Privacy Policy

1. Information We Collect

1.1 Information You Provide to Us

• Account Information: When you register, we collect your email address and password (stored securely as a hash).
• Profile Information: Name, professional details, and preferences you choose to provide.
• Financial Data: Production amounts, payment records, expense information, and clinic details that you enter into the Service.
• Uploaded Documents: Files you upload for record-keeping purposes. You are solely responsible for ensuring these documents do not contain Protected Health Information (PHI).
• Communications: When you contact us, we may collect your email address and the content of your messages.

1.2 Information Collected Automatically

• Usage Data: Pages visited, features used, time spent on pages, and other usage statistics.
• Device Information: Browser type, operating system, device type, and IP address.
• Cookies and Tracking Technologies: We use cookies, local storage, and similar technologies to provide and improve the Service. See Section 10 for details.

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service
• Process your transactions and manage your account
• Generate reports and analytics based on your data
• Improve, personalize, and expand our Service
• Understand and analyze how you use our Service
• Develop new products, services, features, and functionality
• Communicate with you, including for customer service and support
• Send you updates and marketing communications (with your consent)
• Detect, prevent, and address technical issues and security threats
• Comply with legal obligations

3. How We Share Your Information

We do not sell your personal information. We may share your information only in the following circumstances:

• Service Providers: Third-party vendors who help us operate the Service, such as our hosting provider (Vercel) and Google (sign-in, Google Drive storage, and optional document scanning).
• Legal Requirements: When required by law, court order, or governmental regulation.
• Protection of Rights: To protect the rights, property, or safety of AssociateSafe, our users, or others.
• Business Transfers: In connection with a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity.
• With Your Consent: When you have given us explicit permission to share your information.

4. Data Security

We implement appropriate technical and organizational security measures to protect your personal information, including:

• Encryption of data in transit (HTTPS/TLS)
• Encryption of data at rest
• Row Level Security (RLS) to ensure users can only access their own data
• Secure password hashing
• Regular security assessments

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee its absolute security.

5. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you with the Service. We may also retain and use your information as necessary to:

• Comply with legal obligations
• Resolve disputes
• Enforce our agreements

Upon account deletion, we will delete or anonymize your personal information within 30 days, except where we are required to retain it for legal purposes.

6. Your Privacy Rights

Depending on your location, you may have the following rights regarding your personal information:

• Right to Access: Request a copy of the personal information we hold about you.
• Right to Rectification: Request that we correct inaccurate or incomplete information.
• Right to Deletion: Request that we delete your personal information, subject to certain exceptions.
• Right to Data Portability: Request a copy of your data in a structured, machine-readable format.
• Right to Opt-Out: Opt out of marketing communications at any time.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise any of these rights, please contact us at support@associatesafe.com. We will respond to your request within 30 days.

7. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know: You have the right to request information about the categories and specific pieces of personal information we have collected about you in the past 12 months.
• Right to Delete: You have the right to request deletion of your personal information, subject to certain exceptions.
• Right to Correct: You have the right to request correction of inaccurate personal information.
• Right to Opt-Out of Sale: We do not sell your personal information. However, you have the right to opt out if we ever do.
• Right to Limit Use of Sensitive Personal Information: You may request that we limit the use of sensitive personal information.

Categories of Information Collected: In the past 12 months, we have collected: identifiers (email), professional information, financial information (that you provide), and internet activity information.

Do Not Track: We currently do not respond to "Do Not Track" signals, but you can manage cookies through your browser settings.

8. International Users (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR):

• Legal Basis for Processing: We process your personal data based on: (a) your consent, (b) the necessity to perform our contract with you, (c) our legitimate interests, or (d) compliance with legal obligations.
• Right to Withdraw Consent: Where we rely on consent, you may withdraw it at any time.
• Right to Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority.
• Data Transfers: Your information may be transferred to and processed in the United States, where data protection laws may differ. By using the Service, you consent to this transfer.

9. Health Information Disclaimer

You are solely responsible for:

• Ensuring that any documents you upload do not contain Protected Health Information (PHI), including patient names, contact information, medical records, or any other individually identifiable health information.
• Redacting or removing all PHI before uploading documents to the Service.
• Complying with HIPAA and any other applicable privacy regulations if you are a covered entity or work for one.

We do not monitor, review, or filter the content of uploaded documents. Any PHI that you upload is uploaded at your own risk and against our Terms of Service.

10. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to track activity on the Service and hold certain information. Types of cookies we use include:

• Essential Cookies: Required for the Service to function (e.g., session management, authentication).
• Analytics Cookies: Help us understand how visitors interact with the Service to improve user experience.
• Preference Cookies: Remember your preferences and settings (e.g., dark mode).

You can instruct your browser to refuse all cookies or indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some portions of the Service.

11. Third-Party Services

The Service may use or integrate with third-party services, including:

• Google: Sign-in (OAuth), Google Drive file storage — your documents and data live in your own Google Drive — and optional Cloud Vision document scanning (Privacy Policy)
• Vercel: Hosting and deployment (Privacy Policy)

Each third-party service has its own privacy policy. We encourage you to review their policies.

12. Children's Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children under 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us so we can delete it.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date.

For material changes, we will provide notice via email or through the Service before the changes become effective. Your continued use of the Service after such modifications constitutes your acceptance of the updated Privacy Policy.

14. Contact Us

If you have any questions about this Privacy Policy or our privacy practices, please contact us at:

• Email: support@associatesafe.com

For privacy-related requests, please include "Privacy Request" in the subject line. We will respond to verified requests within 30 days.