 59.1-575 et seq. Where Remedy & Root does not meet a statute’s applicability threshold, these rights are extended voluntarily. We make no disclosures of the kind covered by California Civil Code sec. 1798.83 (“Shine the Light”).
10. Children
The Site is meant for professionals and organizational leaders. We do not knowingly collect personal information from anyone under sixteen (16), and consistent with the Children’s Online Privacy Protection Act, 15 U.S.C. sec. 6501 et seq., we will promptly delete anything we learn we collected from a child under thirteen (13). If you believe a child has given us information, write to tracy@remedyandroot.com.
11. Other Sites and Platforms
We link to third-party sites, research repositories, and platforms that we do not control and are not responsible for. Once you follow a link away from the Site, or engage with us on LinkedIn or Substack, that platform’s privacy policy governs and it may collect information about you independently of us.
12. Changes
We may update this Policy as our tools, practices, or obligations change, and the Last Updated date above always shows the current version. For a material change to how we use information already collected, we will post a prominent notice on the Site and, where we hold your email address, tell you by email. Using the Site after a change takes effect means you accept it. Prior versions are available on request.
13. Contact
Remedy & Root, LLC, Attn: Privacy
Email: tracy@remedyandroot.com
We aim to acknowledge every privacy inquiry within five (5) business days. ***