Privacy Policy

Last Updated: November 2, 2026

Introduction

Protocol Archive (“we,” “us,” or “our”) is operated by PrepQ LLC, which runs the website protocolarchive.com. This Privacy Policy explains what information we collect, how we use it, who we share it with, and your rights. PrepQ LLC, trading as Protocol Archive, is responsible for (the “controller” of) the personal data described here. Contact details are at the end of this page.

If you live in Washington, Nevada or Connecticut, also read our Consumer Health Data Privacy Policy.

Information We Collect

Information You Provide

  • Email address and sign-up details: If you subscribe to our emails or ask us to email you a handout, we collect the email address you provide. We also record the date you signed up, the page you signed up from, which email list you are on (our general list, or our list for clinicians), the emails we have sent you, and any topics you choose by clicking topic links in our emails, so we can send you relevant content.
  • Plan emails: If you ask for a plan by email, we record which plan you chose (for example, a knee arthritis plan) so we can send that day’s session. Because the plan name can suggest a health condition, we treat it as health-related information: we use it only to send the plan and never for advertising.
  • Saved progress (optional): If you choose “Save my progress” on a plan page, we email you a one-time sign-in link and store your progress on our server so it can sync across your devices: which plans and routines you are following and the days you have ticked. Pain and how-you-feel scores are saved to our server only if you tick the separate box for them; otherwise they stay on your device. There is no password.
  • Clinician portal: If you’re a clinician and sign in to the free clinician portal, we store your email address, the name, clinic and contact details you add to your profile, and the programs and links you save. Patients who open a program or shared link are counted anonymously (a daily total per link); we don’t record who they are. If you joined through a colleague’s invite link, we note which portal account invited you so we can show them how many colleagues joined (a count only). Early each month we email you a summary of these anonymous totals and your listing status; you can turn it off in your portal profile or with the link in any summary. Please don’t enter patient names or health information in the portal. You can ask us to delete your portal account at hello@protocolarchive.com.
  • Clinic listings: If you list or claim a clinic, we collect the clinic details you enter (such as clinic name, address, phone, website, opening hours, languages, accessibility, payment types, registration or license number and services) and the contact person’s name, role and work email. We use these to check registration, publish and manage the listing and contact you about it. We send marketing emails only if you tick the optional box.
  • Clinicians named on a clinic page: A clinic can add the names, roles and registration numbers of its clinicians. We publish a clinician only after we have checked their registration number on the official register (for example, the HCPC register in the UK). We keep a record of each check (the date, the number, the result and the registration end date) so we can recheck it before it expires. Clinics must have each clinician’s agreement before adding them. A clinician can ask us to remove their name at any time.
  • Logos and photos: Clinics can upload a logo and up to four photos. We resize them and remove hidden camera data (such as location) before storing them, review them before they appear, and keep them until the clinic removes them or the listing is removed.
  • Reports about listings: If you report a problem with a directory listing, we store your report, any note you add and a scrambled (hashed) form of your IP address to prevent abuse. If you choose to add your email, we use it only to reply about that report.

Tools That Keep Your Information on Your Device

  • Body pain chart and pain visit summary: Everything you mark or type stays in your own browser. We don’t receive it or store it, it never appears in the page address, and Google Analytics is switched off on these pages. If you choose to keep your entries, they are kept only in that browser tab until you close it.
  • Plan trackers and routine builder: Your ticks, routines and any pain scores are saved in your own browser (local storage) so they are there when you come back. They are not sent to us unless you choose to save your progress to your account (see above). You can clear them at any time by clearing your browser’s site data.

Information Collected Automatically

  • Analytics data: We use Google Analytics 4 to understand how visitors use the site, such as pages visited, time on page, device and browser type, approximate location and referring pages. In the UK, the European Economic Area and Switzerland, Google Analytics does not run until you choose “Accept analytics”. Elsewhere it runs by default, and you can opt out using the Cookie settings link in the footer or Google’s opt-out browser add-on. We don’t use Google Analytics data for advertising, and Google’s advertising consent settings are always set to “denied” on our site.
  • Directory searches: When you search a directory, we use the ZIP code, postcode, city or approximate location you give only to sort results by distance; we don’t store it with anything that identifies you. For UK postcode searches, our server sends the postcode to postcodes.io, a free postcode lookup service, to find its location. We count searches only by US state and the first three digits of the ZIP code, or by UK postcode area (for example “LS”), and we count how often each listing is shown and how often its call, website, directions and booking buttons are used, as anonymous daily totals.
  • Server logs: Our hosting provider (SiteGround) automatically collects standard server log data, including IP addresses, browser user agent strings and access times, for security and performance.

Third-Party Embedded Content

  • YouTube videos: Our pages show a preview image for each video, loaded from YouTube’s image server (i.ytimg.com). The YouTube player (youtube-nocookie.com) loads only after you press play. When it loads, YouTube (Google) may collect data such as your IP address and may set cookies. See Google’s Privacy Policy for details.

Information About Clinics in Our Directories

Our directories list clinics so patients can find care. For US physical therapy clinics and chiropractic offices, business details (name, address, phone and website) come from the public CMS NPI Registry and Overture Maps open data. For UK physiotherapy clinics, they come from Overture Maps open data, checked against each clinic’s own public website. Where a business name includes a person’s name, that is personal data. We process it because we have a legitimate interest in helping people find local care, and we show only public business contact details. Listed clinics and individuals can ask us to correct or remove a listing at any time, using “Report a problem” on the listing or by emailing hello@protocolarchive.com, or can claim the listing free to manage it themselves.

How We Use Your Information

  • Emails: To send the emails you signed up for: a short welcome series when you join (up to five emails over about two weeks for our general list, or three emails for our clinician list), then our regular emails (a weekly Exercise of the Week for our general list, and a monthly update for clinicians). We use the topics you choose to decide which content to include. We will not sell, rent or share your email address with third parties for marketing.
  • Plan emails: To send one short email a day with that day’s session until the plan ends or you stop it, then Exercise of the Week. Each email has a link to stop plan emails and a link to unsubscribe.
  • Saved progress: Only to show you your saved plans and progress on the devices where you sign in. We do not use your progress or pain scores for marketing, and we do not share them.
  • Clinician portal and listings: To run your account, publish and update your listing and clinic page, check registrations, show you anonymous activity counts and email you about your account.
  • Analytics: To understand which pages and tools are useful and to improve them.
  • Server logs and abuse prevention: For security, troubleshooting and site performance.

Legal Bases (UK and EEA)

If you are in the UK or the European Economic Area, we rely on these legal bases:

  • Consent: marketing emails, analytics cookies, plan emails, saving pain and how-you-feel scores to your account, and optional extras you choose. You can withdraw consent at any time.
  • Contract: running the clinician portal, clinic listings and saved progress you ask us to provide.
  • Legitimate interests: listing clinics in our directories, checking clinician registrations, keeping the site secure and preventing abuse, and counting anonymous usage.
  • Legal obligation: where we must keep or disclose information by law.

Cookies and Similar Technologies

  • Google Analytics cookies (_ga, _ga_*): measure site usage. In the UK, EEA and Switzerland they are set only if you choose “Accept analytics”.
  • Cookie choice (pa_consent, stored in your browser): remembers your analytics choice.
  • Sign-in cookie (pa_s): set only if you use an email sign-in link to save your progress. It keeps you signed in on that device for up to 180 days and is removed when you sign out. It is essential and not used for tracking.
  • Clinician sign-in cookie (pa_cs): set only when a clinician signs in to the clinician portal. It keeps you signed in for up to 90 days and is removed when you sign out.
  • WordPress cookies: essential cookies for site administrators.
  • YouTube cookies: may be set after you press play on a video.
  • Retailer links: Some pages link to products on Amazon. As an Amazon Associate we earn from qualifying purchases. If you click one of these links, Amazon may set its own cookies on its site to record that you came from Protocol Archive. Amazon reports sales to us without your name, contact or payment details. See How we make money.

You can change your analytics choice at any time with the Cookie settings link in the footer, and control cookies in your browser settings.

Data Sharing

We do not sell your personal information, and we do not share it for targeted advertising. We share data only with service providers who help us run the site, under contracts that limit how they use it:

  • Google (Analytics; YouTube when you play a video)
  • SiteGround (hosting and security)
  • MailPoet (storing our subscriber lists and delivering our emails; our emails may record whether a message was opened and which links were clicked)
  • postcodes.io (UK postcode lookups; receives the postcode only)

We may also disclose information if required by law or to protect the rights and safety of others.

International Transfers

We are based in the United States, and our service providers may store data in the US and other countries. If you are in the UK or EEA, your data is transferred to the US. Where required, we rely on safeguards such as the EU-US Data Privacy Framework and its UK Extension, or standard contractual clauses used by our providers.

Data Retention

  • Email addresses and sign-up details: until you unsubscribe or ask us to delete them.
  • Saved progress: until you delete it (use “Delete my saved progress” on any plan page) or ask us to. Sign-in links expire after 30 minutes and work once; sign-in sessions end after 180 days without use.
  • Clinician portal accounts: until you ask us to delete your account. Programs and links you delete are removed.
  • Clinic listings, clinician names, registration check records, logos and photos: while the listing is active, and for up to 2 years after a listing is removed so we can answer questions about it, unless you ask us to delete them sooner.
  • Listing reports: up to 2 years.
  • Anonymous counts: kept as totals; they do not identify anyone.
  • Analytics data: 14 months (Google Analytics setting).
  • Server logs: according to SiteGround’s standard retention schedule.

Your Rights

Depending on where you live, you may have the right to:

  • Access a copy of the personal data we hold about you
  • Correct inaccurate data
  • Delete your data
  • Restrict or object to how we use it, including objecting to a directory listing
  • Data portability: receive your data in a common format
  • Withdraw consent at any time, for example by unsubscribing or changing your cookie choice
  • Delete saved progress yourself with “Delete my saved progress” on any plan page

To use these rights, email hello@protocolarchive.com. We will reply within one month (45 days for US state privacy laws). If you are in the UK or EEA, you can also complain to your data protection authority; in the UK this is the Information Commissioner’s Office (ico.org.uk).

US State Privacy Rights

Residents of California and other US states with privacy laws may have the rights to know, access, correct and delete their personal information, and to opt out of its sale or sharing for targeted advertising. We do not sell personal information or share it for targeted advertising. We will not treat you differently for using your rights. Residents of Washington, Nevada and Connecticut: see our Consumer Health Data Privacy Policy.

Children’s Privacy

Protocol Archive is not directed at children under 13, and we do not knowingly collect personal information from children under 13. If we learn that a child under 13 has given us personal information, we will delete it.

Security

We use reasonable measures to protect your information, such as encrypted connections, hashed sign-in tokens and limited access. No website is completely secure.

Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated “Last Updated” date.

Contact Us

For questions about this Privacy Policy or to use your rights, contact us at: hello@protocolarchive.com
Protocol Archive (PrepQ LLC), 46 Danada Square W, Wheaton, IL 60189, USA