Skip to content
Request Consultation
Panel A · Legal

Privacy Policy

Last updated 2026-10-13

This policy explains how we handle information from our website and ordinary business inquiries. Patient information handled for a healthcare client is subject to separate project arrangements and applicable law.

Panel A operates panelastudios.com as a production business serving healthcare, brands, agencies and documentary projects. This policy covers our public website, consultation requests and ordinary business communications. The Panel A legal party for a production is identified in its signed agreement.

We share team members and business administration with our sister company, Carscenez. The companies remain separate. Relevant inquiry information can be handled by authorized staff in our shared contact, conversation and project administration systems. A shared platform does not make an ordinary inquiry a healthcare record system or make another company a party to your production agreement.

This policy is not a healthcare provider's Notice of Privacy Practices, a patient authorization or a Business Associate Agreement (BAA). It does not authorize medical disclosure or public use of a patient story. Our Terms of Service describe website use and how project agreements are formed.

Our project inquiry asks for your name, email and a project message. You may also provide your organization, phone number and project type. A consultation request identifies your interest in arranging a call; you can describe general availability in your message. Please provide business details you have authority to share.

If you contact us by email or phone, we receive the contact details and content you provide, including a voicemail if you leave one. During a production engagement, we may also receive project correspondence, approvals, agreements, rights evidence, billing contacts and materials under the project arrangement. Do not send account passwords, payment-card details or unnecessary identity documents through an inquiry.

Do not submit patient names, medical records, photographs, insurance identifiers, treatment details or other PHI through this form, ordinary email, text or voicemail. Start with a general business description. Contact us without patient details to coordinate a provider-approved transfer method and any required agreements before sensitive material is shared.

When you visit, our hosting, network and media providers receive information needed to deliver pages and files, such as your IP address, request time, requested resource, browser/device information and available referrer information. Our public reel and images can load from our shared Cloudflare media infrastructure at cdn.carscenez.com. Those requests are separate from the inquiry message you send. Fonts are served with the site.

Inquiry processing uses a request identifier and a message-derived hash to reduce duplicate submissions. For abuse prevention, the server processes an IP-derived keyed value and request counts to limit submissions. Those identifiers are not a claim that the underlying information is anonymous. Service providers may maintain operational and security logs under their arrangements.

The dedicated public Panel A site does not embed advertising pixels, PostHog analytics or session replay in this version. It does not use cross-site advertising tracking. If we add optional analytics or advertising tools, we will update this policy and provide legally required information and choices before their use. The separate staff administration website has its own information practices.

The site uses local browser storage to remember your reduced-motion preference and session storage to restore a reading position and open sections. These settings support the page experience; they do not store your inquiry message for an advertising profile. Your browser may supply its own autofill or saved-form behavior, which we do not control.

You can clear or restrict cookies and browser storage through your browser settings. That can reset preferences or reading positions. Network and inquiry security processing still occurs when you request pages or submit an inquiry. We do not claim that every browser Do Not Track signal changes server logging or these functional settings. Applicable privacy rights and legally required preference signals remain respected where they apply.

We use ordinary inquiry information to respond, arrange a conversation, understand and scope the project, maintain correspondence, avoid duplicate requests and connect the request to the appropriate Panel A business records. Sending a consultation request does not automatically book an appointment. If we enter an agreement, we use the agreed information to plan and deliver the production, obtain approvals and clearances, administer billing and preserve appropriate records.

We also use limited information to operate the site, prevent abuse, investigate technical or security problems, resolve disputes and meet legal obligations. We do not sell personal information or share it for cross-context behavioral advertising. We do not use an inquiry as permission to publish your project, identify a patient or train a model on your content.

Providing contact information allows us to respond about your request. It does not execute a production contract or enroll you in an automated promotional text program. Separate promotional communications, if offered, require the applicable permission and an appropriate way to opt out. You can ask us to stop optional promotional contact while necessary project or legal communications may continue.

Authorized team members use our shared business administration tools to handle inquiries and projects. Our inquiry service uses Supabase for server processing and business records. Website hosting uses Vercel, and public media delivery uses Cloudflare. Business email and ordinary correspondence may be handled through our workspace and communication providers. These providers receive the information needed for the service they perform.

For a signed production, approved crew, editors, advisors, delivery providers and project recipients may receive relevant information as assigned in the agreement and subject to applicable confidentiality and rights restrictions. Ordinary vendor use is not a representation that a provider is approved to receive PHI or has executed the required BAA. A healthcare project needs its own approved systems and downstream arrangements.

We may disclose information when law or lawful process requires it, to protect lawful rights or investigate abuse, or as part of a lawful business transaction subject to applicable confidentiality and privacy requirements. Where appropriate and lawful, we limit disclosures to their purpose. We do not provide inquiry contact information to unrelated businesses for their independent marketing.

Links to external sites and your decision to open an email or phone application are governed by those services' practices. Publishing a cleared film on the agreed channels necessarily discloses its approved content to its intended audience; that requires the separate production and subject permissions.

We may handle patient material for an authorized healthcare production under applicable law and the signed client arrangements. Before access, the healthcare party and our team must confirm our legal role, lawful purpose, required patient authorizations, BAA, systems, recipients and retention instructions. A medical subject does not by itself determine whether information is PHI or whether a BAA applies.

When acting as a business associate, we handle PHI for the permitted services and follow the BAA, including appropriate safeguards, required incident reporting, rights assistance, downstream duties and return or destruction. These are project obligations, not a statement that our ordinary website, email, public CDN or every service provider is suitable for PHI.

We do not receive an automatic portfolio or independent marketing right in patient material. Public disclosure requires the applicable specific patient authorization, underlying permissions and healthcare client privacy approval. Purpose limits, expiration and lawful revocation govern future use. Neither an appearance release nor a BAA replaces patient authorization. Already distributed public copies may be difficult to recall; lawful future-use restrictions still apply.

For patient access, correction, accounting, restriction or authorization revocation, contact the healthcare provider identified in your production paperwork. If you contact us directly, we coordinate with that party as required rather than deciding a clinical record request ourselves. If sensitive material was sent accidentally, contact us without repeating it so we can assess the incident and coordinate appropriate handling.

We keep ordinary business information for the purposes described here, including inquiry follow-up, an ongoing business relationship, contract and rights evidence, accounting, dispute resolution, security and legal requirements. The appropriate period depends on the record, relationship and applicable obligation. We review removal requests against those needs; we do not promise instant deletion of every business record or backup.

A production agreement sets footage, working-file and delivery retention separately from legal-record retention. Production storage follows the agreed retention schedule, subject to applicable law. PHI follows the BAA's return/destruction directions and any documented lawful reason destruction is infeasible. Required retained material remains protected and limited to its justified purpose.

Removing a record from active use may not immediately remove a restricted backup, a legal hold or a copy already lawfully provided to an authorized recipient. We address those copies under the relevant agreements and law. We cannot guarantee retrieval of every authorized public copy of a film.

We use reasonable safeguards suited to the information and the service, and limit business access to authorized people. No website, transmission or storage system can guarantee absolute security. Do not treat an ordinary contact channel as a secure route for patient records or highly sensitive material.

Healthcare production safeguards must be documented and verified in the applicable BAA operating schedule before use. That includes the actual devices, access controls, storage, review, transfer, vendors, incident contacts and deletion process. Signing a document does not by itself establish that those controls operate or certify HIPAA compliance.

We operate in the United States. Our service providers and authorized project recipients may process information in locations where they operate, which can involve transfer outside your state or country. A project with special location or transfer requirements must document them before collection; this policy does not promise that all ordinary information remains in one state or a particular data center. If a reportable incident occurs, we follow the applicable notice duties and project agreements.

You can choose not to submit an inquiry, leave optional fields blank, contact us another way, change browser storage settings or ask us to correct ordinary contact information. We need sufficient details to respond and may be unable to arrange a project without required information.

Depending on the law that applies to you and to our business, you may have rights to access or receive a copy of personal information, correct it, request deletion, restrict or object to certain processing, or exercise other privacy choices. Contact hello@panelastudios.com with the request and your relationship to us. Do not include PHI or unnecessary identity documents. We verify identity and representative authority proportionately, respond within applicable deadlines, explain any lawful limits, and provide a legally required appeal process where applicable.

A request does not automatically override required contract, tax, clearance, security or preservation records or another person's rights. We will not unlawfully discriminate for exercising an applicable privacy right. Patient and clinical-record rights follow the healthcare contact and BAA process described in Section 7.

Our public inquiry service is intended for adult business contacts and is not directed to children under 13. We do not knowingly solicit children's personal information through it. If you believe a child submitted information, contact us so we can assess and remove it as appropriate, subject to applicable obligations.

A child appearing in a production is a different situation. Participation requires the appropriate guardian authority, work and welfare protections, permissions and, where relevant, healthcare authorization. Do not send a child's patient details through the website. A parent's signature does not automatically authorize every kind of minor medical disclosure.

We identify policy versions by date and update this policy when our ordinary information practices change. Where law requires additional notice or consent for a change, we provide it. A policy update does not amend an existing BAA, override a signed project restriction or grant a new patient or portfolio permission.

For ordinary website privacy questions, requests or accidental-submission concerns, contact hello@panelastudios.com or (602) 497-0331. Our business address is 7201 W Oakland St, Suite 4, Chandler, AZ 85226. For urgent project incidents, use the specific privacy/security contacts in your agreement. Describe the concern without repeating patient information through an ordinary channel.