1. Scope
This Privacy Policy applies to ChiroVerify's website and software service. It covers account information, practice information, website usage information, payment-related information handled through our billing provider, and patient eligibility request information processed through the service.
2. Information we collect
We may collect the following categories of information:
- practice account information, such as practice name, address, phone number, timezone, user names, roles, and email addresses;
- authentication and security information, such as session records, verification status, security event metadata, and multi-factor authentication status;
- provider and payer configuration, such as provider NPI labels, payer selections, favorite payers, and payer issue reports;
- eligibility request information submitted by users, such as patient name, date of birth, member ID, payer, and provider NPI, when needed to perform a verification;
- PHI-free usage information, such as daily successful-check counts and categorized payer or system error counts;
- payment and subscription metadata, such as plan, billing state, Paddle customer or transaction identifiers, and invoice or checkout status; and
- technical information, such as browser type, request metadata, device and network signals, cookie data, and logs needed for security and reliability.
3. Patient data minimization
ChiroVerify is designed to minimize patient data retention. The service processes patient eligibility request data to perform a verification through clearinghouse and payer systems. The current application does not store patient records, raw eligibility responses, parsed eligibility results, or eligibility history in the application database.
Users should not include patient details in support notes, payer issue reports, email, chat, or other free-form communications unless a separate approved secure process has been established.
4. How we use information
We use information to:
- provide eligibility verification and account functionality;
- authenticate users and protect accounts;
- display practice settings, plan information, and usage summaries;
- send account, security, billing, and service communications;
- measure PHI-free usage for plans, caps, operations, and support;
- investigate payer routing, payer support, system reliability, and security issues;
- process billing, taxes, receipts, refunds, and subscription lifecycle events through Paddle; and
- comply with legal, security, and contractual obligations.
5. Sharing and service providers
We share information with service providers only as needed to operate, secure, support, and bill for the service. These providers may include cloud hosting and database providers, clearinghouse and payer connectivity providers, email providers, bot-protection providers, logging and security tools, and Paddle for payment and subscription processing.
Eligibility request information is transmitted to clearinghouse and payer systems as needed to perform the requested verification. Payment card details are handled by Paddle or its payment processors and are not stored by ChiroVerify.
6. Cookies and similar technologies
ChiroVerify uses cookies and similar technologies for authentication, session security, CSRF protection, bot protection, and core website functionality. Some third-party providers may use their own cookies or browser storage when they provide security, checkout, or payment services.
7. Security
We use administrative, technical, and organizational safeguards designed to protect information, including HTTPS, server-managed sessions, restricted account access, role-based controls, email verification, multi-factor authentication for administrators, and PHI-safe logging practices. No internet service can be guaranteed to be completely secure.
8. Retention
We retain account, subscription, security, audit, and PHI-free usage records for as long as needed to provide the service, comply with legal obligations, resolve disputes, enforce agreements, support security, and maintain business records. Patient eligibility request details and returned eligibility results are not retained in the current application database.
9. Your choices
Account administrators can update many practice and user details from the application. You may contact us to request access, correction, deletion, or export of information where applicable. We may need to verify the request and may retain information when required for legal, security, billing, or legitimate business reasons.
10. Children's privacy
ChiroVerify is intended for use by healthcare practices and their authorized workforce members. It is not directed to children and is not intended for personal consumer use by patients.
11. Changes to this policy
We may update this Privacy Policy from time to time. The updated policy will be posted on this page with a new last-updated date.
Questions about this policy can be sent to admin@chiroverify.net.