At HIPAADesk.app, we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our HIPAA-compliant help desk platform.
Quick Contact
Questions about this Privacy Policy? Contact us at support@hipaadesk.app
1. Information We Collect
1.1 Personal Information
We collect information that identifies you personally, including:
- Account Information: Name, email address, phone number, job title, department
- Authentication Data: Password (encrypted), two-factor authentication settings
- Profile Information: Profile picture, preferences, acknowledgment of policies
1.2 Organization Information
- Organization name, domain, and contact information
- Subscription plan and billing information
- HIPAA compliance status (BAA signing, policy acknowledgments)
1.3 Support Ticket Data
- Titles, descriptions, and content you submit
- Attachments and files you upload
- Comments and communications
- Metadata (dates, times, priorities, categories)
1.4 Usage Data
- Access logs and login history
- Browser type and device information
- IP address and location data
- Features used and interaction patterns
2. How We Use Your Information
We use your information for the following purposes:
- Service Delivery: To provide, maintain, and improve our help desk services
- Account Management: To create and manage your account, verify your identity
- Communication: To send you notifications about tickets, updates, and support requests
- Security: To detect and prevent fraud, unauthorized access, and security threats
- Compliance: To maintain HIPAA compliance and meet legal obligations
- Analytics: To understand how our services are used and improve user experience
- Billing: To process subscription payments and manage billing
3. HIPAA Compliance
Our HIPAA compliance measures include:
- Encryption of data at rest and in transit
- Access controls and audit logging
- Two-factor authentication options
- Regular security assessments
- Employee training on HIPAA requirements
- Incident response procedures
4. Information Sharing
4.1 We Share Information:
- With Your Organization: Your account is associated with your organization; administrators can see your activity
- With Service Providers: Third parties who help us operate (hosting, payment processing)
- For Legal Reasons: When required by law, court order, or government regulation
- To Protect Rights: To enforce our Terms, investigate potential violations, or protect safety
4.2 We Do NOT:
- Sell your personal information to third parties
- Share your data for advertising purposes
- Use your PHI for any purpose other than providing our services
5. Data Security
We implement comprehensive security measures:
- Encryption: TLS 1.3 for data in transit; AES-256 for data at rest
- Access Controls: Role-based access control (RBAC), principle of least privilege
- Authentication: Secure password storage (bcrypt), optional two-factor authentication
- Monitoring: Audit logging of all access and modifications
- Regular Testing: Security assessments and vulnerability scanning
6. Data Retention
We retain your information as long as your account is active or as needed to provide services:
- Account Data: Retained while account is active; deleted within 30 days of account closure
- Tickets & Content: Retained per organization settings and legal requirements
- Logs: Retained for 12 months for security purposes
- HIPAA Records: Retained as required by law (minimum 6 years)
7. Your Rights
You have the following rights regarding your data:
- Access: Request a copy of your personal data
- Correction: Request correction of inaccurate data
- Deletion: Request deletion of your personal data (subject to legal requirements)
- Export: Request export of your data in a portable format
- Restriction: Request restriction of processing
- Objection: Object to processing for legitimate interests
To exercise these rights, contact us at support@hipaadesk.app.
8. Cookies and Tracking
We use cookies and similar tracking technologies:
- Essential Cookies: Required for authentication and security
- Functional Cookies: Remember preferences and settings
- Analytics Cookies: Help us understand how users interact with our services
You can control cookies through your browser settings.
9. Third-Party Services
Our service may include links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies.
10. Children's Privacy
Our services are not intended for individuals under 18 years of age. We do not knowingly collect personal information from children.
11. International Data Transfer
Your information may be transferred to and processed in countries other than your country of residence. We ensure appropriate safeguards are in place for such transfers, including Standard Contractual Clauses and adequacy decisions.
12. Changes to This Policy
We may update this Privacy Policy periodically. We will notify you of material changes by:
- Posting the updated policy on our website
- Updating the "Last Updated" date
- Sending you an email notification (for significant changes)
13. Contact Information
For questions, concerns, or requests regarding this Privacy Policy:
- Email: support@hipaadesk.app
- Website: https://hipaadesk.app
- Mail: Protego Technologies, LLC
14. Dispute Resolution
Any disputes regarding privacy will be resolved through binding arbitration in accordance with our Terms of Service.
15. California Privacy Rights
California residents have additional rights under the California Consumer Privacy Act (CCPA):
- Right to know what personal information we collect
- Right to delete your personal information
- Right to opt-out of sale of personal information (we do not sell your data)
- Right to non-discrimination for exercising privacy rights
16. EU/UK Data Protection
For users in the EU/UK, we comply with GDPR and UK GDPR:
- Legal basis for processing (contract, consent, legitimate interest)
- Data Protection Officer contact: dpo@hipaadesk.app
- Right to lodge a complaint with data protection authorities
- International data transfer safeguards