Less data. Visible boundaries. One clear path to request action.
This notice explains what information Credalyst Health LLC handles, where it comes from, why it is needed, who may receive it, and how long it is kept. It does not replace customer terms or turn a non-regulated relationship into one governed by HIPAA.
Scope and roles
Who this notice covers and when we act for a customer.
Who we are
Credalyst Health LLC (“Credalyst,” “we,” “us”) operates credalysthealth.com, its localized pages, the customer portal, and the services described on this site.
When Credalyst decides
Credalyst determines how site data, business inquiries, accounts, billing records, and service communications are handled to operate its business. This notice applies to that handling.
When we act for a customer
When we handle information a customer provides for a service, the customer may determine the purpose and Credalyst acts under its instructions, the signed agreement, and applicable law. Requests involving data controlled by a customer may be directed to that customer.
What this does not cover
Third-party sites and services have their own notices. This site is intended for organizations and professionals, not consumers seeking medical care or children.
Data we handle
Categories, sources, purposes, recipients, and retention.
| Context | Data and source | Purpose and recipients | Retention |
|---|---|---|---|
| Public visit | Technical request data from the browser or network; allowlisted first-party event, safe path, and optional commercial door. | Delivery, security, reliability, and internal measurement; hosting, security, and observability systems. | Only as long as needed to operate, protect, diagnose, and meet obligations; aggregate metrics may be kept longer. |
| Inquiry | Name, work email, organization, role, interest, question, locale, and source path; provided by you. | Qualify, review, and respond; authorized Credalyst personnel and necessary email providers. | 180 days; expired records are excluded from the active record. |
| Account and service | Business identity, organization, role, email, CCN, authorizations, account activity, deliverables, and agreed evidence; from you, your organization, CMS, and the service. | Authenticate, deliver work, limit access, preserve traceability, support, and perform the agreement; role-limited providers. | Based on purpose, agreement, necessary traceability, legal obligations, disputes, and legal holds. |
| Payment | Email, organization, CCN, product, and transaction data; Stripe directly collects the payment, billing, device, and fraud-prevention data its experience requests. | Create, verify, and reconcile payments or subscriptions; Credalyst, Stripe, financial institutions, and payment providers. | Business and legal records under the agreement and law; Stripe retains data under its own notice. |
| Communications | Email or mobile number, consent, service content, and delivery status; from you, your organization, and providers. | Operational, account, or service messages; email and messaging providers such as Resend or Twilio when enabled. | While needed for service, consent, suppression, security, audit, or applicable law. |
| Authorized evidence | Public CMS records and, only in an authorized workspace, evidence the customer agrees to provide. Contract Labor Recovery may involve sensitive or regulated invoice evidence. | Produce agreed work, verify claims, and preserve an evidence trail; access limited to authorized personnel and providers. | Under signed terms, purpose, law, and any applicable return or deletion obligation. |
We do not intentionally collect patient, resident, or workforce information through the public form. Do not place PHI, credentials, invoice files, or other sensitive records in an inquiry, search, or undesignated field.
Site, storage, and analytics
What happens during a visit and what depends on your choice.
Essential operation
The site receives technical request data needed to deliver and protect the service. Our first-party event rail accepts only approved event names, a path without query strings, and limited categorical properties. It rejects contact values, free text, email addresses, organization names, CCNs, and PHI. These first-party events may operate even when you decline optional analytics.
Optional pseudonymous measurement
With your permission, PostHog receives allowlisted events and sanitized properties to understand navigation, recommendations, and conversions. We do not send the search question, email, organization, CCN, or inquiry content. We disable autocapture, session replay, and automatic page views, and do not create profiles for unidentified events. After a consented inquiry, an opaque inquiry ID may connect the conversion without sending contact fields. PostHog may process technical or device identifiers as part of its service, so we do not describe this measurement as anonymous.
Your signals and choice
Do Not Track and Global Privacy Control block optional measurement. You may choose “Essential only” or “Allow pseudonymous measurement” and change that choice any time through Privacy choices in the footer. Withdrawal stops future capture; it does not automatically require deletion of data already processed by a provider.
Cookies and local storage
- A local preference stores your analytics choice.
- Local and session timestamps distinguish a return visit without collecting your identity.
- Session storage remembers recent destinations and a selected intent to make navigation easier.
- If you allow measurement, a first-party cookie may keep an approved presentation variant for 30 days. Variants do not change evidence, price, scope, or security claims.
- The portal uses an essential HttpOnly session cookie to authenticate and limit access; its configured lifetime is ordinarily 1 hour.
Products and engagements
How handling changes when a commercial relationship begins.
Begins with a CCN, business context, and public CMS records. It does not require PHI.
Maintains the public-record view and agreed deliverables. Account, authorization, and traceability follow the agreement.
Begins with facilities, available CCNs, and transaction or credit context. It does not require resident records.
Is a separate lane. It may require customer-authorized invoice evidence, so scope, access, retention, deletion, and any required BAA are established before receipt.
Payments handled by Stripe
After review and a signed agreement, Credalyst may open a Stripe-hosted payment experience. We send the buyer email, organization, product, and CCN needed to create and reconcile the transaction. Stripe directly collects payment and billing data, may use technical data for fraud prevention, and acts under its own notice for certain purposes. Credalyst does not receive the full payment-card number.
Protected health information
Survey Command, Continuous Monitoring, and Due Diligence begin without PHI. Providing software alone does not determine whether Credalyst is a Business Associate. When contracted work requires Credalyst to create, receive, maintain, or transmit PHI for a covered entity, handling does not begin until permitted scope, safeguards, incident duties, subcontractor terms, return or deletion, and a BAA when required are established.
Not a clinical privacy notice
This policy is not a covered entity’s Notice of Privacy Practices and does not describe how a facility provides care or administers resident rights. For PHI controlled by a healthcare organization, contact that organization. Credalyst will support its obligations only as required by the applicable agreement and law.
AI and public sources
Boundaries for model assistance and CMS previews.
Intent assistance
Command search first tries local deterministic rules. Only if those rules do not resolve the question and you explicitly choose model assistance is a capped version of up to 500 characters sent to Anthropic with locale and a safe current path. Obvious identifiers and clinical-record coordinates are rejected before transmission. Anthropic may select only an approved intent; Credalyst controls the route, evidence, copy, and boundary. Credalyst does not persist the question or send it to PostHog. Anthropic may retain API inputs and outputs under its applicable commercial terms and configuration. Do not include personal data or PHI.
CMS previews
A valid CCN can request a point-in-time view from the CMS Provider Data Catalog. Credalyst uses the CCN to retrieve the public record, keeps the view in an in-memory cache for up to 15 minutes for reliability, and does not send the CCN to PostHog. The preview does not use internal, resident, patient, or workforce records and does not predict an inspection.
Decisions and profiling
We do not use site data for automated decisions that produce legal or similarly significant effects about a person. Intent assistance is navigation; it does not create a product claim, price, evidence item, customer action, or clinical, employment, credit, or investment decision.
Email and SMS
Data, consent, providers, and opt-out.
We may use a work email to respond to inquiries, authenticate an account, deliver reports, send alerts or service communications, and maintain delivery or suppression records. Providers such as Resend may process the address, necessary content, delivery identifiers, and status. We do not treat an inquiry as blanket permission for unrelated marketing.
SMS messaging
If you expressly opt in, Credalyst Health may send operational, account-related, or service-related text messages to the mobile number you provide. Message frequency varies based on the service and your interactions. Message and data rates may apply. Reply STOP to unsubscribe or HELP for help. We do not share, sell, rent, or provide mobile phone numbers, SMS opt-in data, or messaging consent to third parties or affiliates for marketing or promotional purposes. We may use service providers solely as necessary to deliver and support the messaging program. Consent to receive text messages is not a condition of purchase.
Necessary disclosures
We may disclose information to providers operating in limited roles; advisers and parties to a corporate transaction under appropriate obligations; to protect rights, safety, and service integrity; or when required by law, order, or valid process. We do not authorize providers to use PHI for advertising.
Your choices and rights
How to access, correct, delete, or appeal.
Ask whether we handle your data and request access or a copy where applicable law provides.
Ask us to correct inaccurate data controlled by Credalyst.
Ask for deletion, subject to service, security, evidence, contract, legal, and legal-hold exceptions.
Decline optional analytics, withdraw future consent, or stop SMS with STOP.
If we deny a request under a law that provides an appeal, ask us to review the decision again.
You will not receive discriminatory treatment for exercising an applicable right.
Submit a request
Write from an address we can associate with the record and identify the right and context. We will verify identity and authority proportionately. An authorized agent may submit a request where law permits and we can verify the agent’s authority.
International legal bases
Where law requires a legal basis, we handle data as needed to enter into or perform a contract; comply with legal obligations; with consent where we ask for it; or for legitimate interests such as security, fraud prevention, support, limited improvement, and business administration after considering individual rights. Where applicable, you may also object or request restriction, withdraw consent without affecting prior handling, and complain to your local data-protection authority.
Rights vary by location, context, and legal exceptions. If a customer controls the information, we may direct you to that customer. Credalyst does not sell personal data or process it for targeted advertising, so there is no Credalyst sale or targeted advertising to opt out of. Global Privacy Control still blocks our optional analytics.
Security, children, and changes
Safeguards, limits, and maintenance of this notice.
Safeguards
We use administrative, technical, and organizational measures designed to limit access, protect transmission, preserve traceability, and detect failures. No system is perfectly secure; we do not promise that an incident is impossible. Read our security boundaries for what we claim—and what we do not.
Retention and deletion
We apply the specific period stated above where one exists. For other data, we keep information only while reasonably needed for purpose, service, security, evidence traceability, agreement performance, accounting or legal obligations, disputes, or legal holds. Deletion from active systems may not immediately remove limited backup copies or records we must retain; their use remains restricted until deletion or expiry.
Processing location
Credalyst operates from the United States. We and our providers may process information in the United States and other places where they operate, subject to applicable terms and safeguards.
Children
The services are intended for professionals and organizations and are not directed to children under 13. We do not knowingly collect personal data from children under 13. If you believe a child provided it, contact us so we can investigate and act.
Changes
We will update the effective date when this notice changes. If a material change requires additional notice or consent, we will provide it as required before the new handling applies.