Privacy Policy

Effective and last updated: September 16, 2026

Overview

Donica Consulting LLC is a health tech consulting business based in Roseville, California, operating at donicaconsulting.com. This policy explains what information we collect through our website, our Shopify store, and our consulting engagements, and how we handle it.

We’ve written this policy in plain language, informed by core principles from the California Consumer Privacy Act (CCPA/CPRA), the EU General Data Protection Regulation (GDPR), and similar laws. We design our privacy practices around these core data protection principles, while the specific statutory rights that apply to you depend on your location. If a term in this policy conflicts with a right you have under your local law, your local law takes precedence.

Information We Collect

Website analytics

We use Plausible Analytics (opens in a new tab) to understand how visitors use this site — things like page views and referral sources. Plausible does not use cookies and does not collect personal data: no names, no email addresses, no IP addresses, and no device fingerprints are stored. All figures we see are anonymous and aggregated across all visitors, so no individual visitor can be identified. You can read more in Plausible’s data policy (opens in a new tab).

Information you give us directly

If you use our contact form, book a call, or email us, we receive whatever you provide — typically your name, email address, phone number, company, and the content of your message. We use this only to respond to you and, if it leads to an engagement, to scope and deliver that work. We don’t add you to a marketing list or share this information with third parties for their own marketing. This contact form is not HIPAA-compliant — please don’t submit Protected Health Information (PHI) through it.

Purchases through our Shopify store

Our digital products (such as the Market Sizing Data guide) are sold through our Shopify store (opens in a new tab). Checkout, payment processing, and order records are handled entirely by Shopify — we never see or store your full payment card details. Shopify collects and processes information (such as your name, email, and billing details) as an independent controller under its own privacy policy, available at shopify.com/legal/privacy (opens in a new tab). We view your order details within Shopify’s vendor portal so that we can deliver your purchase and provide support.

Other service providers

Beyond Plausible and Shopify, we use a small number of other providers to run this site and communicate with you: Netlify for website hosting, Formspree to process contact-form submissions, Elfsight to embed our LinkedIn feed on the Insights page, and Google Calendar and Gmail for scheduling and correspondence. Each processes information only as needed to provide that service to us, under its own privacy and security practices, and none of them are used to build advertising profiles or sell your information.

Client Engagement Data

When you engage Donica Consulting LLC for advisory, fractional leadership, or analysis work, you may share business, operational, or clinical information with us as part of that engagement. We treat this information as strictly confidential to the engagement it was shared for. Some engagements may involve Protected Health Information (PHI) as defined under HIPAA; handling of PHI is governed by your separate consulting agreement or a Business Associate Agreement (BAA), not by this general policy, and is subject to the safeguards set out there.

• Information shared by one client is not disclosed to another client or used to benefit a different engagement, except as required by law or as explicitly set forth in your consulting agreement.
• We use engagement data only to perform the work you’ve engaged us for, and share it only with subcontractors or tools that are bound by confidentiality obligations and only where needed to deliver that work.
• Any conflict-of-interest review we perform before or during an engagement is conducted separately from other client relationships, and any information shared as part of that review is limited to what the review requires and remains subject to our confidentiality obligations.

Specific confidentiality terms for your engagement — including any PHI/BAA terms — are set out in your consulting agreement, which takes precedence over this general policy for that engagement.

How We Use Information

In short: to respond to inquiries, deliver purchased products, perform consulting engagements, keep the site running securely, and meet our legal and accounting obligations. We do not sell personal information, and we do not use it to build advertising profiles.

Data Retention

We retain contact form/inquiry data, client engagement records, deliverables, and related correspondence for the duration of our relationship and up to seven years after the conclusion of any engagement, to satisfy legal, tax, professional recordkeeping, and contract enforcement obligations. After this period, these records are securely deleted or anonymized, unless a longer retention period is required by applicable law or your specific consulting agreement or BAA. Any Protected Health Information (PHI) is retained and disposed of under the terms of the applicable Business Associate Agreement (BAA), not this general schedule.

Shopify order and payment records are retained by Shopify per its own retention practices and as required by applicable tax and accounting law — typically several years.

Cookies & Tracking

We do not use tracking cookies or other non-essential cookies on this site. Some pages embed third-party widgets — such as the Elfsight LinkedIn feed on our Insights page — that run in your browser and may set their own cookies or local storage under their own privacy policies, not ours. Other third-party services we link to, primarily Shopify at checkout, may similarly set their own strictly necessary cookies to process your order securely.

Your Privacy Rights

The rights below concern personal information we hold about you as an individual — for example, as a website visitor or a Shopify customer. They don’t extend to the confidential business or clinical information a client shares with us as part of an engagement; that information is governed separately, as described under Client Engagement Data above.

California residents (CCPA/CPRA)

You have the right to know what personal information we hold about you, request its deletion, request correction of inaccurate information, and opt out of the sale or sharing of personal information. We don’t sell or share personal information, so there’s nothing to opt out of. We do not collect or process Sensitive Personal Information through this website to infer characteristics about you. We won’t discriminate against you for exercising any of these rights.

EU, UK, Brazil, India, and other residents (GDPR, LGPD, DPDP, and similar laws)

Where the GDPR, Brazil’s LGPD, India’s DPDP Act, or a similar law applies, our lawful basis for processing is typically your consent (contact form submissions), performance of a contract (engagements and purchases), or our legitimate interest in running and securing this website. You have the right to access, correct, delete, restrict, or port your personal data, and to object to our processing of it. If you believe we haven’t handled your data properly, you also have the right to lodge a complaint with your country’s data protection authority.

Exercising your rights

To make any request above, contact us using the details below. We’ll respond within the timeframe required by applicable law — generally within 45 days for California requests, and whatever shorter or longer window your local law sets for other requests — and may need to verify your identity first.

Data Security

We take reasonable technical and organizational measures to protect information we hold, including relying on well-established, reputable providers (Plausible, Shopify) rather than building our own data infrastructure. No method of transmission or storage is 100% secure, so we can’t guarantee absolute security. If a breach affecting your personal information ever occurs, we’ll notify you and the relevant authorities as required by applicable law.

Children’s Privacy

This site and our services are intended for business professionals and are not directed to children. We do not knowingly collect personal information from anyone under 16.

International Visitors

We’re based in the United States, and information we receive directly (such as contact form submissions) is processed here. Where you use Shopify to make a purchase, Shopify may process and transfer information internationally under its own safeguards, as described in its privacy policy. Where personal data from the EU, UK, or a similar jurisdiction is transferred to and processed in the United States, we and our service providers rely on legally recognized transfer safeguards, such as Standard Contractual Clauses incorporated into those providers’ own agreements.

Links to Other Sites

This site links to third-party sites we don’t control — including our Shopify store, LinkedIn, and Bluesky. Those sites have their own privacy policies, and we aren’t responsible for their content or practices.

Changes to This Policy

We may update this policy as our services or applicable law change. The “last updated” date at the top of this page reflects the most recent revision. Material changes will be reflected here before they take effect.

Contact Us