Privacy Notice
RecordVanta is designed so that your health information stays inside your member account and under your control. This notice describes our practices, including the notices required by state consumer-health-data laws.
What we collect
- Account information: name, email address and sign-in details provided by our identity provider.
- Membership and billing: subscription status and payment confirmations from our payment processor. RecordVanta never stores card numbers.
- What you enter: conditions, record inventory entries, journal notes, appointments, providers and medications, your claim stage and the VA letters you track, tasks and learning progress.
- Technical information: request identifiers, hashed before storage, used for security and rate limiting.
How we use it
To provide the service you signed up for, to send the reminders and updates you choose, to keep the service secure, and to meet legal obligations. We do not sell your information and we do not use health information for advertising.
What leaves the service
Emails and notifications carry counts and reminders, never the content of your records. Analytics receive page and feature usage without health content. Staff access to member data is limited, logged and only with your explicit, time-limited consent.
If Analyze is available to you and you choose to use it, the records you add to a run are read by Amazon Web Services tools to turn scanned pages into text and to find identifiers; names, Social Security and file numbers, dates of birth, addresses, phone numbers, e-mail addresses and other direct identifiers are then replaced with placeholders, and the placeholder text goes to the service that writes the report. The replacement is thorough but not perfect: in rare cases an identifier can reach that service and appear in the report. The files are deleted once they have been read, and anything left behind is removed automatically within two days. The notice you accept before each run repeats all of this.
Service providers
We use a small set of providers to run RecordVanta, including hosting, database, identity, payment and email services. Each is bound by a data-processing agreement. The current list is maintained with this notice. When Analyze is enabled, Amazon Web Services (text recognition and medical-identifier detection) and the provider that writes the report join that list, configured and contracted not to keep or train on your data.
Your choices
- Export a copy of your data from your privacy settings.
- Delete your account and its data from your privacy settings.
- Unsubscribe from any email with one click.
Records and uploads
Members inventory their records; file uploads and Analyze are offered only when enabled for your account. Uploaded files are private, encrypted, deletable by you and covered by this notice as updated. An Analyze report is health information about you: it is kept under your account like your journal, included in your data export, deleted when you delete it or close your account, and never shared.
Contact
Privacy questions can be sent through the contact page.