Privacy policy
This policy explains what [Org Data Solutions legal entity name] collects about the clinics that use Tracker for SPRAVATO® and the people who work there, and what we do with it. Patient information that clinics enter is not covered here: it is protected health information, handled only on the clinic's behalf under our Business Associate Agreement.
What we collect
- Clinic and account details — the clinic's name, address and NPI, and each user's name, e-mail address and role.
- Billing details — collected and stored by our payment provider. We receive the card brand, last four digits and payment status, never the full card number.
- Agreement records — who accepted our terms and business associate agreement, their title, when, from which network address, and which version.
- Security and usage records — sign-in attempts and outcomes, network address and browser type, and which pages of the Service are opened (addresses only, with record numbers replaced). We use them to protect accounts and to run the Service.
Cookies
We use only cookies the Service needs: the signed-in session, security cookies that protect forms and two-factor sign-in, and one cookie that remembers which clinic address this browser last opened. We use no advertising or third-party analytics cookies, and the site loads nothing from other companies' servers.
How we use it
- to provide, secure and support the Service and to bill for it;
- to send messages about your account, your clinic's alerts, security and changes to these policies;
- to understand, in aggregate, how the Service is used so we can improve it.
We do not sell personal information and do not use it for advertising.
Who we share it with
Only the service providers that help us run the Service, under contract and only for that purpose — our payment provider, our e-mail delivery provider and our hosting and backup providers [list] — and authorities when the law requires it. Providers that could come into contact with protected health information sign a business associate agreement with us.
How long we keep it
Account and agreement records are kept while the clinic has an account and for [6] years after, to meet legal and HIPAA documentation requirements. Security and usage records are kept for [12] months.
Your choices
Users can ask their clinic administrator to correct or remove their account. Anyone can write to us to ask what we hold about them, or to correct or delete it, at support@orgdatasolutions.com; we answer within [30] days.
Security
The safeguards are described on our security page.
Changes
We will e-mail clinic administrators about material changes before they take effect.