Privacy at Harborline

Last updated: October 20, 2026

Harborline helps outpatient medical practices with security and HIPAA compliance. This page explains what information our website collects, why, who helps us handle it, and how to reach us about it.

Who we are: This site is run by SecurityBlox LLC, doing business as Harborline, based in Boise, Idaho.

Please do not send patient information

This website is not built for patient health information. Please do not enter patient names, dates of birth, chart details, or any other protected health information (PHI) in our forms or in the chat box.

Our phone line is for sales and scheduling only. Please do not share patient information by phone.

When we work with a client's PHI, we do it under a signed Business Associate Agreement and outside this website.

What our forms collect and why

Today the site has two download forms. One is for the insurance renewal checklist. The other is for the first 72 hours checklist, for practices that get a letter from the Office for Civil Rights (OCR).

Each form asks for:

Your name (required)
Your work email (required)
Your organization (optional)
On the insurance renewal page only: when your policy renews (optional)
Whether you ticked the newsletter box (optional, unticked unless you tick it)

We also have a contact form. It asks for your name, your email, what your message is about, and your message. We use it only to answer you.

When you submit, the form also sends:

The page you were on
Campaign tags in the link you followed, if there were any (for example, which email or ad brought you)
The date and time

We use this to give you what you asked for, to answer you if you contact us, and to see which pages and links are useful. We do not send you sales emails because you downloaded a checklist. We only add you to our newsletter if you tick the newsletter box.

What happens after you submit a form

For the download forms, the checklist opens right away on the page.

A service called FormSubmit sends the details you typed to our business email. We keep a record of each request in our own files. The website itself does not store your entry in a database.

For the download forms, your browser also keeps a copy of your entry on your own device, as a backup in case the form fails. We cannot see that copy. You can remove it by clearing your browser's site data for harborlinesec.com.

The site does not send an automatic email after a download. It does not add you to any mailing list unless you tick the newsletter box.

The Harborline newsletter is optional. You join only if you tick the newsletter box on a download form, or ask us to add you. Leaving the box unticked means you will not get the newsletter.

What we collect. Your name, your work email, the date you signed up, and the page you signed up on. When we send a newsletter, our email service also records whether the email was delivered, opened, or clicked, so we can see which topics are useful.

Why. To send you short updates on HIPAA security for outpatient practices, new free tools, and guides from the Harborline team. We do not use your newsletter details for anything else, and we never sell or rent them.

Who sends it. We use Brevo, an email service, to store the newsletter list and send the emails. Brevo handles this information for us under its own privacy policy. Our newsletter list is kept separate and is not shared with other companies.

How to unsubscribe. Every newsletter email has an unsubscribe link at the bottom. One click removes you. You can also use our contact form. We act on requests within 10 business days, and usually right away.

How long we keep it. We keep your newsletter details while you are subscribed. If you unsubscribe, we keep only your email address on a do-not-send list, so you are never added back by mistake, and we delete the rest within 30 days. If we have not sent a newsletter for 2 years, we delete the list.

Please do not reply to a newsletter with patient information.

Booking a call

The "Book a call" links take you to Calendly, a scheduling service. You pick a time and enter your details on Calendly's site. Calendly handles that information under its own privacy policy. We receive your booking details so we can hold the call.

Chat

Our pages show a chat box from a service called Crisp. It opens by itself once per visit. If you type a message, it goes to Crisp and then to us. Please do not share patient information in chat. We delete chats within 12 months, or sooner if you ask.

Analytics and cookies

We use a few tools to run the site and to understand how it is used. In plain words:

Google Analytics. This counts visits and pages. It sets two cookies, named _ga and _ga_ followed by our account ID. It also records when someone clicks a "Book a call" link, completes a download form, sends a question through the contact form, or clicks to download or print a checklist. It does not receive your name, email, organization, or anything you write. Privacy requests sent through the contact form are not counted. Today, Google's ad features are turned off, including Google Signals, ad personalization, and ad storage. If we ever turn on ad features, we will update this page first.
Campaign tags. If you arrive from a link with campaign tags, the site remembers them during your visit. That way we know which email or post was useful.
Website hosting. Our hosting provider, Lovable, runs the site and counts basic visits. It sets a cookie (__dpl) to serve the right version of the site.
Security. Cloudflare sits in front of the site for security. It may set a cookie (__cf_bm) to tell people apart from automated bots.
Fonts. Our fonts load from Google Fonts. To show them, your browser connects to Google.

We do not use advertising pixels or retargeting cookies on harborlinesec.com. You can block or delete cookies in your browser settings. The pages and checklists will still work.

We do not sell or rent your information

We do not sell or rent your personal information to anyone. We also do not share it so other companies can show you ads on other websites.

Who we share information with

We share information only with the service providers that help us run the site and respond to you:

FormSubmit, to deliver form entries to our email
Calendly, to schedule calls
Crisp, to run the chat box
Brevo, to send the newsletter to people who sign up
Google, for Google Analytics, Google Fonts, and our business email (Google Workspace)
Lovable, to host the website
Cloudflare, to protect the website

We share information with courts, police, or government agencies only when the law requires it.

If Harborline is sold or merges with another company, your information may move to the new owner, and this page, or a newer version we post, would still cover it.

How long we keep information

We keep information only as long as we need it:

Form entries. FormSubmit keeps a copy for 30 days. We keep the email and our own record for up to 2 years after we last hear from you, then delete them. If you become a client, we keep what our contract requires.
Newsletter. Kept while you are subscribed. After you unsubscribe, only your email stays on a do-not-send list, as described above.
Bookings. Calendly keeps booking details under its own privacy policy, and we can delete them from our account. We delete them on the same 2 year schedule, or sooner if you ask.
Chat. We delete chats within 12 months, as described above.
Analytics. We set Google Analytics to delete visit data tied to your browser after 2 months. Summary reports that do not identify you may be kept longer.
Security cookie. The Cloudflare cookie expires after 30 minutes without activity.
The copy in your browser. It stays on your device until you clear your browser's site data.

We may keep something longer if the law requires it.

Your choices

Stop hearing from us. Reply to any email with "unsubscribe," or use our contact form. We act on requests within 10 business days.
Ask what we have. We will tell you what information we hold about you.
Fix or delete it. Ask us to correct or delete your information. We will do it unless the law requires us to keep it.

To make any of these requests, use our contact form.

Anyone can make these requests, no matter where you live. We will reply within 30 days. We may ask you to confirm your email address first, so we know the request is really from you.

Children

This site is for adults who work in or with medical practices. It is not meant for anyone under 16. We do not knowingly collect information from anyone under 16. If you think a child has sent us information, contact us and we will delete it.

Changes to this page

If we change this page, we will update the "Last updated" date at the top.

Contact us

Questions about this page or your information? Use our contact form.

Harborline, Boise, Idaho