Effective 06/01/2026- Replaces all previous versions
The short version. This website collects only what you type into our contact form or place in an order — nothing more. We do not sell your information. This website is not a channel for patient data: please do not submit Protected Health Information (PHI) through this site. Any PHI we handle on behalf of a client practice is governed by a signed Business Associate Agreement, not by this policy — see Section 8.
This policy explains how Archer & Clay, LLC, a Pennsylvania limited liability company ("Archer & Clay," "we," "us"), collects and uses personal information through archerclay.com (the "Site"). Archer & Clay is the party responsible for that information.
This policy covers this Site only. It does not cover any third-party site you reach by following a link from here, and it does not cover PHI we process for a client under a Business Associate Agreement — see Section 8.
Archer & Clay handles two entirely separate categories of information, under two separate legal frameworks. We state the difference plainly because confusing the two is the most common misunderstanding of a medical billing company's privacy practices:
| Website personal information | Client protected health information (PHI) |
|---|---|
| Contact details you type into a form on this Site, or provide when placing an order | Patient data we process while performing billing, coding, credentialing, or related services for a contracted practice |
| Governed by this policy | Governed by HIPAA and a signed Business Associate Agreement, not this policy |
| Collected directly from you, the visitor or customer | Received from the contracted practice, never through this website |
| Rights described in Section 12 | Exercised through your own healthcare provider |
If you are a patient looking for your own medical or billing records, we cannot assist you directly — please contact your healthcare provider, who holds your record and controls your HIPAA rights.
Information you give us directly. Our contact form asks for your Full Name, Phone number, Email address, and an optional message describing your inquiry. If you place an order through our Products page (forms, envelopes, or software), we collect the name, billing and shipping address, email, and phone number needed to fulfill and invoice that order.
Payment information. When you check out on our Products page, your card details are entered directly into our payment processor's secure fields and are transmitted to and stored by that processor, not by us. See Section 10.
Information collected automatically. Our hosting and security providers automatically log standard technical information for every visit — IP address, browser type, pages requested, and timestamps — for security and site-operation purposes. We currently do not run Google Analytics, advertising pixels, or any behavioral tracking on this Site.
Cookies. WooCommerce sets functional cookies needed to operate your shopping cart and checkout session. Cloudflare, our content delivery and security provider, sets a security cookie used to distinguish legitimate visitors from automated traffic. Neither is used for advertising or cross-site tracking. See Section 7.
We do not collect patient information through this website. No form on this Site asks for it, and none is designed to accept it. Please do not enter a patient's name, date of birth, medical record number, diagnosis, or any other health information into our contact form or any other field on this Site. If any is submitted anyway, we will delete it as soon as we reasonably identify it.
We also do not knowingly collect Social Security numbers, government identifiers, or precise geolocation through this Site.
| Purpose | Information used |
|---|---|
| Respond to your inquiry and provide the information you requested | Name, email, phone, message |
| Process, ship, and invoice an order placed on our Products page | Name, contact and shipping details, order contents |
| Operate, secure, and maintain the Site; prevent abuse | IP address, technical logs |
| Meet legal, tax, and accounting obligations | Whatever the obligation requires |
We do not use your information for automated decision-making with a legal or similarly significant effect on you, and we do not build advertising profiles.
The following providers process information on our behalf, solely to perform their service for us:
| Provider | What it does | What it receives |
|---|---|---|
| GoDaddy e-COMMERCE | Hosts this website | Standard technical/server logs |
| Cloudflare | Content delivery and security (bot/spam protection) | IP address, request metadata |
| WooCommerce | Processes online orders and payments | Order details; card information is handled directly by the payment processor |
We do not authorize any provider to sell your information or use it for their own marketing.
This Site uses only functional cookies required for shopping cart and checkout functionality (via WooCommerce) and basic security/bot filtering (via Cloudflare). We do not currently run any advertising, retargeting, or analytics cookies. You can block or clear cookies in your browser at any time; doing so may prevent the shopping cart from functioning correctly but will not prevent you from browsing the Site or using the contact form.
As a medical billing and practice management service, Archer & Clay acts as a Business Associate under HIPAA when performing billing, coding, credentialing, or related services on behalf of a contracted medical or dental practice (a "Covered Entity"). We require a signed Business Associate Agreement, satisfying 45 CFR § 164.504(e), before receiving, using, or disclosing any PHI on a client's behalf. That agreement — not this policy — governs the permitted uses, required safeguards, subcontractor obligations, and breach-notification duties for that PHI.
Should a breach of unsecured PHI occur, we will notify the affected Covered Entity without unreasonable delay and in no case later than 60 calendar days after discovery, as required by 45 CFR § 164.410.
This website itself neither collects, transmits, nor stores PHI.
We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We disclose information only to the service providers listed in Section 6, solely so they can perform their function for us, and to comply with law, protect our legal rights, or in connection with a merger, acquisition, or sale of assets (in which case the recipient remains bound by this policy for information transferred).
Orders placed through our Products page are processed through Wo-Commerce. Card numbers and security codes are entered directly with that processor and are not received, processed, or stored on our servers. We retain only what is needed for accounting purposes — the order amount, date, and an invoice reference.
| Category | Retention |
|---|---|
| Contact form inquiries that do not become a client relationship | Kept for a reasonable follow-up period, then deleted |
| Client and order records | Kept for the duration of the relationship and as long afterward as tax, accounting, and legal retention requirements require |
| Server and security logs | Kept for the period set by our hosting and security providers |
We may retain information longer where a legal obligation or an actual or anticipated legal claim requires it.
Regardless of where you live, you may ask us to:
Access the personal information we hold about you and how we use it.
Correct inaccurate information.
Delete your information, subject to legal retention requirements.
Opt out of marketing communications at any time.
These rights apply to website personal information only; they do not extend to PHI we hold for a client — a patient exercises HIPAA rights through their own provider (Section 2).
Email priority@archerclay.com with the right you'd like to exercise and the email address or phone number you used with us, so we can locate your information. We will acknowledge your request within 10 business days and respond within 45 days.
We use HTTPS encryption for all traffic to and from this Site, and we rely on our hosting and security providers' safeguards to protect information in transit and at rest. No system can be guaranteed completely secure, and we encourage you to avoid submitting sensitive information — including PHI — through any web form
This Site is a business-to-business service and is not directed at children. We do not knowingly collect personal information from anyone under 18.
If a security incident compromises personal information, we will investigate, contain it, and notify affected individuals as required under the Pennsylvania Breach of Personal Information Notification Act (73 P.S. § 2301 et seq.) and, where applicable, the breach notification law of your own state. Where the compromised information is PHI, the HIPAA Breach Notification Rule applies as described in Section 8
We may update this policy from time to time. The effective date at the top will always reflect the current version. Where a change is material, we will post notice on this Site before it takes effect. Continued use of the Site after the effective date constitutes acceptance of the revised policy.
Questions about this policy or your personal information:
Archer & Clay, LLC
215-576-4282
email: priority@archerclay.com
