Privacy Policy

Effective date: 07/25/2036 · This policy covers the AttestRx website and the account/operational data of our clients. Patient health information handled inside the AttestRx service is governed by each client's Business Associate Agreement, not this policy.

1. Two Kinds of Data, Two Sets of Rules

Website & business data (this policy): information you submit through our contact form, account and billing information for clients, support conversations, and technical logs.

Protected Health Information (PHI) (the BAA): patient signatures, dose records, and related clinical documentation processed on behalf of client practices. We act as a business associate; the clinic is the covered entity and owns those records. PHI is encrypted in transit and at rest, held on HIPAA-eligible AWS infrastructure, protected by access controls and audit logging, with signature evidence in write-once storage.

2. What We Collect on the Website

• Contact form: name, clinic name, email, phone, state(s), EMR software, and your message — used solely to respond to your inquiry.
• Anti-spam: the form uses Cloudflare Turnstile, which processes technical signals to distinguish humans from bots (see Cloudflare's privacy policy). We also log the IP address and time of submissions to prevent abuse.
• Server logs: standard web-server logs (IP, page, timestamp) retained briefly for security and troubleshooting.
• Cookies: the marketing site sets no advertising or analytics tracking cookies. The client portal uses strictly necessary session cookies to keep you signed in.

3. How We Use It

• To respond to inquiries and schedule calls you request.
• To provide, secure, bill, and support the service for clients.
• To meet legal obligations and enforce our terms.

We do not sell personal information, and we do not share it for advertising.

4. Who We Share With

Service providers that help us operate, under appropriate agreements: Amazon Web Services (hosting; BAA in place for PHI), Stripe (payments — billing data only, never patient information), Cloudflare (DNS, email routing, and Turnstile), and email delivery providers. We disclose information if required by law, and in a business transfer your data would remain subject to this policy.

5. Retention

• Contact-form inquiries: retained while we correspond and for a reasonable period after.
• Client account and billing records: for the life of the account plus periods required for tax and legal purposes.
• PHI: retained per the client's instructions, the BAA, and controlled-substance record-retention requirements (typically seven years), including the read-only Archive option after cancellation.

6. Security

Encryption in transit (TLS) and at rest, least-privilege access, multi-factor authentication on administrative access, immutable audit logging, and tested backups. No method is 100% secure, but security is the product here — we hold ourselves to the standard we sell.

7. Your Choices and Rights

Email [email protected] to access, correct, or delete information you've submitted through the website, or to opt out of further contact. Patients seeking access to their clinical records should contact their clinic, which is the record owner; we support clinics in fulfilling those requests. We honor applicable state privacy rights.

8. Children

The website and service are for businesses and are not directed to children under 13; we do not knowingly collect their information through the website.

9. Changes and Contact

We'll post updates here with a new effective date, and notify clients of material changes. Questions: [email protected].