This Privacy Policy explains what information ADA Surgical, Inc. ("we," "us," or "our") — as manufacturer and IP holder for G-Stirrups® — collects through gstirrup.com, why we collect it, and how to contact us about it. Worldwide sale and marketing is conducted under the authority of ADA Surgical.
1. What this policy covers
This policy describes our practices for:
- The gstirrup.com website (this site).
- Email, phone, and other communications you send to us.
- Form submissions (fit review, contact, newsletter signup).
- Interactions with the G-Stirrups® Ready Room platform (launching 1/1/2027).
2. Information we collect
a. Information you provide directly
- Fit-review form submissions: business name, professional name + title, business email, business phone (optional), city, state, table manufacturer + model, extension type (optional), room count (optional), and free-form message. We do not request patient information, diagnosis, treatment details, or any medical history.
- Contact form submissions: name, email, organization (optional), and your free-form message.
- Email communications: when you email support@gstirrup.com or use a form, we retain the message thread for support continuity.
b. Information from your usage
- Standard web analytics (Google Analytics 4): pages visited, browser type, approximate geographic region, referrer.
- Server logs: IP address, request path, response status, user agent, Cloudflare ray ID. Retained for abuse detection and operational diagnostics.
3. How we use your information
We use the information we collect to:
- Respond to your fit-review and contact requests (primary business purpose).
- Verify compatibility of your equipment request against the released IFU.
- Send transactional emails (fit-review responses, order confirmations, shipping notifications) at the address you provided.
- Maintain an internal sales pipeline and audit trail.
- Detect and prevent fraud, abuse, and security incidents.
- Improve the site through aggregated analytics.
- Comply with applicable tax, regulatory, and legal obligations.
4. What we do NOT do
- We do not sell your information to third parties.
- We do not share your information with marketing companies, ad networks, or data brokers.
- We do not use remarketing cookies or cross-site behavioral tracking on this site.
- We do not collect Protected Health Information (PHI) through this site. See §5.
5. HIPAA and PHI: why we don't need a BAA
ADA Surgical, Inc. does not store, process, or transmit Protected Health Information (PHI) as defined under HIPAA. We collect business-side inquiry data from healthcare purchasers (procurement, biomed, surgeons sourcing equipment) — not patient health information.
What we collect is NOT PHI:
- Business contact information (name, work email, work phone)
- Organization details (facility name, service line)
- Equipment specifications being sourced (model, configuration, quantity)
- Purchase intent (quote request, lead time inquiry)
What is PHI under HIPAA? "Individually identifiable health information" about patients — diagnoses, treatment plans, lab results, insurance claims for specific patients. We don't have any of that, and we don't want any of that.
Why no BAA is needed: Under HIPAA, a Business Associate Agreement is required when a vendor touches PHI on behalf of a covered entity. We don't touch PHI. Our service operates entirely on business inquiry data from healthcare purchasers. We are not a Business Associate of any covered entity.
6. How we protect your data
- Encryption in transit: TLS 1.3 for all HTTP traffic (HSTS enforced).
- Encryption at rest: data stored in our backend systems is encrypted at rest by our infrastructure providers.
- Access control: access to inquiry data is limited to authorized personnel on a need-to-know basis.
- Form sanitization: inquiry form fields are validated and sanitized server-side to prevent XSS or injection attacks.
- Audit trail: form submissions are timestamped and preserved for sales, support, and tax/audit purposes.
7. Data retention
- Fit-review records: retained for the duration of our business relationship plus 7 years for tax and audit purposes.
- Email threads: retained per standard business email retention policy.
- Server logs: typically 30 days, retained longer only when needed for security investigations.
- Analytics data (Google Analytics 4): retained per Google's default retention settings (14 months for user-level data; we have IP anonymization enabled).
- You may request deletion of your inquiry data at any time (see §8). We honor deletion requests within 30 days, except where retention is required by law.
8. Your rights and choices
You have the right to:
- Access: request a copy of the inquiry data we hold about you.
- Correct: update or correct your contact information.
- Delete: request deletion of your inquiry data (subject to tax/audit retention requirements).
- Opt out of analytics: use your browser's privacy settings or the Google Analytics Opt-out Browser Add-on to prevent analytics tracking.
9. Third-party services we use
- Cloudflare Pages: website hosting and edge network. Privacy policy.
- Google Analytics 4: website analytics. Privacy policy. We have IP anonymization enabled.
- Resend: transactional email. Privacy policy.
- Stripe: payment processing (when checkout is active). Privacy policy.
- Apollo.io: lead enrichment for outbound outreach. Privacy policy.
10. International data transfers
ADA Surgical, Inc. is operated from the United States. If you are accessing this site from outside the US, please be aware that your information will be transferred to, stored, and processed in the United States. By using this site, you consent to the transfer of your information to the US.
For EU/UK users: We comply with GDPR data subject rights (access, rectification, erasure, restriction, portability) and use standard contractual clauses for international transfers.
For Canada: We comply with CASL (Canada's Anti-Spam Legislation) and PIPEDA. Express consent is obtained before any marketing email.
11. Children's privacy
This site is not directed to individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected such information, we will delete it.
12. Changes to this policy
We may update this Privacy Policy from time to time. If we make material changes, we will update the "Effective" date at the top of this page. Your continued use of the site after the effective date constitutes acceptance of the updated policy.
13. Contact us
For privacy-related questions, data access requests, or to file a complaint:
Traves Brady — CEO/President, ADA Surgical, Inc. (FL Corporation)
Email: traves.brady@gstirrup.com — privacy, data access requests, and executive inquiries
Main line — general, order, and support inquiries
Phone: 844-787-7305 — rings our clinical and order team
Larry Razanno — Owner, Clinical & Fit Review
Phone: (336) 300-5622 — fit review, compatibility, and clinical use
This Privacy Policy was drafted with the assistance of automated tools and has not been reviewed by a licensed attorney. Before relying on this policy in any legal dispute, please consult with a qualified attorney in your jurisdiction.