The documents in force
Terms of service
The contract itself: how accounts, seats and roles work, what counts as a billable user, how the subscription starts, fees and cancellation, acceptable use, availability, intellectual property, liability and termination. Read this one if you are signing up on behalf of a clinic.
Privacy notice
What personal data we process, why, for how long, who else touches it, and the choices available to you. It separates the data we control (your account) from the data you control (your workforce credential records).
Security & privacy
A plain-language description of the safeguards in place: encryption of contact details, private document storage, malware scanning, tenant isolation, the append-only audit log, our subprocessor list and how to report a vulnerability. It describes how the service behaves; it is not a certification or a compliance attestation.
Who the parties are
credentracker is a product of Haven Technologies. “We” and “us” mean Haven Technologies. “You” and “customer” mean the clinic, agency or other organization that subscribes — not each individual employee. “Worker” or “member” means a person whose credentials are tracked inside your organization.
If you create the organization, you confirm you are allowed to bind it to these documents. If you accept an invitation, your use is governed by the same documents through the clinic that invited you.
Which document wins
They are meant to fit together, but if two of them disagree, this is the order we follow:
- A signed agreement, such as an order form — anything you and we both signed beats the public pages, for the topic it covers.
- The terms of service — for everything about using the product, seats, fees and liability.
- The privacy notice — for anything about personal data. Where the privacy notice and the terms differ on privacy, the privacy notice controls.
- The security & privacy page — a plain-language description of the controls. It explains how the service behaves; it does not create commitments beyond the documents above.
Nothing in any of these documents limits a right you have under applicable law, including data-protection rights you may exercise against us directly.
Two kinds of data, two different roles
This distinction comes up in almost every security question we get, so it is worth stating plainly:
- Account data — we are the controller. Your name, email address, phone number, role, sign-in history and billing details. We decide why we hold this and we answer for it. See the privacy notice.
- Workforce credential records — you are the controller, we are the processor. License numbers, issue and expiration dates, documents and the audit trail. You decide what goes in; we store, display and report it on your instructions only.
The practical consequence: a worker who wants a record corrected, exported or deleted should ask the clinic first. We will route the request to your administrators and act on their instruction.
What the service is not
- Not an electronic health record and not a place to store patient information. Do not upload patient records, charts or notes.
- Not legal, medical, licensing or accreditation advice. credentracker records dates and statuses; confirming that a document satisfies a regulator is your job.
- Not a guarantee of a survey or audit outcome. It is a system of record with an audit trail, which is what makes an inspection faster.
Changes to these documents
When the text changes we update the “Last updated” date at the top of the document. For a material change — pricing structure, retention, a new subprocessor category or a shift in liability — we notify Organization Admins by email or in-app before it takes effect, and we keep using the version you agreed to until then.
Questions
Ask before you sign, not after. If a clause needs adjusting for your procurement process, email us and we will say whether we can move.
Contact
Contract, billing, insurance and data-protection questions go to support@credentracker.com. Vulnerability reports and security questionnaires go to security@credentracker.com. We answer legal notices from the address they were sent to, so keep the thread.