Privacy Policy, Data Practices & Client Confidentiality
Privacy is more than a cookie notice to me. It includes what this website collects, what it does not collect, how third-party technology may process routine visitor information, and how I treat information entrusted to me by a client, company, executive or individual.
Paper Boat Media is a consulting and advisory business. This website is primarily informational. It is not an ecommerce store, payment portal, financial transaction system, medical portal, client document repository or account platform.
Effective date: August 26, 2026 · Last updated: August 26, 2026
I separate what belongs in public from what belongs between a client and me.
A website, search engine, presentation or case study is a public environment. A strategy discussion, internal report, unreleased product, patient-related workflow, customer record, financial plan, board discussion or executive concern may be something very different.
I understand that distinction. I do not need a piece of paper to tell me that information entrusted in confidence should be treated as confidential. A nondisclosure agreement can formalize the obligation, and I am comfortable signing an appropriate NDA when a client wants one. My discretion does not begin only after the signature.
What this policy covers
What this policy applies to
This Privacy Policy applies to the public Paper Boat Media website at paperboatmedia.com and explains my general approach to website visitor information, inquiries and client confidentiality.
Separate contracts, statements of work, nondisclosure agreements, business associate agreements, data processing agreements, client information-security requirements or other written terms may apply to a particular engagement. When those terms impose a stricter obligation, the stricter engagement-specific obligation controls for that work.
This policy does not replace a client's own privacy notice, regulatory obligations or professional responsibilities.
The website is primarily informational, but some routine data can still be generated.
Information you choose to provide
If you contact me by email, phone, text message, contact form or another communication channel, you may provide information such as your name, company, email address, phone number and the content of your message.
Please do not submit medical records, patient information, Social Security numbers, account credentials, payment-card data, brokerage account information or other highly sensitive information through a general website form or ordinary unsolicited email.
Routine technical information
Web servers, security systems, analytics services and similar tools may process information such as IP address, approximate location, browser type, device type, operating system, referring page, pages viewed, timestamps, cookie identifiers and interaction events.
This technical information is generally used for website operation, security, troubleshooting, analytics and understanding how visitors use the site.
I intentionally keep the public website out of sensitive-data workflows.
- No ecommerce transactions: Paper Boat Media does not sell products or process purchases through this website.
- No website payment processing: I do not request or store credit-card, debit-card or bank-account information through this website.
- No customer financial accounts: This website is not a bank, brokerage, investment, insurance or trading platform and does not maintain financial customer accounts.
- No patient portal: This website is not designed to receive, maintain or transmit protected health information or medical records.
- No client document vault: I do not use the public website as a repository for confidential client strategies, internal records, proprietary files or regulated customer information.
- No public user accounts: The public site does not require visitors to create a consumer account in order to read its content.
Important distinction: saying that I do not intentionally store sensitive information in the website itself does not mean that absolutely no data exists anywhere. Hosting providers can maintain server logs, analytics providers can maintain usage data, and ordinary business correspondence may remain in email or other approved business systems for as long as reasonably necessary.
I use information for limited, ordinary business purposes.
- Operate, maintain and secure the website.
- Respond to inquiries and communicate with prospective or current clients.
- Understand website traffic, usability and content performance.
- Diagnose technical problems and prevent fraud, abuse or malicious activity.
- Maintain records reasonably necessary for business administration, legal obligations or an active engagement.
- Comply with law, regulation, court orders or valid governmental requests when required.
I do not use confidential client information simply because it would make an interesting marketing story. Public use of a client's name, logo, testimonial, result, internal data, case study or nonpublic engagement detail requires an appropriate basis, such as client permission, a contractual right or information that is already legitimately public.
Third-party measurement technology may collect routine website usage information.
Paper Boat Media currently uses or may use services such as Google Analytics, Google Site Kit, Google Tag Manager or related Google measurement technology, the Meta Pixel, website performance and security services, and other measurement or visibility tools.
These services can use cookies, pixels, tags, local storage or similar technologies to process information about website visits and interactions. Depending on the service and settings, this can include device and browser information, IP address, approximate geographic information, referral information, page views, events and advertising or measurement identifiers.
Google requires sites using Google Analytics to disclose the use of Analytics and how it collects and processes data. You can learn more from Google's page explaining how Google uses information from sites or apps that use its services.
I do not intentionally send names, email addresses, Social Security numbers, medical records or other directly identifying sensitive information to Google Analytics. Visitors should also avoid placing sensitive information in URLs or public website fields.
Some analytics or advertising technologies may be considered "sharing," "targeted advertising" or similar activity under certain privacy laws even when no money changes hands. Where applicable, visitors may have rights to limit those uses.
Confidentiality is part of the relationship, not merely a clause.
I regularly work around strategy, marketing plans, budgets, research, analytics, technology, executive decisions, organizational challenges, unreleased initiatives and other information that may be commercially or personally sensitive.
I treat information provided in confidence as confidential and use it for the purpose for which it was entrusted to me. I am comfortable working under an NDA when appropriate, and I will follow engagement-specific confidentiality requirements that are agreed in writing.
At the same time, professional discretion does not depend entirely on an NDA. I understand the difference between information intended for public consumption and information that belongs between a company, person, leadership team and me.
What I do not casually disclose
- Nonpublic strategy or financial discussions
- Internal performance or analytics data
- Unreleased products, campaigns or initiatives
- Board, executive or personnel discussions
- Customer, donor, patient, member or employee information entrusted through an engagement
- Credentials, passwords or security information
- Confidential research, trade secrets or proprietary methods belonging to a client
What may be discussed publicly
- Information the client has already made public
- Published campaigns, websites, reports or announcements
- Generalized professional lessons that do not identify or expose a client
- Case studies, testimonials or client names when permission or an applicable agreement allows them
- My own methods, opinions, experience and publicly available research
Some clients operate under rules that go far beyond an ordinary marketing engagement.
Depending on the client and the work, privacy, confidentiality, recordkeeping, communications and information-security requirements may arise under healthcare, financial-services, education, consumer-privacy, employment or other laws and regulatory frameworks.
Healthcare and HIPAA
HIPAA does not apply to every company or consultant. It applies to covered entities and, in defined circumstances, their business associates. If an engagement makes Paper Boat Media a business associate because the work requires creating, receiving, maintaining or transmitting protected health information on behalf of a covered entity or another business associate, the engagement should use an appropriate Business Associate Agreement and approved safeguards.
The public Paper Boat Media website is not intended to receive PHI. I do not ask visitors to submit patient records or protected health information through public forms, analytics systems or general website communications.
Financial services, FINRA, SEC and customer information
Broker-dealers, investment advisers and other regulated financial institutions may have obligations under FINRA rules, SEC Regulation S-P, the Gramm-Leach-Bliley Act and related requirements concerning customer information, supervision, recordkeeping and cybersecurity. When working with a regulated financial-services client, I work within the client's approved communication, data-handling, retention and supervisory requirements for the engagement.
This public website does not request or maintain brokerage credentials, account numbers, securities transaction instructions or nonpublic customer financial information.
Other privacy and communications requirements
Depending on the facts, other laws or contractual requirements may include state consumer privacy laws, GDPR or other international privacy requirements, FERPA, COPPA, CAN-SPAM, TCPA, data-breach notification laws, confidentiality obligations, intellectual-property protections and industry-specific rules.
I do not represent that every one of these laws applies to Paper Boat Media in every engagement. I do represent that I take a client's applicable legal, regulatory and contractual environment seriously and work with the client's legal, compliance, privacy, security or other qualified professionals when those questions require them.
AI does not erase confidentiality obligations.
I use modern technology, including AI, where it can improve research, analysis, drafting, search, workflow or decision support. That does not mean confidential client material should automatically be placed into an open consumer AI system.
When an engagement involves confidential, regulated or sensitive information, the appropriate tools, account settings, data-processing terms, access controls and client requirements should be considered before that information is used with an AI or automation platform.
I do not intentionally use confidential client information to train a public model for my own benefit, publish it through an AI system, or turn private engagement material into public content without an appropriate basis.
Running a website involves service providers even when I am not selling visitor data.
Information may be processed by companies that provide hosting, security, analytics, email, website functionality, communications, professional services or other infrastructure used to operate Paper Boat Media.
I may also disclose information when reasonably necessary to comply with law, enforce agreements, protect rights or security, investigate fraud or abuse, respond to a valid legal process, or complete a business transaction such as a merger, acquisition or sale of substantially all relevant assets.
I do not sell personal information for money. As noted above, certain advertising or measurement technologies may nevertheless fall within broader statutory definitions of "share," "targeted advertising" or similar terms in some jurisdictions.
I do not operate the public website as a long-term personal-data warehouse.
Paper Boat Media does not intentionally maintain sensitive client information in the public website itself. Routine technical logs and analytics information may be retained by hosting, security and analytics providers according to their settings and policies.
Ordinary correspondence, proposals, contracts, invoices, project records or client communications may be retained outside the public website for as long as reasonably necessary for the engagement, business administration, legal obligations, dispute prevention, tax/accounting requirements or other legitimate purposes.
Where an engagement-specific agreement requires a different retention, return or destruction schedule, I follow that agreement to the extent applicable.
I use reasonable safeguards, but no public internet system can promise absolute security.
I use reasonable administrative and technical measures appropriate to the nature of the information and the systems involved. Security can include access controls, account protections, software updates, secure hosting, encryption where available, limited access, backups and engagement-specific procedures.
No website, email system, cloud platform or transmission method is guaranteed to be perfectly secure. For particularly sensitive or regulated information, clients should use the approved secure channel established for the engagement rather than a general website form or unsolicited email.
Your rights depend on where you live and what law applies.
Depending on the jurisdiction and the type of information involved, individuals may have rights to request access, correction, deletion, portability, information about disclosure, or an opt-out from certain forms of targeted advertising, sharing or profiling.
You may also control cookies through browser settings, privacy extensions and available consent or opt-out controls. Google provides a browser add-on for users who wish to opt out of Google Analytics measurement.
If you make a privacy request, I may need enough information to verify the request and determine whether a legal exception applies. I will respond as required by applicable law.
To make a request, contact robert@paperboatmedia.com.
This website is directed to businesses and adults seeking professional information.
Paper Boat Media does not knowingly use this website to solicit personal information from children under 13. If you believe a child has provided personal information through the site, contact me so the situation can be reviewed and appropriate action taken.
External sites have their own privacy practices.
This website links to government agencies, professional organizations, research sources, social networks, client or partner sites and other external resources. Paper Boat Media does not control the privacy, security, content or data practices of third-party websites. Review their policies when leaving this site.
Technology and privacy requirements change.
I may update this Privacy Policy when website technology, business practices, legal requirements or service providers change. The effective date at the top of this page will be updated when the policy is materially revised.
Material changes apply prospectively unless law or an applicable agreement requires otherwise.
Questions about privacy, confidentiality or a regulated engagement?
Paper Boat Media
Dr. Robert Urban
DeLand, Florida, United States
Email: robert@paperboatmedia.com
Phone: 407-227-0741
If your matter involves protected health information, nonpublic financial customer information, credentials, trade secrets or another highly sensitive category, please do not send the sensitive material in an initial unsolicited message. Contact me first so an appropriate communication method can be established.
Legal note: This page describes Paper Boat Media's privacy and confidentiality practices. It is not legal advice and does not create a professional legal, medical, financial, fiduciary or compliance relationship.