Privacy Policy
This Privacy Policy explains how Credentik, Inc. ("we", "us") collects, uses, and shares information when you use credentik.com and app.credentik.com (the "Service"). For Protected Health Information (PHI) submitted by customer agencies, the Business Associate Agreement controls.
Contents
1. Information we collect
Account information
When you create an account we collect your name, email, password (hashed with bcrypt), agency name, and role. Your password is never stored or transmitted in plain text.
Customer-submitted data
Customer agencies submit data about providers, organizations, payers, claims, payments, and (for some workflows) patients. We process this data on the agency's behalf as a data processor / business associate.
Usage data
We log IP address, browser/device user-agent, pages visited, and timestamps to operate the Service and investigate security incidents. We do not sell or share these logs with advertisers.
Payment information
Subscription payments are processed by Stripe. We receive transaction metadata (amount, status, last-4 of card) but do not store full card numbers.
2. How we use information
- To operate, secure, and improve the Service;
- To authenticate you and enforce access controls;
- To send transactional emails (welcome, password resets, approval requests);
- To comply with legal obligations and respond to lawful requests;
- To investigate and prevent fraud, abuse, or security incidents.
We do not use Customer Data to train machine-learning models that benefit any party other than the customer who submitted the data.
3. How we share information
We share information with:
- Service providers we depend on to operate the Service — currently Railway (hosting), Stripe (payments), Resend (email), Anthropic (AI features). Each is bound by contract; see our Security Overview for the current subprocessor list.
- Your agency — users in the same tenant see data as their role permits.
- Government or legal authorities — when compelled by valid legal process or to protect rights, safety, or property.
- Acquirers — in connection with a corporate transaction (merger, acquisition, asset sale), subject to confidentiality and continued application of this Policy.
We do not sell personal information.
4. PHI handling
For Protected Health Information as defined by HIPAA, Credentik acts as a Business Associate. We process PHI only as permitted by the executed BAA and only to perform the Service for the Covered Entity / Business Associate that submitted it. We do not use PHI for marketing or analytics. See the BAA for the full terms.
5. Retention and deletion
We retain Customer Data while your account is active and as required to provide the Service. On termination, we will return or destroy Customer Data within 30 days upon request. Audit logs and minimal account records may be retained longer where required by law or for legitimate security purposes (typically 7 years for billing records).
6. Your choices and rights
You may access, correct, export, or delete your account information from within the Service. For requests we cannot fulfill in-product (including data subject requests under GDPR / CCPA / state privacy laws), email privacy@credentik.com. We respond to verifiable requests within statutory timeframes (typically 30 days).
7. Cookies and tracking
We use first-party cookies and similar storage to keep you signed in and remember preferences. We use minimal first-party analytics (page views, error rates) to operate the Service. We do not use third-party advertising trackers.
8. Children
The Service is not directed to children under 13 and we do not knowingly collect personal information from children. If you believe a child has provided information to us, contact us so we can delete it.
9. International users
Credentik is operated from the United States. By using the Service from outside the US, you consent to the transfer of your information to, and processing in, the United States.
10. Changes
We will post material changes to this Policy here and notify account owners by email. Continued use after the effective date constitutes acceptance.
11. Contact
Credentik, Inc.
100 Demo Boulevard, Suite 200
Orlando, FL 32801
Privacy: privacy@credentik.com
Security: security@credentik.com