Privacy policy

Effective date: May 24, 2026

This privacy policy explains how Beluga Health collects, uses, and shares information from visitors to belugahealth.com. We are Beluga Management LLC, the company that operates this marketing website (referred to in this policy as "Beluga," "we," "us," or "our").

This policy covers visitors to belugahealth.com and prospects who submit information through our contact and AutoRx forms. It does not cover patients receiving clinical care through Beluga Health, P.A. or its affiliated professional corporations. Patient-facing privacy practices are governed by a separate Beluga Health Privacy Policy applicable to the clinical care relationship.

If you are visiting this site to learn about Beluga's services, contact our team, or request information, this policy applies to you. If you are a patient receiving telehealth services from one of our partner brands, please refer to the privacy policy provided through your patient portal.

Information we collect

We collect information in three ways.

Information you provide to us. When you fill out the contact form or the AutoRx brief request form on our website, we collect the information you submit. This typically includes your name, email address, the company or brand you represent, the topic of your inquiry, the audience or category you identify with, your role at your company, expected visit volume (for AutoRx requests), and the message or details you provide in the free-text fields. We collect this information so that our team can respond to your inquiry, schedule scoping calls, and follow up on partnership conversations.

Information collected automatically. When you visit our website, we automatically collect certain technical information through analytics cookies and server logs. This includes your approximate location (city-level, based on anonymized IP address), the pages you visit, the time you spend on each page, the actions you take such as clicking CTAs, the type of device and browser you use, and the website you came from if you arrived via a referral link. We use Google Analytics 4 to collect this information. We have configured Google Analytics to anonymize IP addresses, disable Google Signals, and disable advertising personalization signals. We do not use Google Analytics for advertising audience building.

Cookies and tracking technologies. Our website uses cookies only after you accept them through our cookie consent banner. If you accept, we set Google Analytics cookies (typically _ga and _ga_*) that help us understand site usage. If you reject, no analytics cookies are set and no usage data is collected. We do not use advertising cookies, social media tracking pixels, or third-party retargeting cookies. The Salespeak chat widget on our marketing pages may set its own cookies for chat session continuity; please refer to Salespeak's privacy practices for details on their data handling.

How we use information

We use the information we collect for the following purposes:

To respond to your inquiry and schedule scoping calls or follow-up conversations
To send you information about Beluga's services that you have requested, such as the AutoRx brief
To improve our website, including by analyzing which pages prospects find most useful
To support our internal sales and partnership operations, including tracking prospects through our CRM and coordinating across our team
To comply with our legal obligations, respond to lawful requests, and protect our rights
To detect and prevent fraudulent or malicious activity, including abuse of our contact forms

We do not sell your personal information. We do not share your personal information with third parties for their own marketing purposes. We do not use the information you submit for any purpose unrelated to your inquiry or our service to you.

How we share information

We share information only in the following limited circumstances:

With our service providers. We use a number of third-party services to operate our business and our website. These providers receive only the information they need to perform their function and are contractually required to protect your information. The providers we currently use include:

Netlify (web hosting and form submission infrastructure)
Google Analytics (website analytics, with the privacy-protective configuration described above)
Google Workspace (email, including the email address contact form submissions are delivered to)
Slack (internal team communication, including channels where partner inquiries may be discussed)
Attio (customer relationship management, used to track prospects and partnership conversations)
Salespeak (chat widget on marketing pages, if you initiate a chat conversation)

We may add or change service providers over time. Material changes will be reflected in updates to this policy.

For legal reasons. We may disclose information if we believe in good faith that disclosure is required by law, regulation, legal process, or governmental request, or if disclosure is necessary to protect our rights, your safety, or the safety of others, or to prevent or investigate fraud or security issues.

In connection with business transactions. If Beluga is involved in a merger, acquisition, financing, sale of assets, or similar transaction, your information may be transferred as part of that transaction. In such a case, we will notify affected individuals and the acquiring entity will be bound by privacy obligations consistent with this policy.

With your consent. We will share your information in other ways only if you give us specific permission to do so.

How long we keep information

We retain the information you provide for as long as is reasonably necessary to support your inquiry, our ongoing partnership conversations, and our business records. In practice this means:

Contact form and AutoRx form submissions are retained in our CRM and email systems indefinitely while the prospect or partnership relationship is active. If a partnership conversation ends without proceeding, we typically retain the contact record for up to three years in case the conversation resumes.
Analytics data in Google Analytics is retained for 14 months from collection. After that period, individual user-level data is automatically deleted by Google. Aggregated data may be retained longer.
Server logs containing IP addresses and request details are typically retained for 30 to 90 days for security and operational purposes.

You may request deletion of information we hold about you at any time. See "Your rights" below.

Your rights

Depending on where you live, you may have specific rights regarding your personal information. The following rights are generally available to most users regardless of location:

The right to access the personal information we hold about you
The right to correct inaccurate information
The right to delete your information, subject to legal limitations
The right to opt out of analytics cookies (you can also withdraw consent at any time by clearing your browser's localStorage or by emailing us)
The right to receive a copy of your information in a portable format
The right to object to certain uses of your information

To exercise any of these rights, email us at the address provided in the "How to contact us" section below. We will respond within 30 days, or longer where law requires or permits.

California residents (CCPA/CPRA)

If you are a California resident, you have the rights described above, plus:

The right to know what categories of personal information we collect about you and the purposes for which we use it (described throughout this policy)
The right to opt out of the "sale" or "sharing" of personal information. We do not sell or share personal information as defined under California law, but you have this right available regardless.
The right to limit the use of sensitive personal information. We do not collect sensitive personal information through this website beyond what is necessary for business purposes.
The right not to be discriminated against for exercising any of these rights.

To exercise any California-specific rights, email us at the address provided below. We may need to verify your identity before responding.

EU, UK, and other GDPR-style jurisdictions

If you are located in the European Union, the United Kingdom, or another jurisdiction with GDPR-style privacy laws, you have the rights described above. The lawful basis for our processing is typically:

Legitimate interest for responding to your inquiry, managing our prospect pipeline, and operating our website analytics
Consent for setting cookies that are not strictly necessary
Legal obligation for retaining records required by law

You have the right to lodge a complaint with your local data protection authority if you believe we have not handled your information appropriately. We encourage you to contact us first so we can address your concern directly.

Other US states

Residents of Virginia, Colorado, Connecticut, Utah, and other US states with comprehensive privacy laws have rights substantially similar to those described above. To exercise any of these rights, email us at the address provided below.

How we protect your information

We use commercially reasonable administrative, technical, and physical safeguards to protect personal information. These include encryption of data in transit (TLS), access controls limiting which team members can view contact records, and regular review of our service provider security practices.

No system is perfectly secure, and we cannot guarantee the security of information transmitted to or from our website. If you have reason to believe your information has been compromised, please contact us immediately.

International data transfers

We are a US-based company, and our service providers process information in the United States and other countries. If you are located outside the United States, your information will be transferred to and processed in the United States, where data protection laws may differ from those in your country.

Where required, we rely on appropriate transfer mechanisms such as standard contractual clauses or equivalent safeguards to protect information transferred from regions with stricter privacy laws.

Children's privacy

This is a business-to-business marketing website. It is not directed to children, and we do not knowingly collect personal information from individuals under 16 years of age. If you believe a child has submitted information through our website, please contact us and we will delete the information.

Updates to this policy

We may update this policy from time to time to reflect changes in our practices, technology, legal requirements, or other reasons. When we make material changes, we will update the effective date at the top of the policy and, where appropriate, notify users through the website or via the email address they have provided. Continued use of the website after an update constitutes acceptance of the revised policy.

How to contact us

If you have questions about this policy or about our privacy practices, or if you would like to exercise any of the rights described above, contact us at:

Email: info@belugahealth.com

Mailing address: 1321 Upland Dr., Suite 18399, Houston, TX 77043

We will respond to inquiries within 30 days where reasonable, and within the timeframes required by applicable law.

This privacy policy applies only to belugahealth.com. It does not cover patient-facing privacy practices for clinical telehealth services provided through Beluga Health, P.A. or its affiliated professional corporations. Patients should refer to the patient-facing privacy policy provided through their patient portal.