Privacy Policy
Version 1.1 · Effective October 11, 2026
I work on AI and compliance for healthcare companies, so this page should survive the same read I'd give a client's. The short version comes first. The details follow.
The short version
- I collect what you send me through a form or email, plus basic analytics if you allow it.
- I use it to reply, to do the work you hire me for, and to learn which pages help.
- I don't sell your information. I don't run ad tracking.
- AI tools help me read, research and draft. I read every message and make every decision, and nothing you send is used to train AI models.
- Please don't send patient health information through this site.
- You can ask me to see, correct or delete your information at any time: [email protected].
Who's responsible
Hugo Acurio, an independent operations consultant, runs hugoacurio.com and decides how the personal information collected here is used. In this policy, "I" and "me" mean Hugo Acurio. This policy covers hugoacurio.com, its forms, and the personal information I handle in my consulting and video work. Links to other sites lead to their own policies.
- Email: [email protected]
- Phone: +1 (480) 875-2068
- Location: Fort Lauderdale, Florida, United States.
I haven't appointed a data protection officer. The laws that require one don't apply to an operation my size, so privacy questions come straight to me.
What I collect
What you give me. When you fill in a form on this site (like the six-question operations diagnostic), book a call, or write to me, I get what you enter: your name, email, company, phone if you add it, your message, and your answers about your company (revenue range, systems, how AI is used and governed). On the contact form, name, email, company and message are required, because without them I can't reply. Everything else is up to you. If you hire me, I also collect what the work needs: contracts, billing details, and the project material you share.
What the site collects on its own. Like most sites, this one receives technical data when you visit: IP address, browser and device type, pages viewed, and the page that sent you. Essential cookies keep the site running. Google Analytics runs only if you allow it (see Cookies).
What I find elsewhere. Before reaching out to a company, I research it using public business sources: company websites, news, public professional profiles and business contact databases. More on this under "If I contacted you first".
I don't ask for sensitive information and I don't want it: health data, government ID numbers, financial account numbers, or anything about race, religion, sexual orientation or politics.
How I use it, and why
| Why I use it | Legal basis (under EU and UK law) |
|---|---|
| To reply to your message and send you my read of your diagnostic | Your consent (the checkbox on the form), and steps you asked for before a possible engagement |
| To do the work you hire me for, invoice it and keep the books | Our contract, and the tax and accounting laws I'm subject to |
| To see which pages are useful (Google Analytics) | Your consent, which you can withdraw at any time |
| To keep the site secure and block abuse | My legitimate interest in a site that works and stays safe |
| To research companies and contact people who might need my help | My legitimate interest in finding clients. You can object at any time |
| To create an AI narration voice for a client video | Your explicit written consent |
| To keep records that prove I followed the law | Legal obligation |
I don't use your information for any other purpose without telling you first and, where the law requires it, asking for your consent.
If I contacted you first
I reach out to companies I think I can help. Before I do, I check public business information to decide whether I can help and to make the first message worth reading. If you'd rather not hear from me, say so and I'll stop. I keep your name and email on a do-not-contact list so it stays that way.
AI in my work
I'd be an odd AI-compliance consultant if I hid this, so here it is.
- What AI does. It helps me read and organize messages, research companies, draft replies, documents and code, and produce videos.
- What it doesn't do. It doesn't make decisions about you, and nothing AI-written goes out under my name without my review.
- Training. I use AI tools only under terms or settings that keep providers from training their models on what I put in.
- Your choice. If you don't want your information to go through an AI tool, say so in your message. I'll handle it by hand.
- Voice. Synthetic voices of real people are made only with written consent. See "Voice data for client videos".
Health information
This site isn't built for health information, and I'm not a HIPAA covered entity. Please don't send patient information, medical records or anything that could identify a patient, through a form or by email. If client work ever needs access to protected health information, we sign a business associate agreement first, and I work with that data inside your systems wherever possible.
Voice data for client videos
Some client videos are narrated with an AI copy of the client's voice, built from a recording of their own speech. Some US states (Illinois, Texas and Washington among them) treat a voiceprint as biometric information, so I handle voice data under these rules:
- I get your written consent before recording anything used to build a voice, and I tell you what it's for and how long I keep it.
- I use your voice only to produce the narration for your video. Never for anything else, never for anyone else.
- I never sell, rent or trade it, and I don't share it with anyone except the voice-synthesis provider that builds the model.
- I delete the recording and the voice model within 30 days after I deliver your final video, and in any case no later than one year after our last interaction. You can ask me to delete them sooner. I ask the provider to delete its copy at the same time.
- I store it with the same care as my most sensitive records.
Who else sees it
I don't sell your personal information, and I don't share it for targeted advertising. It reaches other parties only in these cases:
- Service providers that run parts of my business for me, under contracts or terms that limit what they can do with it: my business software and hosting provider (this site, forms, client records and invoices), Google (email, web fonts, Google Analytics if you allow it, YouTube for embedded videos), Cloudflare (site security, delivery and cookie-free performance measurement), Anthropic (AI assistance), ElevenLabs (voice synthesis, client videos only) and Zoom (calls).
- My professional advisors, such as an accountant or a lawyer, under confidentiality, when they need it to advise me.
- The law. When a valid legal request or a legal duty requires it, or to protect someone's safety or my legal rights.
- A business change. If my practice becomes part of a company, your information moves with it under this policy, and I'll tell you first.
I don't share personal information with third parties for their own direct marketing.
Cookies and analytics
Cookies are small files your browser stores. The site's software also keeps a few technical entries in your browser's local storage, to coordinate open tabs and hold your diagnostic answers while you fill in the form. Here's every kind this site uses:
| Type | What it does | Set by | When | How long |
|---|---|---|---|---|
| Essential | Keeps your session, your language and your cookie choice (session_id, frontend_lang, tz, website_cookies_bar) | This site | Always | 7 days (session) to 1 year (language) |
| Security | Tells people from bots (__cf_bm) | Cloudflare | When Cloudflare checks a visit for bots | 30 minutes |
| Analytics | Counts visits and clicks (_ga, _ga_*) | Google Analytics | Only after you choose "Allow analytics" | Up to 2 years |
| Video | Plays embedded videos in YouTube's privacy-enhanced mode | YouTube | Only when you press play | Set by YouTube |
Video thumbnails load from YouTube's image servers when a page opens, which shares your IP address with Google. YouTube sets cookies only when you press play.
The site's software also loads Google's Firebase library on every page, for push notifications that are switched off. It sets no cookies or browser storage, and the download shares your IP address with Google.
On your first visit, a banner lets you choose "Only essential" or "Allow analytics". Both buttons carry the same weight, and nothing is pre-selected. You can change your choice at any time through "Cookie settings" at the bottom of every page.
If your browser sends a Global Privacy Control or Do Not Track signal, analytics stays off, whatever you clicked on the banner.
I don't use advertising cookies, retargeting pixels or cross-site tracking.
Where your information goes
I work from the United States and Latin America, and my providers run servers in the United States and other countries. Moving information across borders is part of how the work gets done. When it happens, I rely on safeguards the law recognizes: your consent, the contract we're performing, or providers' contractual protections such as standard contractual clauses.
How long I keep it
| Information | How long |
|---|---|
| Messages and form submissions that don't turn into work | 24 months after our last contact |
| Contracts, invoices and payment records | 7 years after the tax year they belong to |
| Client project files | What our agreement says. If it says nothing, 2 years after the work ends |
| Call recordings | 90 days, unless our agreement says otherwise. Recordings used for a voice model follow the voice rules |
| Voice recordings and voice models | Deleted within 30 days after final delivery |
| Analytics data | Up to 14 months |
| Do-not-contact list | As long as I do outreach, so your "stop" holds |
| Privacy requests and consent records | 3 years after the request or the end of our relationship |
Deleted information can stay in system backups for up to 3 months before it rolls off.
How I protect it
- Encrypted connections (HTTPS) on every page and form.
- Two-factor authentication on the accounts that hold your information.
- Access limited to me. If someone works on your project with me, they're bound by confidentiality and see only what the work needs.
- Providers chosen in part for their security practices.
No system is perfectly secure. If a breach puts your information at risk, I'll tell you, and the authorities the law requires, within the deadlines it sets.
Your rights
Wherever you live, you can ask me to:
- tell you whether I hold information about you, and give you a copy;
- correct or update it;
- delete it;
- send it to you or to someone else in a usable format;
- stop or pause using it, or stop using it for outreach;
- withdraw a consent you gave, without affecting what happened before;
- not make decisions about you based solely on automated processing. (I don't make any.)
Write to [email protected] with "Privacy request" in the subject. I may ask you to confirm your identity before I hand anything over. I answer within 15 days, and it costs nothing. Using a right never changes how I treat you.
You can also complain to a regulator: the data protection authority where you live or, in the United States, your state attorney general. I'd rather you tell me first, but that's your call.
Children
This site is for business professionals. It isn't meant for anyone under 18, and I don't knowingly collect information from children. If you think a child sent me something, tell me and I'll delete it.
Changes
When I change this policy, the version and date at the top change with it. If a change affects information you already gave me, I'll tell you by email before it takes effect, if I have your email. Earlier versions are available on request.
Contact
Questions, requests or complaints: [email protected], or +1 (480) 875-2068.