Privacy Policy

Last updated July 15, 2026

Samson Advisory (“we”, “us”, or “our”) respects your privacy. This Privacy Policy explains what information we collect, why we collect it, how we protect it, and the limited circumstances under which we would ever share it. It applies to two distinct experiences: our marketing website at samsonadvisory.com (the “Site”) and the Awali Technology application we operate for our engaged clients (the “Application”).

1. Information We Collect on the Website

Our website is intentionally lightweight. When you submit a contact form, a customer support request, an access request, or a whistleblower report, we collect only the information you provide in that form — typically your name, email address, phone number (if you supply one), your company or role, and the message you’ve written.

We also receive standard technical information that any website receives: your IP address, browser type, referring page, and pages viewed. We use Google Analytics to understand aggregate site traffic (e.g., which pages are most useful). Analytics data is not used to identify individual visitors or combined with any information you submit through our forms.

How we use website information. Information you submit through a website form is used solely to respond to and follow up on the request you made. We do not sell it, rent it, or add it to marketing lists. We do not use it to profile you for advertising. We do not share it with third parties for their marketing.

2. Information We Collect in the Awali Application

The Awali Application is provided to clients under a Master Services Agreement and one or more Statements of Work. In the course of a client engagement, the Application collects information in three categories, each tied to a specific operational purpose:

• User account information — name, work email address, role, and authentication credentials for the individuals your organization designates to use the platform. This is used to create and administer user accounts and to control access.
• Subject matter expert identification — names, roles, functional areas, and points of contact for the people inside your organization who own or operate the processes we are mapping. This is used to route interviews, questions, and process reviews to the right people.
• Process mapping content — the descriptions, artifacts, workflows, screenshots, exports, and supporting materials that document how work gets done at your organization. This is used to build the operational map, workshop process changes, and design the automations that are the deliverable of the engagement.

We collect only what is necessary to deliver the scope described in the Statement of Work. We do not collect information from the Application for any purpose outside that engagement.

3. Protected Health Information (PHI)

When we are engaged by a HIPAA-regulated client (a “Covered Entity” or an existing Business Associate) and the engagement requires access to Protected Health Information, that access is governed by a signed Business Associate Agreement (“BAA”) between Samson Advisory and the client.

In every such engagement:

• PHI is used only for the specific purposes stated in the applicable Statement of Work.
• Access is limited to Samson Advisory personnel who have a documented need to perform the engagement, and each person is trained on HIPAA obligations.
• PHI is not commingled with data from any other client or used for any Samson Advisory internal purpose.
• The terms of the BAA control in the event of any conflict with this Privacy Policy.

If you believe an incident involving PHI has occurred, contact us immediately using the details in Section 11.

4. How We Store and Secure Data

All data we collect — whether from the website or the Awali Application — is stored in an encrypted-at-rest format. Data in transit between your browser or device and our systems is protected by industry-standard TLS encryption.

Additional safeguards we apply include:

• Role-based access controls, so users and staff can see only the records their role requires.
• Multi-factor authentication for administrative access.
• Logging and monitoring of access to client data.
• Regular backups, with backups encrypted using the same standards as production data.
• Physical and network security controls provided by our vetted cloud infrastructure providers.

No security program can promise perfect security, but we design ours to meet the expectations of the regulated industries and clients we serve.

5. No Third-Party Sharing Without Client Authorization

We do not sell, rent, license, or otherwise disclose client data to any third party for any purpose — ever — unless the client has specifically and expressly authorized that disclosure. This is the single most important commitment in this Policy.

The limited exceptions are:

• Service providers we rely on to operate the platform (for example, our cloud hosting provider or transactional email provider). These providers act only under our instructions, are bound by written confidentiality and data-protection obligations at least as strict as the ones in this Policy, and are permitted to access data only to the extent required to provide their service. Where a HIPAA client’s data is involved, they are also bound by a downstream BAA.
• When required by law, such as a valid subpoena or court order. In such a case, we will notify the affected client to the extent legally permitted so the client can seek a protective order or otherwise respond.

Beyond those two narrow situations, your data stays with us and with you.

6. Cookies and Analytics

The Site uses a small number of cookies to remember display preferences and to enable Google Analytics. You can disable cookies in your browser settings; the Site will continue to function. We do not use advertising cookies, cross-site tracking, or third-party marketing pixels.

7. Data Retention

We retain website contact submissions for as long as reasonably needed to complete follow-up and any resulting business relationship, and then in accordance with our records-retention schedule.

Application data is retained for the term of the engagement and, unless the underlying Statement of Work requires otherwise, is deleted or returned to the client on request after the engagement ends. HIPAA-covered records are retained and disposed of in accordance with the applicable BAA and applicable law.

8. Your Rights

Depending on where you live, you may have the right to request access to, correction of, or deletion of personal information we hold about you. To exercise these rights, contact us at the address in Section 11. We will respond within the time frames required by applicable law.

For information that Samson Advisory processes on behalf of a client (for example, information inside the Awali Application about the client’s own employees or patients), please direct your request to the client. We will support the client in responding as required by the applicable agreement.

9. Children’s Privacy

Neither the Site nor the Application is directed to children under the age of 13, and we do not knowingly collect information from children under 13. If you believe a child has provided information to us, contact us and we will delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date at the top of this page. Material changes affecting the Awali Application will be communicated to affected clients through the notice provisions of their agreement. Continued use of the Site or the Application after a change indicates acceptance of the updated Policy.

11. Contact Us

Questions about this Policy, or requests concerning your information, should be directed to:

Samson Advisory
Attn: Privacy
2301 W Anderson Ln #102-126
Austin, TX 78757
United States
Phone: 512-635-2718
Email: robert@samsonadvisory.com