Two roles, one system
We handle both kinds of data in the same product, but we are not the same thing for each:
- Account data — we are the controller. Your name, email address, phone number, role, session history and billing information. We decide why it is collected and we answer for it.
- Workforce credential records — your clinic is the controller, we are the processor. License numbers, issuing bodies, dates, uploaded documents and the audit trail. We hold and process it only on your clinic's instruction.
If you are an employee whose clinic tracks your credentials, start with your administrator — they control that record. We support their request and act on their instruction.
What we collect
- Account identifiers. Name, work email address, phone number, role and whether the account is active, invited or suspended.
- Organization details. Clinic or agency name, timezone, logo, billing configuration and the seat count that drives your invoice.
- Credential records. Credential type, number, issuing body, issue and expiration dates, status changes and the documents your team uploads.
- Security and audit data. Sign-in events, invitations, exports, document views and configuration changes — with actor, timestamp and request metadata such as IP address and user agent.
- Billing data. Plan, subscription status, billing period, seat events and invoices. Card details go straight to Stripe; they never reach our servers.
Why we hold it
- To provide the service: store credentials, calculate status, send reminders, build reports.
- To sign people in and keep accounts straight — one-time sign-in codes, invitations and account lifecycle messages.
- To bill accurately: seat changes are recorded as events and feed the invoice.
- To protect the service and everyone in it: rate limits, malware scanning on uploads, abuse prevention and security investigation.
- To meet legal, tax and accounting obligations, and to answer lawful requests.
What we never do
- We do not sell personal data, and we do not share it for advertising.
- We do not run advertising pixels, cross-site trackers or third-party session recording on the application.
- We do not ask for patient information. credentracker is not an electronic health record — do not upload patient charts, notes or records.
- We do not use your credential records or documents to train models or to build benchmarks.
- We do not send marketing email to people whose address came from a clinic's workforce list.
Cookies and sessions
The application sets only the cookies sign-in requires. Auth.js issues a signed, HTTP-only, same-site session cookie that carries your session and organization, plus its short-lived companion cookie used to validate sign-in and sign-out requests. We set nothing for analytics, advertising or cross-site tracking, and no cookie is readable from JavaScript in your browser.
Because every cookie we set is strictly necessary, there is no consent banner to click through: refusing them means sign-in cannot work. Requests that change data are additionally checked for a same-origin origin header, so a page on another site cannot act on your session even if a cookie were sent.
Website visit counts
On the public website — not inside the application — we count page views ourselves so we know which pages are useful and where visitors come from. No cookie is set and nothing is shared with an analytics or advertising company. For each view we keep the page, the domain of the site you came from, any campaign tags in the link, your device type and browser family. Your IP address and browser details are used only to compute an anonymous identifier that changes every day, and are never stored, so a visit cannot be linked to you or to your other visits. Browsers that send Do Not Track or Global Privacy Control are not counted. The counts are kept for 13 months.
Who else processes it
We use a short list of vendors to run the service, and each one is bound by contract to process data only for us. The categories:
- Cloud and database infrastructure — document storage, key management, the managed PostgreSQL cluster that holds clinic, user and credential records.
- Redis and job queue — rate limits, one-time sign-in codes and export jobs awaiting delivery.
- Payments — card processing, invoices and receipts. Card numbers never reach us.
- Transactional email and SMS — sign-in codes, invitations and expiration reminders.
- Error monitoring and product analytics — server-side only. Events are stripped of personal data by configuration: no user records, cookies, request bodies or query strings, redacted headers, and analytics events carry opaque IDs and coarse attributes rather than names, emails, phone numbers or credential details.
Named vendors, regions and the mapping to each data category are listed on the security & privacy page. We also disclose data when the law requires it, and where we are allowed to, we tell the affected organization first.
Where it lives
The application, database, document storage and cache all run in the United States (us-east-1). Documents sit in private storage — never a public bucket — and are served through URLs that expire within minutes. If your clinic needs a different residency arrangement, talk to us before you sign up; it is not something we can change after data has been written.
How long we keep it
- Account data — for as long as your clinic is a customer, then for a short wind-down window so an accidental deletion can be undone.
- Credential records — for as long as your clinic keeps them. Deleting a credential is a soft delete: it leaves the active list immediately, and the record is kept with the audit trail rather than destroyed.
- Documents — kept in private storage, filed under your organization. Deleting a credential, or replacing its document on renewal, does not destroy the earlier file; an upload that fails the malware scan is deleted.
- Audit entries — the audit log is append-only and retained for the life of the organization; it is what makes the file defensible.
- Billing records — kept for as long as tax and accounting rules require, which is typically longer than the subscription itself.
- After a clinic is deleted — every member is marked deleted and their lookup keys are cleared, so the same person can be invited elsewhere. The records stay for the audit trail and are pruned on schedule.
Your choices and rights
- See and correct your account. Your name, phone number and notification preferences are editable in settings; your role is set by a clinic administrator.
- Export. Reports export the credentials register as CSV, XLSX or PDF and the workforce register as CSV or XLSX while your subscription is current.
- End sessions. Sign out everywhere revokes every active session for your account; suspending a user does the same for their other devices.
- Access, portability, correction or deletion of a credential record. Ask your clinic — as the controller they decide. We assist them, and we will tell you who to contact if you come to us by mistake.
- Remove a user. An Organization Admin or HR user can delete a user record from the workforce list; the credential history leaves with them and the seat stops billing.
- Delete the whole clinic. Organization deletion is a platform-side action: ask us from a verified Organization Admin account and we will soft-delete the organization and cancel its subscription.
- Marketing. We do not run a marketing list built from clinic workforce data. You can ask us to stop any non-essential email and we will.
You can also object to our processing of account data or ask for a copy of it; write to the support address below and we will respond within the period applicable law allows.
Text messages
We text the mobile number on your account only for the service: sign-in codes you request, an invitation when a clinic adds you, and reminders when one of your credentials is about to expire. Message frequency varies. Msg & data rates may apply. Reply HELP for help or STOP to stop receiving texts; you can also change your number in settings.
No mobile information will be sold or shared with third parties for promotional or marketing purposes. Text messaging opt-in data and consent will not be shared with any third parties.
How we protect it
Email addresses and phone numbers are encrypted with AES-256-GCM and looked up through a blind index, so the plaintext never sits in the database or in a query log. Documents live in private storage and are served through short-lived signed URLs. Every organization-scoped query is filtered by clinic, roles are enforced in the API rather than the interface, and consequential actions are written to an append-only audit log. The security & privacy page lists the full control set and our subprocessors.
Children
credentracker is a business tool for employers and their workforce; it is not directed at anyone under 18, and we do not knowingly hold data about children.
Changes to this notice
We update the date at the top whenever this notice changes. If a change materially affects what we collect or how long we keep it, we will notify Organization Admins before it takes effect.
Contact
Privacy questions and requests go to support@credentracker.com. Security reports go to security@credentracker.com. If you are contacting us about a record, include the clinic name and the credential in question so we can route it the same day.