Privacy Policy

Amfit, LLC ("Amfit," "we," "us") builds scanning, design, and fabrication systems for the clinicians and providers who make custom foot orthotics. This policy explains what information we collect, why we collect it, who we share it with, and the choices you have.

We have written it to be read, not to be survived. If anything here is unclear, contact us using the details at the end and we will explain it in plain terms.

Who this policy covers

This policy applies to:

• amfit.com, including our contact forms and the ROI calculator
• the Amfit Provider Portal, the logged-in area where providers manage their account and submit orders
• the Amfit Scanner App for iPad

A note for patients. Amfit sells to providers, not to the public. If you received an orthotic through a clinic, your clinical record and your relationship are with that provider, not with Amfit. Requests about your own health information should go to the provider who treated you. What Amfit receives in order to fabricate a device is described below.

Information we collect

Information you give us

• Contact forms. When you contact sales, orders, or technical support, we collect your name, email address, phone number, company or practice name, and your message. Depending on the form, we may also collect the product, model number, serial number, order reference, area of interest, and how you prefer to be contacted.
• ROI calculator. To send you a projection we collect your first and last name, email address, state, and practice type, plus your phone number if you provide it. We also record the ranges you select for monthly volume, what you charge, and your fabrication path, along with the estimate we calculated for you.
• Provider Portal account. When an account is created for you we hold your name, email address, practice or account name, phone number, ship-to address, and your Amfit account number. Your password is stored only as a cryptographic hash by our authentication provider, and is never visible to us.
• Orders. When you submit an order through the portal we record the items and quantities, your purchase order number, shipping selection, order comments, and the resulting order number.

Information collected automatically

• Analytics. We use Google Analytics to understand how the site is used. It sets cookies and similar identifiers and records pages viewed, the page that referred you, an approximate location derived from your IP address, and general device and browser information.
• Server logs. Our hosting provider records standard request information, including IP address, timestamp, and browser user agent.
• Maps. Our Find a Provider page loads mapping from a third-party provider, which receives your IP address and your interactions with the map in order to serve it.

The Provider Portal is deliberately excluded from our analytics. We do not track provider behavior inside the logged-in area.

Information we do not collect

We do not use advertising pixels, session recording, or cross-site tracking on this website. We do not run behavioral advertising, and we do not build advertising profiles.

How we use information

• To answer your questions and follow up on requests you make of us
• To provide the Provider Portal, authenticate you, and keep your account secure
• To receive, process, fabricate, and ship orders, which includes transmitting order details to our internal order management system
• To send transactional messages such as order confirmations and password resets
• To understand how the site is used and improve it
• To protect against fraud, abuse, and security incidents
• To meet legal, tax, and regulatory obligations

If you ask us for information about our products, we may follow up with you about them. You can tell us to stop at any time and we will.

Cookies, analytics, and Do Not Track

Cookies are small files a website stores in your browser. We use them for two purposes: keeping you signed in to the Provider Portal, and measuring site usage through Google Analytics.

You can control cookies through your browser settings. Blocking them will not prevent you from reading the site, but it will prevent the Provider Portal from keeping you signed in. You can opt out of Google Analytics specifically using Google's browser opt-out add-on.

Do Not Track. Some browsers can send a "Do Not Track" or Global Privacy Control signal. There is no common industry standard for how a website should respond to these signals. Our website does not currently respond to them. We disclose this so you can make an informed choice rather than assume a protection that is not in place. The controls described above do work, and so does contacting us directly.

We do not authorize third parties to collect personally identifiable information about your activity across other websites through our site.

How we share information

We do not sell personal information. We do not share personal information for cross-context behavioral advertising. We never have.

We share information only in these circumstances:

• Service providers. Companies that run parts of our operation on our behalf and are permitted to use the information only to provide that service: website hosting and form delivery, database and authentication, analytics, mapping, transactional email delivery, and the connector that carries orders into our order management system.
• Our corporate family. Amfit is owned by Surefoot. We may share information within our corporate group where it supports the purposes described in this policy.
• Professional advisors. Accountants, auditors, and lawyers, bound by confidentiality.
• Legal requirements. Where we are compelled by law, or where disclosure is necessary to protect our rights, safety, or property, or that of others.
• Business transfers. If Amfit is involved in a merger, acquisition, or sale of assets, information may transfer as part of that transaction. We would give notice before your information became subject to a different policy.

Your choices and rights

Regardless of where you live, you can ask us to:

• Access the personal information we hold about you
• Correct information that is inaccurate or out of date
• Delete information we no longer need to keep
• Stop sending you marketing communications

We extend these choices to everyone who asks, whether or not a specific law requires it in your case.

Reviewing and updating your own information. If you hold a Provider Portal account, you can review and update your account details by signing in. For anything else, or if you do not have an account, contact us using the details below and we will handle it for you.

How to make a request. Email or call us using the contact details at the end of this policy. We will acknowledge your request and respond within 45 days. We may need to verify your identity before acting, particularly where account or order information is involved. We will not treat you differently for exercising any of these rights.

Some information cannot be deleted on request. Completed order records, for example, are business and tax records we are required to retain.

How long we keep information

We keep information for as long as it serves the purpose it was collected for, and then for as long as we are required to retain it. In practice that means account and order records are kept for the life of the business relationship and the retention period that applies to business records afterward. Inquiries and leads are kept while they are useful to the sales relationship. Analytics data is retained for 14 months.

The Amfit Scanner App

The following describes the Amfit Scanner App for iPad specifically. It may change as the app evolves.

What is stored on your device

The upload function requires a pair of identifying credentials we provide as part of your existing Amfit account. When you enter them in the app, they are stored in a credential protection space that iOS creates specifically for the app.

The app provides a simple data store, sometimes known as a database, which persists in storage accessible only through the app. This allows you to save and retrieve scans paired with identifying labels and any modifying values you have selected.

How the app sends scans

The app allows you to upload scan bundles to a secure Amfit storage site. A scan bundle includes the scan with its labels and modifiers, your account identifiers, and the app ID that iOS creates on installation. The bundle is transferred over the internet using Transport Layer Security (TLS).

Sending a scan bundle is entirely under your control. It happens only when you explicitly begin an upload.

What happens to bundles you upload

Authorized Amfit personnel periodically retrieve uploaded scan bundles for processing at our facility. Retrieval occurs over the internet using TLS. Processing transforms scans into records that, at your discretion, are used to produce custom orthotics. The records are stored in an Amfit proprietary format on secure servers located on site.

Clearing app data

You can clear your device by deleting the app. The app also allows you to delete specific scans of your choosing. We will remove uploaded bundles and processed records from storage at your request.

In general, nothing sent through the app needs to contain personal or confidential patient information.

Security

Amfit takes care to safeguard confidentiality, and we adhere to state and national law.

• We use TLS encryption for information in transit across the internet.
• We maintain antivirus and monitoring across our local networks.
• Access to customer information is limited to authorized Amfit employees, and limited further to what their role requires.
• Provider Portal accounts are protected by individual credentials. Each account can reach only its own profile and its own orders.

No security is perfect. In the event of a breach affecting personal information, Amfit will make every effort to notify affected customers, and will do so where the law requires it.

Children

Our products and this website are intended for professional and business use. Amfit does not market to, or knowingly solicit information from, individuals under the age of 18. If you believe a minor has provided us information, contact us and we will delete it.

Visitors outside the United States

Amfit operates in the United States and our systems are hosted here. If you contact us or use the Provider Portal from another country, the information you provide is transferred to and processed in the United States, where data protection law may differ from the law where you live. The rights described in the "Your choices and rights" section are available to you regardless of where you are.

Changes to this policy

We may update this policy as our products and obligations change. When we do, we will revise the effective date at the top of this page. If a change materially affects how we handle information already collected, we will give more prominent notice, such as a notice on the website or an email to affected account holders, before the change takes effect. We review this policy at least once a year.

How to reach us

For any question about this policy, or to make a privacy request:

If you are not sure who to contact, use any of our published addresses on the contact page and we will route your message to the right person.