Effective Date: June 1, 2025

Last Updated: June 3, 2026

IMPORTANT NOTICE TO ALL CLIENTS AND USERS
Tegrity Connect LLC operates as an independent reseller and white-label licensee of the GoHighLevel (HighLevel Inc.) CRM platform. This Privacy Policy governs Tegrity Connect LLC’s data practices and supplements — but does not replace — GoHighLevel’s own Privacy Policy available at https://www.gohighlevel.com/privacy-policy. By using our Services, you acknowledge that your data is processed on GoHighLevel’s infrastructure.

1. Introduction and Scope

Tegrity Connect LLC (“Tegrity Connect LLC,” “Company,” “we,” “us,” or “our”) is a Software-as-a-Service (SaaS) company that provides customer relationship management (CRM) solutions, application development tools, and related technology services to businesses and organizations. Our platform is built on a white-label license of the GoHighLevel CRM platform, developed and operated by HighLevel Inc. (“GoHighLevel” or “GHL”).

This Privacy Policy describes how Tegrity Connect LLC collects, uses, discloses, retains, and protects information in connection with our branded platform, website, products, and services (collectively, the “Services”). It also discloses the role of GoHighLevel as our primary infrastructure subprocessor.

This Policy applies to:

Business clients and organizations that subscribe to or use our Services (“Clients”)
Authorized end users of Client accounts, including employees, contractors, and agents (“Users”)
Individuals whose data is stored, processed, or managed within our platform by our Clients (“End Consumers” or “Data Subjects”)
Visitors to our website at TegrityConnect.com

By accessing or using our Services, you acknowledge that you have read, understood, and agree to the terms of this Privacy Policy. If you are a Client, your agreement to our Terms of Service and any applicable Data Processing Agreement (“DPA”) supplements this Policy.

2. Platform Infrastructure and Subprocessor Disclosure

IMPORTANT: GoHighLevel Infrastructure Disclosure
Tegrity Connect LLC does not operate its own independent CRM infrastructure. Our Services are delivered through a white-label license of the GoHighLevel platform (HighLevel Inc.). All Client data submitted to Tegrity Connect LLC’s CRM is stored and processed on GoHighLevel’s servers and infrastructure. GoHighLevel is our primary subprocessor.

2.1 GoHighLevel as Primary Subprocessor

HighLevel Inc. (doing business as GoHighLevel), located at 400 North Saint Paul St., Suite 920, Dallas, TX 75201, serves as Tegrity Connect LLC’s primary infrastructure and platform subprocessor. In this capacity, GoHighLevel:

Hosts and stores all Client Data on its servers and cloud infrastructure
Processes data through its CRM, automation, communication, and marketing tools
Maintains its own Privacy Policy, Terms of Service, and data security practices
Operates as a data subprocessor subject to its agreements with Tegrity Connect LLC as a licensed agency reseller

GoHighLevel’s Privacy Policy is available at: https://www.gohighlevel.com/privacy-policy

GoHighLevel’s Terms of Service are available at: https://www.gohighlevel.com/terms-of-service

2.2 Implications for Client Data

Because Client Data is stored and processed on GoHighLevel’s infrastructure, the following apply:

Tegrity Connect LLC’s data security commitments are contingent on and bounded by GoHighLevel’s own security practices, certifications, and infrastructure capabilities.
Data retention and deletion timelines are subject to GoHighLevel’s technical capabilities and policies, in addition to Tegrity Connect LLC’s obligations.
GoHighLevel may update its Privacy Policy, Terms of Service, or subprocessor arrangements. Tegrity Connect LLC will endeavor to notify Clients of material changes that affect their data, but is not responsible for changes made unilaterally by GoHighLevel.
Certain features, integrations, or data handling practices described in this Policy are dependent on GoHighLevel’s platform capabilities at any given time.

2.3 Tegrity Connect LLC’s Independent Data Practices

Separate from data stored within the GoHighLevel platform, Tegrity Connect LLC independently collects and processes certain information in connection with account management, billing, customer support, and website operations. This independently collected data is governed solely by this Privacy Policy.

2.4 Other Subprocessors

In addition to GoHighLevel, Tegrity Connect LLC may engage other third-party service providers to support our Services, including:

Payment processors (for billing and subscription management)
Email and communication platforms (for service and marketing communications)
Analytics providers (for website and platform usage analytics)
Customer support software providers

All subprocessors are required to maintain data protection standards consistent with applicable law and our contractual requirements.

3. Key Definitions

“Business Purpose” means the use of personal information for operational purposes reasonably necessary and proportionate to providing our Services.

“Client Data” means all data, content, and information that Clients or their Users submit to, store in, or process through our Services, including personal information of End Consumers, which is stored on GoHighLevel’s infrastructure.

“Controller” means the entity that determines the purposes and means of processing personal data. Our Clients are typically Controllers of Client Data; Tegrity Connect LLC acts as a Controller of data we independently collect.

“De-identified Data” means information that cannot reasonably identify a specific individual and for which we have implemented technical safeguards against re-identification.

“GoHighLevel” or “GHL” means HighLevel Inc., Tegrity Connect LLC’s primary platform infrastructure provider and subprocessor.

“HIPAA” means the Health Insurance Portability and Accountability Act of 1996 and the regulations promulgated thereunder, including the HITECH Act amendments.

“HIPAA Module” means the optional, account-wide HIPAA compliance add-on available through GoHighLevel at an additional cost of US$297 per month, which enables ePHI encryption, Business Associate Agreements, audit logging, and MFA enforcement within the GoHighLevel platform.

“Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked to a particular individual or household.

“PHI” or “Protected Health Information” has the meaning set forth in 45 C.F.R. § 160.103.

“Processor” means an entity that processes personal data on behalf of a Controller.

“VCDPA” means the Virginia Consumer Data Protection Act, Va. Code Ann. §§ 59.1-571 through 59.1-585, and any amendments thereto.

4. Information We Collect

4.1 Information You Provide Directly to Tegrity Connect LLC

When you register for an account, subscribe to our Services, or communicate with us directly, Tegrity Connect LLC independently collects:

Account registration details: name, business name, email address, phone number, job title, and billing address
Payment and billing information (processed by our PCI-compliant payment processors; Tegrity Connect LLC does not store full card numbers)
Communications and correspondence with our support, sales, and account management teams
Information submitted in forms, surveys, or feedback
Contract information and signed agreements

4.2 Client Data Processed Through the GoHighLevel Platform

As a CRM platform, our Services enable Clients to store, process, and manage data about their own customers and contacts. This Client Data is submitted to and stored on GoHighLevel’s infrastructure and may include:

Contact and lead information (names, emails, phone numbers, addresses)
Account and company records
Transaction and sales data
Customer interaction history and communications
Custom fields and data sets defined by the Client
Data integrated from third-party systems connected by the Client

With respect to Client Data, Tegrity Connect LLC acts as a data Processor on behalf of the Client Controller, and GoHighLevel acts as a subprocessor. Our use of Client Data is governed by our contract with the Client, this Policy, and GoHighLevel’s applicable terms.

4.3 Automatically Collected Technical Information

When you access our Services or website, we and our service providers automatically collect:

Device and browser information (type, operating system, browser version, language settings)
IP address and general geographic location
Log data (pages visited, features used, timestamps, referring URLs)
Performance and error data
Cookies and similar tracking technologies (see Section 11)

4.4 Information from Third Parties

We may receive information from third-party sources, including identity verification services, business data enrichment providers, and referring partners.

5. How We Use Information

5.1 Service Delivery and Operations

We use information to provide, operate, maintain, secure, and improve our Services, including account and subscription management, billing, technical support, and system administration.

5.2 Tegrity Connect LLC’s Proprietary Rights to Aggregate and De-Identified Data

Subject to applicable law, any limitations in a signed DPA, and GoHighLevel’s platform terms, Tegrity Connect LLC expressly reserves the following rights:

Aggregation: We may aggregate Service usage data and de-identified Client Data to generate statistical and anonymized insights. Tegrity Connect LLC owns all such aggregated, de-identified data.
Analytics and Benchmarking: De-identified, aggregated data may be used to develop industry benchmarks, improve our products, and create reports, provided no individual Client or consumer is identified.
Machine Learning and AI Improvement: We may use de-identified, aggregated Service usage patterns to train, validate, and improve AI and machine learning models embedded in our Services. Individually identifiable Client Data will not be used for AI training without express written consent.
Product Development: Platform usage analytics and feedback may inform new features, products, and services.
Business Records: We retain account records, contractual agreements, and financial records as required for legal compliance and legitimate business purposes.

Note: Tegrity Connect LLC’s data aggregation rights are exercised at the level of our agency account and platform operations. To the extent GoHighLevel independently retains rights to platform-wide data under its own Terms of Service, those rights are separate from and in addition to Tegrity Connect LLC’s rights described herein.

5.3 Communications

We may use contact information to send transactional messages, product updates, security alerts, and marketing communications (subject to opt-out rights in Section 10).

5.4 Legal and Compliance Purposes

We may use and disclose information to comply with applicable laws, respond to lawful governmental requests, enforce our agreements, and protect the rights and safety of Tegrity Connect LLC, our Clients, Users, and the public.

6. Disclosure of Information

6.1 GoHighLevel (Primary Subprocessor)

By using our Services, you acknowledge and consent that Client Data is disclosed to and processed by GoHighLevel (HighLevel Inc.) as our primary platform infrastructure subprocessor. This disclosure is inherent to the delivery of our Services and is a condition of use. GoHighLevel processes Client Data subject to its own Privacy Policy, Terms of Service, and its agreement with Tegrity Connect LLC as a licensed agency reseller.

6.2 Other Service Providers

We share information with other trusted third-party service providers who assist in operating our Services, including cloud hosting providers, payment processors, analytics vendors, email delivery services, and customer support platforms. All are bound by confidentiality obligations and restricted to using data for specified purposes only.

6.3 Business Transfers

In the event of a merger, acquisition, asset sale, or other business transfer, Client Data and other information may be transferred as part of that transaction, subject to applicable legal notice requirements.

6.4 Legal Disclosures

We may disclose information if required by law, legal process, or governmental request, or to protect rights, property, or safety.

6.5 With Client Direction or Consent

We may share Client Data with third parties as directed in writing by the Client. Clients bear responsibility for ensuring such instructions comply with applicable law.

6.6 What We Do Not Do

Tegrity Connect LLC does not:

Sell personal information to third parties for monetary consideration
Share personal information for cross-context behavioral advertising without consent
Disclose PHI except as permitted by HIPAA and an executed Business Associate Agreement
Use Client Data for our own marketing without consent

7. Tegrity Connect LLC’s Data Rights and Ownership

7.1 Ownership of Service Data

Tegrity Connect LLC owns all Service Data, platform metadata, system logs, and performance analytics generated through operation of our Services and agency account on GoHighLevel’s platform. This ownership right is expressly reserved and is not limited by any client agreement unless a signed, written DPA expressly restricts such use.

7.2 License to Client Data

Clients grant Tegrity Connect LLC a non-exclusive, worldwide, royalty-free license to access, store, process, and use Client Data solely as necessary to provide, maintain, secure, and improve the Services and as otherwise described in this Policy. This license persists for the period necessary to comply with legal retention obligations.

7.3 De-Identification and Anonymization

Tegrity Connect LLC reserves the right to de-identify Client Data in accordance with recognized de-identification standards and to use, retain, and share such de-identified data without restriction. De-identified data is not subject to Client Data return or deletion obligations.

7.4 Aggregated Insights

Aggregated, de-identified analytics derived from multiple Clients’ use of the platform are proprietary to Tegrity Connect LLC, to the extent permitted by our agreement with GoHighLevel and applicable law. Such data does not belong to any individual Client and will not be returned upon termination.

7.5 Limitation: GoHighLevel’s Platform Rights

Tegrity Connect LLC’s data rights described in this Section are subject to the rights GoHighLevel independently retains over its platform and infrastructure under its own Terms of Service. Tegrity Connect LLC makes no representations regarding GoHighLevel’s independent data rights and practices beyond what is disclosed in GoHighLevel’s publicly available terms.

8. HIPAA-Compliant Services and Protected Health Information

HIPAA MODULE NOTICE — Please Read Carefully
Tegrity Connect LLC’s HIPAA-compliant feature set is delivered exclusively through the GoHighLevel HIPAA Module, an optional account-wide add-on provided by HighLevel Inc. at a cost of US$297 per month. This module cannot be disabled once purchased and must remain active for HIPAA compliance obligations to be maintained. If you have not requested and activated the HIPAA Module through Tegrity Connect LLC AND executed a Business Associate Agreement, you are strictly prohibited from storing, transmitting, or processing any Protected Health Information (PHI) through our Services.

8.1 How Tegrity Connect LLC’s HIPAA Service Works

Because our platform is built on GoHighLevel’s infrastructure, HIPAA compliance for our Services operates through a dual-BAA structure:

Layer 1: GoHighLevel – Tegrity Connect LLC BAA

GoHighLevel executes a Business Associate Agreement with Tegrity Connect LLC (as a licensed agency reseller) covering Tegrity Connect LLC’s use of the GoHighLevel HIPAA Module. This BAA is obtained by Tegrity Connect LLC directly through the GoHighLevel platform at the agency level.

Layer 2: Tegrity Connect LLC – Client BAA

Tegrity Connect LLC separately executes a Business Associate Agreement with each Client who requires HIPAA-compliant services. Clients must execute this BAA with Tegrity Connect LLC prior to inputting any PHI into our platform. Tegrity Connect LLC’s Client-facing BAA is layered on top of and consistent with Tegrity Connect LLC’s BAA with GoHighLevel.

This dual-BAA structure means that for HIPAA compliance to be fully maintained, both agreements must be active and in good standing simultaneously.

8.2 Business Associate Agreement Requirement

To use HIPAA-compliant features through Tegrity Connect LLC, Clients must:

Request activation of the HIPAA Module through Tegrity Connect LLC
Execute a written Business Associate Agreement with Tegrity Connect LLC prior to inputting any PHI
Understand that the HIPAA Module subscription is US$297/month, is account-wide, and cannot be disabled once activated
Acknowledge that the underlying HIPAA infrastructure is provided by and dependent on GoHighLevel’s HIPAA Module

8.3 GoHighLevel HIPAA Module: Technical Safeguards Provided

When the HIPAA Module is active, GoHighLevel provides the following technical capabilities within the platform:

Encryption of electronic Protected Health Information (ePHI) within the GoHighLevel platform environment
AES-256 encryption for data at rest and TLS encryption for data in transit
Detailed audit logging of user access and data interactions
Multi-Factor Authentication (MFA) enforcement across the account
Role-based access controls and user permission management
Business Associate Agreement management directly within the GoHighLevel platform interface

Clients may view, sign, download, and manage compliance documentation directly within the platform. HIPAA-ready sub-accounts can only be transferred between agencies where both have the HIPAA Module enabled.

8.4 Tegrity Connect LLC’s Additional Administrative Safeguards

In addition to GoHighLevel’s platform-level technical safeguards, Tegrity Connect LLC maintains the following administrative practices:

Designated point of contact for HIPAA compliance matters (hipaa@tegrityconnect.com)
Workforce access controls limiting PHI access to authorized personnel only
Client onboarding procedures to verify BAA execution prior to PHI access
Incident response procedures for potential PHI breach scenarios
Regular review of GoHighLevel HIPAA Module status and compliance documentation

8.5 Permitted Uses and Disclosures of PHI

Tegrity Connect LLC will use and disclose PHI only as:

Necessary to provide the Services specified in the Client BAA
Required by HIPAA, HITECH, and applicable Virginia health privacy law
Permitted by the terms of the executed BAA
Authorized in writing by the covered entity Client

8.6 Breach Notification

In the event of a Breach of Unsecured PHI (as defined under 45 C.F.R. § 164.402), Tegrity Connect LLC will:

Notify the affected Client without unreasonable delay and no later than sixty (60) calendar days after discovery of the breach
Provide the information required by 45 C.F.R. § 164.410(c) to enable the Client to fulfill its own notification obligations
Cooperate with the Client in investigating the breach and mitigating harm
Coordinate with GoHighLevel as needed in investigating any breach that originates at the infrastructure level

Tegrity Connect LLC’s breach notification obligations are in addition to, and do not replace, any obligations GoHighLevel may have under its BAA with Tegrity Connect LLC.

8.7 Critical Limitations and Client Responsibilities

IMPORTANT LIMITATION: GoHighLevel Infrastructure Dependency
Tegrity Connect LLC’s HIPAA compliance capabilities are entirely dependent on GoHighLevel’s HIPAA Module remaining active, subscribed, and compliant. If Tegrity Connect LLC’s HIPAA Module subscription lapses for any reason, the BAA with GoHighLevel automatically expires and HIPAA-compliant data handling cannot be guaranteed. Clients will be notified immediately of any such lapse.

Clients using HIPAA-compliant features represent and warrant that they will:

Obtain all required patient authorizations and consents prior to inputting PHI
Configure access controls and user permissions appropriately within the platform
Not use third-party integrations (e.g., SMS/email providers like Twilio) with PHI unless those providers are independently verified as HIPAA-compliant and covered by appropriate BAAs
Promptly notify Tegrity Connect LLC of any change in their covered entity status
Comply with all applicable HIPAA provisions applicable to covered entities
Follow the HIPAA “minimum necessary” principle — only storing the minimum PHI required for their specific use case

8.8 Third-Party Integrations and PHI

GoHighLevel integrates with numerous third-party communication and data services (including SMS providers, email delivery services, and others). Clients are solely responsible for ensuring that any third-party integrations used in connection with PHI are independently HIPAA-compliant and covered by appropriate Business Associate Agreements with those providers. Tegrity Connect LLC’s BAA does not extend to GoHighLevel’s third-party integration partners.

9. Data Retention

9.1 Client Data Retention

Tegrity Connect LLC retains Client Data for the duration of the Client’s active subscription. Following termination or cancellation, Client Data stored within the GoHighLevel platform is subject to GoHighLevel’s data retention and deletion policies, in addition to any obligations in our agreement with the Client. Tegrity Connect LLC will use commercially reasonable efforts to facilitate Client data export requests prior to account termination.

Clients are strongly encouraged to export their data prior to terminating their subscription, as Tegrity Connect LLC’s ability to retrieve data post-termination is dependent on GoHighLevel’s platform capabilities and policies.

9.2 PHI Retention

PHI will be retained and disposed of in accordance with the Client’s executed BAA and applicable HIPAA requirements. Tegrity Connect LLC’s obligations with respect to PHI retention and disposal are coextensive with GoHighLevel’s capabilities under the active HIPAA Module.

9.3 Tegrity Connect LLC’s Independent Records

Tegrity Connect LLC independently retains account records, contracts, billing records, and communication logs for periods required by applicable law and legitimate business purposes, typically seven (7) years for financial records.

9.4 De-Identified and Aggregated Data

De-identified and aggregated data derived from Client Data may be retained by Tegrity Connect LLC indefinitely as proprietary business data and is not subject to deletion obligations.

10. Data Subject Rights

10.1 Virginia Consumer Data Protection Act (VCDPA) Rights

Virginia residents have the following rights with respect to personal data Tegrity Connect LLC controls (note: Clients are the Controllers of Client Data concerning their End Consumers):

Right to Know: Confirm whether we process your personal data and access a copy
Right to Correct: Request correction of inaccurate personal data
Right to Delete: Request deletion of personal data you have provided or that we have collected
Right to Data Portability: Obtain a portable copy of your personal data
Right to Opt Out of Targeted Advertising: Opt out of processing for targeted advertising purposes
Right to Non-Discrimination: We will not discriminate against you for exercising your rights
Right to Appeal: If we deny your request, you may appeal within 60 days

Submit verifiable requests to: privacy@tegrityconnect.com. We will respond within 45 days, with a possible 45-day extension upon notice.

Important: For requests relating to data stored in our platform on behalf of a Client (e.g., your contact record in a Client’s CRM account), please contact that Client directly as the Controller. Tegrity Connect LLC will assist Clients in responding to such requests as required by law and our DPA. Note that because Client Data is stored on GoHighLevel’s infrastructure, fulfillment of deletion requests is also dependent on GoHighLevel’s technical deletion capabilities.

10.2 Marketing Opt-Out

You may opt out of marketing communications at any time by clicking the unsubscribe link in any marketing email or by emailing privacy@tegrityconnect.com. Transactional and service messages required for the delivery of our Services will continue.

11. Cookies and Tracking Technologies

We use cookies, pixel tags, and similar technologies to operate and improve our Services. Categories include:

Strictly Necessary Cookies: Required for the Services to function. Cannot be disabled.
Functional Cookies: Enable personalization and preferences.
Analytics Cookies: Collect anonymized usage data to improve our Services.
Marketing Cookies: Support targeted advertising, subject to opt-out rights.

Manage preferences through our cookie consent banner or your browser settings. Restricting certain cookies may impair Service functionality.

12. Data Security

Tegrity Connect LLC implements administrative and operational safeguards to protect information under our direct control. Security of Client Data stored on GoHighLevel’s platform is primarily maintained by GoHighLevel’s infrastructure security practices. GoHighLevel’s HIPAA Module (when active) provides AES-256 encryption at rest and TLS encryption in transit for ePHI.

Tegrity Connect LLC’s independent security measures include:

Role-based access controls for Tegrity Connect LLC personnel
Secure account credentialing and access management practices
Monitoring for unauthorized access to our agency account
Incident response procedures for potential data security events

No security system is impenetrable. In the event of a data breach affecting your information, we will notify you as required by applicable law.

13. Children’s Privacy

Our Services are not directed to children under the age of 13. We do not knowingly collect personal information from children. If you believe we have collected such information without appropriate consent, contact privacy@tegrityconnect.com and we will promptly delete it.

14. Third-Party Links and Integrations

Our Services may contain links to third-party websites or permit integration with third-party services, including GoHighLevel’s native integrations. This Privacy Policy does not apply to third-party sites or services. We encourage you to review the privacy policies of all third parties you interact with through our platform, including GoHighLevel’s own Privacy Policy.

15. International Data Transfers

Tegrity Connect LLC is based in Virginia, United States, and our Services are operated from the United States through GoHighLevel’s U.S.-based infrastructure. If you are accessing our Services from outside the United States, your information will be transferred to, stored, and processed in the United States. By using our Services, you consent to such transfer.

16. Virginia-Specific Privacy Provisions

16.1 VCDPA Compliance

Tegrity Connect LLC complies with the Virginia Consumer Data Protection Act (effective January 1, 2023) with respect to personal data of Virginia residents. Our data processing activities are designed to meet the Controller obligations under Va. Code Ann. § 59.1-577 for data we independently control, and Processor obligations for Client Data.

16.2 Data Processing Agreements

Consistent with Va. Code Ann. § 59.1-578, when acting as a Processor on behalf of a Client, we offer a Data Processing Agreement setting forth the subject matter, duration, nature, and purpose of processing, the types of personal data involved, and the obligations and rights of both parties.

16.3 Data Protection Assessments

We conduct data protection assessments for processing activities presenting heightened risk, including targeted advertising, sale of personal data, and processing of sensitive data, as required by the VCDPA.

16.4 Virginia Data Breach Notification

In the event of a security breach affecting personal data of Virginia residents, we will provide notification in accordance with the VCDPA and Va. Code Ann. § 18.2-186.6, including timely notification to affected individuals and, where required, to the Virginia Attorney General.

17. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our practices, technology, legal requirements, or our relationship with GoHighLevel. We will notify you of material changes by:

Posting the updated Policy on our website with a new “Last Updated” date
Sending an email notification to the primary account contact
Displaying an in-app notification for active Users

Your continued use of our Services after the effective date of a revised Policy constitutes your acceptance. Changes to GoHighLevel’s own Privacy Policy or Terms of Service may affect your data independent of changes to this Policy.

18. Contact Information

For questions, concerns, or to exercise your privacy rights, please contact us at:

Tegrity Connect LLC

Attention: Privacy & Compliance Officer

Email: privacy@tegrityconnect.com

Website: https://www.tegrityconnect.com/privacy

For HIPAA-related inquiries or to report a potential PHI breach:

Email: hipaa@tegrityconnect.com

For Virginia VCDPA rights requests or appeals:

Email: privacy@tegrityconnect.com — Subject: VCDPA Rights Request – [Your Name]

For questions regarding GoHighLevel’s data practices:

GoHighLevel Privacy Policy: https://www.gohighlevel.com/privacy-policy

By using Tegrity Connect LLC’s Services, you acknowledge that you have read and understood
this Privacy Policy, including the disclosures regarding GoHighLevel as our platform infrastructure subprocessor, and agree to be bound by its terms. If entering into this Policy on behalf of a business entity, you represent that you have authority to bind that entity.