Privacy Policy
Phoenix Compliance Shop, a d/b/a of Phoenix Laboratory Consulting, LLC
Effective 31 July 2026 · Version 1.0
1. Who controls your data
Phoenix Laboratory Consulting, LLC, a Kentucky limited liability company, trading as Phoenix Compliance Shop ("Phoenix," "we," "us"), is the data controller for the information described in Section 3.
Contact for any privacy question or request: bronwynr@phoenixlabconsulting.com.
2. Purchases are handled by FastSpring, and this matters for your data
We sell through FastSpring, which acts as our authorized reseller and Merchant of Record. When you buy from us:
- FastSpring collects and controls your payment and billing data — payment card details, billing address, and tax identifiers. FastSpring is an independent controller of that data under its own privacy policy. We never see or store your payment card details.
- We receive only limited order data from FastSpring: your name, email address, country, order reference, product purchased, and order value. That is what we use to fulfil the order, verify a license, and respond to you.
FastSpring's privacy notice governs the data it collects directly. Please read it at fastspring.com.
3. What we collect
| What | When | Why |
|---|---|---|
| Name, work email, organization, role, permit status, and any free text you enter | You request the preview asset or submit an intake or contact form | To send you the requested material and respond to your enquiry |
| Name, email, country, order reference, product, order value | You purchase a product | To fulfil the order, verify license scope, and provide order support |
| Email content and attachments | You email us | To respond to you |
| Usage data — pages viewed, referring site, approximate region, device and browser type | You visit our sites | To understand which pages are used and to improve them |
We do not require an account, and we do not ask for information we do not need.
4. Please do not send us protected health information
Our customers work in clinical laboratories. Do not send us patient data, specimen-level data, protected health information, or any personally identifiable clinical record in an email, form, or attachment.
We are not a HIPAA business associate to you, we have no agreement permitting us to receive PHI, and we do not want it. If you need to discuss a real case, de-identify it first. If you send us PHI unsolicited, we will delete it and ask you to resend without it.
5. Cookies and analytics
We use Google Analytics 4 to measure site usage. It sets cookies and processes usage data on our behalf. IP addresses are handled by Google's anonymization behaviour for GA4.
FastSpring sets cookies necessary to operate the checkout when you begin a purchase.
We run no advertising cookies, no retargeting pixels, and no cross-site tracking for advertising purposes.
You can block or delete cookies in your browser, and you can opt out of Google Analytics using Google's browser add-on at tools.google.com/dlpage/gaoptout. Blocking analytics cookies does not affect your ability to use the site or make a purchase.
6. Service providers we use
We keep this list current because a named list is more useful than a vague one.
| Provider | Role |
|---|---|
| FastSpring | Merchant of Record, checkout, payment, tax, invoicing, file delivery |
| Google Analytics 4 | Site usage analytics |
| Cognito Forms | Intake, contact, and preview-request forms |
| GitHub Pages | Website hosting |
| Cloudflare | DNS |
| Google Workspace | Email and document storage |
Each processes data on our behalf or, in FastSpring's case, as an independent controller for transaction data.
7. We do not sell or share your personal information
We do not sell your personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined under California law. We do not disclose your information to third parties except to the service providers listed above, or where required by law.
8. How long we keep it
- Order records: seven years, for tax and accounting purposes.
- Preview requests and enquiry correspondence: up to three years from last contact, then deleted.
- Analytics data: per Google Analytics 4 retention settings.
You can ask us to delete your data earlier — see Section 9.
9. Your rights
If you are in the EU, EEA, or UK, you have the right to access, correct, delete, restrict, or object to our processing of your personal data, and the right to data portability. Our legal bases are: performance of a contract (order fulfilment), legitimate interests (responding to enquiries, understanding site usage, securing our systems), consent (where you asked for the preview or other material), and legal obligation (tax records). Where we rely on consent you may withdraw it at any time. You may also complain to your local supervisory authority.
If you are a California resident, you have the right to know what personal information we collect and how we use it, to request deletion or correction, to request a portable copy, and not to be discriminated against for exercising these rights. As stated in Section 7, we do not sell or share personal information.
To exercise any right, email bronwynr@phoenixlabconsulting.com. We will respond within 30 days. We may need to verify your identity, usually by confirming the email address on file.
10. International transfers
We are based in the United States, and our service providers are primarily US-based. If you contact or buy from us from outside the US, your information will be transferred to and processed in the United States. Where transfers of EU, EEA, or UK personal data are involved, our providers rely on Standard Contractual Clauses or equivalent safeguards.
11. Security
We use reputable providers, multi-factor authentication on our accounts, and encrypted connections. Payment card data never reaches our systems. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
12. Children
Our sites and products are for laboratory and business professionals. They are not directed to anyone under 18, and we do not knowingly collect personal information from children.
13. Changes
We may update this policy. The effective date and version above will change, and material changes will be described here. Please review it from time to time.
14. Contact
Phoenix Laboratory Consulting, LLC d/b/a Phoenix Compliance Shop bronwynr@phoenixlabconsulting.com phoenixlabconsulting.com · phoenixcomplianceshop.com