- English
- Español
Privacy Policy
Last updated: November 10, 2026
This Privacy Policy explains what information AIPRDESK LLC, doing business as “aiprdesk” (“aiprdesk,” “we,” “us”), collects through aiprdesk.com, our client desks and approval portal, our messages and alerts, and our services. It explains how we use and share that information, how long we keep it, and the choices and rights you have.
aiprdesk is a business-to-business editorial PR firm with an Ask Your Desk assistant. We work for verified organizations (our “clients”) and with their staff, and we deliver their approved stories to journalists and professional contacts chosen with the client.
About aiprdesk
aiprdesk is an editorial PR firm with an Ask Your Desk assistant. We are the messenger. We create a client’s real stories as news (news articles, news releases, podcasts, social posts, and short videos) in the languages of the client’s plan. We deliver them one-to-one to relevant journalists, to the client’s own channels, and to professional contacts chosen with the client, only after the client approves the content and presses Send.
How we are different. Every message goes out from a verified sender on an authenticated domain. We deliver one-to-one, never as a mass blast. The client approves before anything is sent.
What we are not. aiprdesk is not an advertising agency or marketing firm. We do not sell, buy, generate, or broker leads, referrals, or patients. We do not sell scripts. We do not run, buy, place, or manage paid advertising. We do not provide marketing or lead generation, including for healthcare, Medicare, Medicare Advantage, or insurance clients, and we do not act as a third-party marketing organization. We do not handle protected health information (PHI) or patient data. Clients must not submit it.
Client identity verification. Every client and its authorized signer is identity-verified through Stripe Identity at checkout, and completes a signed, paid service agreement, before we create or deliver anything. We may refuse, pause, or suspend a client we cannot verify.
Bed-availability updates, where a plan includes them, are informational, approved by the client, and go only to professional referral contacts the client selects. They are never sent to patients, prospective patients, families, or other consumers.
Fees are flat monthly subscription fees per location, as stated in the Order Form and on the pricing page. No fee is tied to referrals, admissions, patients, leads, calls, census, or any other outcome. This describes how we price. It is not legal advice.
The client keeps editorial control and is responsible for the accuracy of what it approves.
1. The short version
- We never handle PHI or patient data, and we do not build, buy, or sell lead lists.
- We do not collect patient information. Our services are designed so that no patient information is needed, including PHI under HIPAA and substance-use-disorder records under 42 CFR Part 2. Our clients agree not to send it.
- We do not sell personal information, and we do not “share” it for cross-context behavioral advertising.
- We use service providers (website platform, database, AI text and video tools, bot protection, email, and payments) only to run our services.
- Our clients approve every message before it goes out.
- This policy is available in the languages linked at the top of this page. If versions differ, the English version controls.
2. Information we collect
a) Website visitors and accounts
- Account signup. The account form collects the name, work email, and company the person enters, plus consent to hear from us about that account. It does not ask for a phone number. The text updates page collects a phone number only when the person checks the optional consent box. Later onboarding can store the industry, voice, website, social accounts, events, reach, languages, and media-contact details the person types.
- Contact messages. The contact form opens the visitor’s own email app with the message they wrote. Nothing is sent until they press Send there. We receive what they choose to send.
- Technical data. The website platform receives standard request data (IP address, browser type, pages requested, and date and time) to deliver and secure the Site. Bot protection. When you create an account, our signup form uses Cloudflare Turnstile to check that the request comes from a person. Cloudflare receives your IP address, browser information, and a challenge token for that check. We do not use this check for advertising.
- Browser storage. We store the language choice in the browser so the Site remembers it. A signed-in account uses an HttpOnly session cookie so the person stays signed in. Demo and account drafts may also be stored in the browser. We do not use advertising cookies or analytics cookies. When you submit the signup form, we set an HttpOnly cookie named aiprdesk_device, a random device id for that browser, used only to limit repeated signup attempts and prevent abuse. It expires after 24 hours.
b) Client staff, portal users, and client verification
- Verification information: the client’s legal name and the registration details it gives us, and the name, title, work email, and proof of authority of the person who signs, collected through intake and the service agreement so we can verify the client before work starts.
- Name, job title, organization, work email, and preferred language, when the client provides them.
- Login and security information for the portal.
- Approval records: who reviewed, edited, approved, rejected, or signed off on each piece of content, when, and which version. We keep these as proof of the client’s approval.
- Click-wrap signature record: when an authorized signer accepts an intake in the portal, we store the signer account id, the Stripe Identity session id, the timestamp, the IP address, the user agent, the document version, and a hash of the click-wrap terms plus the intake fields. We keep this to show who accepted that intake and which text they accepted. We do not take this record from email. Each pitch also needs that client’s own approval of the exact pitch text, and a separate staff review before the pitch is sent.
- Messages to us, and preferences for story alerts and press updates.
c) Content our clients give us
Stories, program and service information, events, news, facts, photos, footage, building and property images, logos, and staff names, titles, bios, quotes, and images. Clients confirm they have permission for any person featured.
d) Staff likeness for a custom representative
If a client asks for a custom AI representative modeled on a staff member, we collect that person’s images, video, and voice samples only with that person’s signed written consent, and use them only to make that client’s approved content. The person may withdraw consent for future content at any time. Content already approved and published may stay up, as stated in the client’s agreement.
e) Media and professional contacts
We keep a press and media contact database with professional information about journalists, editors, producers, and outlets (name, outlet, beat, work email, social handles, and the coverage they have published). We build it from publicly available professional sources and from contacts who give us their details. Clients may also give us lists of professional contacts (for example, hospital discharge planners or case managers, in their work role). These lists may never include patients, prospective patients, or their families. Bed-availability updates go only to these professional contacts. We deliver one-to-one to contacts chosen with the client. We do not run a mass blast.
f) Connected accounts
When a client connects a social account, YouTube channel, website news section, email platform, or business listing profile, we receive only the access the client grants to publish approved content, plus aggregate results such as views, clicks, and rankings. We do not connect to patient records, electronic health records, or intake or admissions systems.
g) Billing information
When a client pays, a payment processor handles the payment. We receive billing contact details and payment status. We do not store full card or bank account numbers on the Site.
What we do not collect
- Patient information of any kind. If it is sent to us by mistake, we delete it and tell the client.
- Information from children. Our services are for businesses, and we do not knowingly collect information from anyone under 18.
- Precise location, government ID numbers, or financial account numbers. The account form does not collect a phone number. A phone number is collected only on the text updates page, and only when the person checks the optional consent box.
3. How we use information
- To provide our services: drafting, translating, and producing articles, news releases, podcasts, representative videos, and social posts; routing them for approval; and publishing or sending only what the client approved.
- To pitch approved stories to journalists and outlets, and to send story alerts and press updates to client staff who asked for them.
- To keep approval records and click-wrap signature records.
- To verify clients and their authorized signers, and to send from verified senders on authenticated domains.
- To communicate with clients and prospects, and to bill and collect fees.
- To secure the Site, prevent fraud and misuse, and fix problems.
- To meet legal obligations and enforce our agreements.
We do not use personal information for targeted advertising, and we do not use one client’s content to promote anyone else without permission.
4. AI tools
We use AI services to draft and translate text and to create representative video and AI voice. Client content and approved scripts are sent to these providers only to make that client’s deliverables. Avatar video is produced with our avatar-video provider.
5. Who we share information with
We do not sell personal information. We share it only as follows.
Service providers, under contracts that limit their use of the information to serving us: the website platform, the database, AI text tools, the avatar-video provider, email delivery, and the payment processor. They process information only to run the service they provide to us.
Bot protection. When you create an account, our signup form uses Cloudflare Turnstile to check that the request comes from a person. Cloudflare receives your IP address, browser information, and a challenge token for that check. We do not use this check for advertising.
Our clients. Approval records, reports, and deliverables go to the client they belong to.
Journalists and outlets. When a client approves a pitch or news release, we send it to the media contacts chosen for it.
Platforms the client tells us to use. Approved content goes out through the client’s own accounts (for example its social accounts, YouTube channel, website, or business listing profiles). Those platforms’ privacy policies apply.
Legal and business reasons. To comply with law or legal process; to protect rights, safety, and property; or as part of a merger, financing, or sale of our business, in which case this policy continues to apply.
6. Cookies and similar tools
aiprdesk.com does not use advertising cookies, tracking pixels, or analytics cookies. We use browser storage for your language choice and for drafts kept on your device. When you create an account, we set an HttpOnly session cookie so you stay signed in. If we add analytics later, we will update this policy first and, where required, ask for your consent.
Referral cookie. If you open a partner link such as aiprdesk.com/c/name, we set one HttpOnly referral cookie for up to 90 days so a later signup can be credited to that link. Some partner links, such as aiprdesk.com/c/name, show a short page with the partner's desk name and a note that the partner earns a commission. Other partner links go straight to the home page. The first link you open is the one we keep. The email address used at signup does not, by itself, assign that credit. This cookie is not an advertising cookie or an analytics cookie.
Device cookie. When you submit the signup form, AI PR Desk (aiprdesk) sets a first-party cookie named aiprdesk_device. It holds a random identifier for that browser. We use it only to limit repeated signup attempts and prevent abuse, so people who share one network are not treated as one person. We do not use it for advertising or analytics. The cookie expires after 24 hours, and you can delete it sooner in your browser. On our servers, rate-limit records hold only a keyed one-way hash of this identifier, of your IP address and, for card setup, of your account ID, with the time of each attempt. We delete those records within 25 hours.
7. How long we keep information
| Information | How long |
|---|---|
| Approval records | For the life of the client relationship and for the further period stated in the executed agreement |
| Click-wrap signature records | For the life of the client relationship and for the further period stated in the executed agreement |
| Client content and deliverables | For the life of the relationship. After it ends, deleted or returned within the period stated in the executed agreement. Routine backups expire on their normal cycle. |
| Custom-representative likeness data | Until consent is withdrawn or the client relationship ends, whichever is first, then deleted from our systems. We also ask the avatar-video provider to delete it. |
| Client-provided contact lists | Until the client asks us to delete them or the relationship ends. Opt-outs are kept so we can honor them. |
| Media List unlocked contacts | Contacts are kept 24 months from unlock and removed on request |
| Other media contact records | While the entry is accurate and useful, and removed on request |
| Website technical logs | For the period the website platform keeps them to deliver and secure the Site |
| Patient information sent by mistake | Deleted promptly |
| Rate-limit records (hashed device ID, IP address, account ID) | Up to 25 hours |
8. Security
We use reasonable administrative, technical, and physical safeguards, including access controls, encryption in transit, and keeping credentials out of public code. No system is perfectly secure. If a breach affects your personal information, we will notify you as the law requires (in Florida, generally within 30 days under Fla. Stat. 501.171).
9. Opting out of our emails
If you get a pitch, alert, or update from us, you can unsubscribe with the link in the message, where that message has one, or through the contact form. We honor email opt-outs within 10 business days.
10. Your privacy rights
Depending on where you live, you may have the right to know what personal information we hold about you, get a copy, correct it, delete it, and opt out of its sale, sharing for targeted advertising, or certain profiling. We don’t sell or share personal information for targeted advertising and don’t profile people in ways that have legal effects.
To make a request, use the contact form and ask for a privacy request. We will verify your request and answer within the time the law requires (usually 45 days). You may use an authorized agent where the law allows. We will not treat you differently for using your rights. If we deny your request, you can appeal by replying through the contact form.
If your information came to us from a client (for example, a contact list), we may pass your request to that client, which decides how to handle it.
Data deletion
To ask us to delete personal information, use the contact form and choose data deletion, or write that request in the message. We verify the request and delete the information the law requires us to delete. Approval records that the executed agreement says we must keep are kept for that period and then deleted. If you connected a social account, you can also remove aiprdesk in that service’s own app settings, and you can ask us to delete what we still hold by using the same form.
California residents (CCPA/CPRA)
In the past 12 months we have collected these categories of personal information, where you or a client gave them to us: identifiers (name, email, IP address); online identifiers (a random device identifier); professional or employment information (title, employer, beat); commercial information (plans purchased); internet activity (basic request logs); audio and visual information (staff likeness and voice samples, with consent). We collect them from you, from our clients, and from public professional sources, for the purposes in Section 3, and we disclose them only to the recipients in Section 5. We do not sell or share personal information, and we have no actual knowledge of selling or sharing information of anyone under 16. We use login credentials only to run the account, not to infer characteristics about you. Retention is described in Section 7. California residents also have the rights described above, including to limit use of sensitive personal information where it applies. To opt out of sale or sharing, use the contact form. We do not sell or share, so there is nothing to opt out of beyond that request.
Florida residents
- We honor the access, correction, and deletion rights in this section for Florida residents.
- Data breach notice. We follow the Florida Information Protection Act (Fla. Stat. 501.171).
- Texts and calls. We do not send promotional texts. Customer-care texts go only to a person who opted in on the text updates page, and only with the consent required by the federal TCPA and the Florida Telephone Solicitation Act (Fla. Stat. 501.059).
Other U.S. states
If you live in another state with a privacy law (for example Colorado, Connecticut, Texas, or Virginia), you may have similar rights. Use the same request process.
11. Health information
We never handle PHI or patient data. We do not want or need anyone’s health information, and clients must not submit it. We are not a “covered entity” under HIPAA, and our standard services do not make us a “business associate.” Questions about a Business Associate Agreement go through the contact form. See the HIPAA & Data FAQ. This page does not promise a Business Associate Agreement and does not refuse one.
12. Visitors outside the United States
aiprdesk is based in the United States and serves U.S. organizations. If you contact us from elsewhere, your information is processed in the United States.
13. Other languages
This policy is provided in the languages linked at the top of this page. Content for a client is provided in the languages of the client’s plan. If the versions differ, the English version controls.
14. Changes
We will post updates here and change the “Last updated” date. For material changes, we will notify clients by a message or in the portal.
Text messages
aiprdesk may send customer-care text messages about a desk, stories, and calls. A phone number is collected only on the text updates page, and only when that person checks the optional consent box. Message frequency varies. Message and data rates may apply. Reply HELP for help and STOP to opt out. Consent is not a condition of purchase. Support is on the contact page.
Mobile information will not be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties.
These messages are customer care for aiprdesk clients and callers who opted in. They are not promotional messages. We do not send protected health information by text.
15. Contact
aiprdesk · AIPRDESK LLC · contact form