LEGAL
Privacy Policy
How Healthdex collects, uses, protects, and retains information.
1. Scope
This Policy covers the public Healthdex website, account administration, and the Healthdex platform. It does not govern third-party websites, source publishers, or services linked from Healthdex.
2. Information we collect
We collect account information such as name, email address, organization, role, password hash, account status, and policy acceptance history. We record authentication, session, administrative, workflow, and audit events needed to operate and secure the service. Marketing-site analytics include page, timestamp, referring domain, campaign parameters, browser family, operating system, device category, viewport, language, timezone, and approximate country, region, and city.
3. Geographic analytics
For marketing-site visits, an IP address may be processed transiently against a locally maintained GeoLite database to derive approximate geography. Healthdex does not store the raw IP address, precise coordinates, postal code, full user-agent string, or the complete referring URL in its analytics database. Daily rotating one-way hashes support aggregate visitor and session counts.
4. Cookies and browser storage
The platform uses a secure session cookie to authenticate signed-in users. The public site uses session storage for an analytics session identifier and local storage to remember dismissal of the privacy notice. Marketing analytics are first-party and cookieless, and the tracker honors the browser’s Do Not Track setting.
5. How information is used
Information is used to provide and secure accounts, enforce tenant access, operate analytical workflows, troubleshoot errors, maintain auditability, understand aggregate website use, improve content and product design, respond to inquiries, and comply with legal obligations. Healthdex does not sell personal information or use platform account data for targeted advertising.
6. No PHI
Healthdex is designed for public, licensed, aggregate, synthetic, and appropriately de-identified information. Users are prohibited from submitting protected health information, patient-identifiable claims, or other patient-level identifiers. If prohibited information is discovered, Healthdex may quarantine or delete it and suspend the related workflow.
7. Disclosure and service providers
Information may be disclosed to infrastructure, hosting, security, and professional-service providers that support the service; to an organization administering its users; when required by law; to protect rights and security; or as part of a corporate transaction. Providers receive only the access reasonably needed for their work and are expected to protect the information.
8. Retention
Account, session, security, audit, workflow, and analytics records are retained according to operational and contractual requirements. Marketing analytics currently use the configured retention period shown in the Site Analytics administration area and are deleted automatically when expired. Records may be retained longer when required for security investigation, legal obligation, dispute resolution, or enforcement.
9. Security
Healthdex uses access controls, tenant-scoped authorization, secure password hashing, session controls, CSRF protection, restricted secrets, audit records, and other administrative and technical safeguards. No system is completely secure, and the pilot does not currently offer SSO, MFA, verified email, or outbound email recovery.
10. Your choices and rights
You may enable Do Not Track for public-site analytics, request correction of account details through your administrator, and contact Healthdex regarding access, deletion, or other privacy rights. Rights vary by jurisdiction and may be subject to identity verification, organizational control, legal exceptions, and retention obligations.
11. Children
Healthdex is a business service and is not directed to children under 13. We do not knowingly collect personal information from children.
12. Changes and contact
Material changes will receive a new version and may require platform users to accept the revised Policy. Questions or privacy requests may be sent to hello@healthdex.com.