Legal
Privacy Notice
What we collect, why we collect it, who sees it, and what you can ask us to do about it. Last updated [CONFIRM: effective date].
What we collect
AccountName, email address, password, the community affiliation you choose, and billing details. Payment card details are handled by our payment processor, [CONFIRM: payment processor] — we do not store card numbers.
ListingLocation, subspecialty and roles, education and credentials, résumé or CV, LinkedIn link, company logo, screening status. Provider listings also include a photograph and introductory video. This information is published to other members — that is its purpose.
AcademyEnrollment, progress, assessment and examination records, and any accommodation request you make.
WorkflowProvider credentialing and enrollment records you enter about your own clients — licenses, coverage, attestations, filings and dates.
TechnicalIP address, browser and device type, pages visited, and dates and times. [CONFIRM: analytics provider, or state that none is used]
We do not want patient information. This site and Workflow are built for provider credentialing and enrollment data. Do not submit protected health information through this site. Where an engagement requires PHI in Workflow, a business associate agreement must be executed first.
Why we use it
Each purpose below is the reason a specific category above exists. We do not repurpose data outside these.
To provide the serviceRun your account, deliver courses, operate Workflow, publish your listing, and take payment.
To verifyOrder and record background screening, and confirm the credentials shown on a listing.
To communicateService messages about your account, your courses and changes to terms. Marketing email only where you have opted in, and every marketing message carries an unsubscribe link.
To improve and secureDiagnose faults, prevent abuse, and understand which pages are used.
To meet obligationsTax, accounting, and responding to lawful requests.
We do not sell personal information, and we do not share it with advertisers or data brokers.
Who we share it with
Other membersYour listing is visible to members on the other side of the directory. That is what it is for. What appears is limited to the fields listed above.
CheckrBackground screening is ordered through DutyPath's Checkr account and completed by you on Checkr's own platform, under Checkr's privacy terms. We receive the result and record status.
Service providersPayment processing, hosting, email delivery and analytics, each under contract and limited to what the service requires. [CONFIRM: name the processors used]
CIFPOWhere you sit the CFPO examination, the records needed to administer and award the credential.
Nonprofit affiliationsVeterans Desk, Inc. and Mendry, Inc. are separate organizations with their own privacy practices. [CONFIRM WITH COUNSEL: exactly what member data, if any, passes to an affiliation — state it here or state that none does]
LegalWhere required by law, or to protect rights and safety. In a sale or merger, to the acquiring party under equivalent obligations.
Your choices, retention and security
Access and correctionYou can view and edit most of your listing in your account. For anything else, write to [CONFIRM: privacy contact email] and we will respond within [CONFIRM: response window, commonly 30 or 45 days].
DeletionYou can ask us to close your account and remove your listing. Some records — payment, tax, examination and screening — are kept for the periods below even after closure.
MarketingUnsubscribe at any time. Service messages about an active account continue.
State rightsVirginia residents, and residents of other states with comprehensive privacy laws, have rights of access, correction, deletion, portability and appeal. [CONFIRM WITH COUNSEL: VCDPA applicability thresholds and appeal process]
RetentionAccount and listing data for as long as the account is open; financial records [CONFIRM: retention period]; academic and examination records [CONFIRM: retention period]; screening records [CONFIRM: retention period].
SecurityEncryption in transit, access limited to those who need it, and separation between clients in Workflow. No system is perfect; we will notify affected people and regulators of a breach as the law requires.
ChildrenThis service is not directed at anyone under 18 and we do not knowingly collect their information.
Cookies. [CONFIRM: cookie categories used, and whether a consent banner is required — depends on the analytics decision above]