Privacy Policy — MSLBlueprint.com

Last updated: 2026-06-12

MSL Blueprint ("we," "us," "our") operates mslblueprint.com. This policy explains what personal information we collect, why we collect it, how we use it, and your rights regarding that information.

We keep this policy in plain language. If something is unclear, email us at hello@mslblueprint.com.

What We Collect

We collect personal information only when you voluntarily provide it or when our analytics tools collect non-identifying usage data.

Information you provide directly:

• Email address — when you submit the maturity assessment results form or subscribe to our newsletter
• Assessment responses — your answers to the MSL Organization Maturity Assessment (15 questions, scored)

Information collected automatically:

• Page views and navigation events — which pages you visit, how long you stay, and where you navigate next
• Device and browser metadata — browser type, operating system, screen size, and referring URL
• Assessment funnel events — whether you started, completed, or abandoned the assessment (no personally identifying information is attached to these events unless you submit your email)

Information we do NOT collect:

• We do not use cookies or local storage. Our analytics use in-memory session tracking only — no data persists on your device after you close the page.
• We do not collect IP addresses. IP capture is disabled in our analytics configuration.
• We do not currently collect payment or financial information through this site. If we add paid features in the future, we will update this policy before collecting any payment data and will identify the payment processor used.
• We do not use tracking pixels in emails beyond standard open/click analytics provided by our email service.

How We Use Your Information

We use personal information for the following purposes only:

• Delivering assessment results — Your email and assessment responses are used to calculate and deliver your maturity score, pillar breakdown, and personalized insights.
• Sending our newsletter — If you opt in (via a separate checkbox), we send MSL Blueprint Brief, our newsletter on field medical leadership. You can unsubscribe at any time via the link in every email.
• Improving the site — We use aggregated, non-identifying analytics to understand which content resonates, where users drop off, and how to improve the experience. We do not build individual behavioral profiles.

We do not use your information for any purpose other than what is described above. We will not change these purposes without updating this policy and, where required, obtaining your consent.

Third-Party Services

We use the following services to operate mslblueprint.com. Each processes data on our behalf under their own privacy policies:

We do not sell, rent, or share your personal information with any third party for their marketing purposes. We do not participate in data brokerages. We do not serve advertising.

Legal Bases for Processing (GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, we process your personal data under the following legal bases:

• Consent — Newsletter subscription (you opt in via a separate, unchecked checkbox; you can withdraw at any time by unsubscribing)
• Contractual necessity — Assessment results delivery (you provide your email to receive a service you requested)
• Legitimate interest — Aggregated, non-identifying site analytics to improve the product and content. We have balanced our interest against your privacy rights: we use cookieless tracking, disable IP capture, and do not build individual behavioral profiles for logged-out visitors.

Data transfers: We use PostHog Cloud US (hosted in the United States). Assessment and analytics data is processed and stored on US servers. We rely on PostHog's data processing agreement and standard contractual clauses for EU-US data transfers. Our cookieless, IP-disabled configuration minimizes the personal data transferred.

Your Rights Under GDPR (EEA/UK Residents)

You have the right to:

• Access your personal data and receive a copy
• Rectify inaccurate personal data
• Erase your personal data ("right to be forgotten")
• Restrict processing of your personal data
• Object to processing based on legitimate interest
• Data portability — receive your data in a structured, machine-readable format
• Withdraw consent at any time (for newsletter subscription — use the unsubscribe link or email us)

To exercise any of these rights, email hello@mslblueprint.com. We will respond within 30 days.

You also have the right to lodge a complaint with your local data protection authority.

Your Rights Under CCPA/CPRA (California Residents)

If you are a California resident, you have the right to:

• Know what personal information we collect and why
• Access your personal information
• Delete your personal information
• Correct inaccurate personal information
• Opt out of the sale or sharing of your personal information (we do not sell or share your data, so there is nothing to opt out of)
• Non-discrimination — we will not treat you differently for exercising your rights

Categories of personal information we collect: Identifiers (email address), internet or network activity (page views, device metadata), and inferences (assessment score and maturity level).

Categories of personal information we sell or share: None. We do not sell or share personal information as defined by the CCPA/CPRA.

To exercise your rights, email hello@mslblueprint.com. We will verify your identity and respond within 45 days.

Your Rights Under PIPEDA (Canadian Residents)

If you are a Canadian resident, the Personal Information Protection and Electronic Documents Act (PIPEDA) gives you the right to:

• Access your personal information held by us
• Challenge the accuracy of your personal information and have it corrected
• Withdraw consent for the collection, use, or disclosure of your personal information (subject to legal or contractual restrictions)

We collect and use your personal information only for the purposes identified in this policy. We obtain your express consent for newsletter subscription and rely on implied consent for analytics (non-identifying, aggregated data collected in the course of providing our service).

To exercise your rights, email hello@mslblueprint.com.

Data Retention

• Assessment results — Retained in our analytics platform (PostHog) for as long as the data is useful for product improvement, or until you request deletion. When we add a database for our SaaS product, assessment data will be migrated there and subject to the same retention and deletion policies.
• Email addresses — Retained as long as you are subscribed to our newsletter or have an active relationship with us. If you unsubscribe, your email is removed from our active mailing list. Beehiiv may retain records for their own compliance purposes per their privacy policy.
• Analytics data — Aggregated, non-identifying analytics data is retained indefinitely. Individual-level analytics events are retained per PostHog's standard retention policies.

You can request deletion of all your personal data at any time by emailing hello@mslblueprint.com.

Children's Privacy

MSL Blueprint is a professional resource for field medical leaders. We do not knowingly collect personal information from anyone under the age of 16. If we learn that we have collected personal data from a child under 16, we will delete it promptly. If you believe a child has provided us with personal information, please contact us at hello@mslblueprint.com.

Changes to This Policy

We may update this policy from time to time. If we make material changes, we will update the "Last updated" date at the top of this page. For significant changes that affect how we use your data, we will notify you via email (if we have your email address) or by a prominent notice on the site.

Contact

For any privacy questions, data requests, or concerns:

Email: hello@mslblueprint.com

MSL Blueprint is operated by Scientific Affairs PBC.

This policy is designed to comply with GDPR (EU/UK), CCPA/CPRA (California), and PIPEDA (Canada). It is not a substitute for legal advice. We recommend consulting with a qualified attorney for compliance specific to your jurisdiction.