1. Scope and roles
This policy applies to hipaamart.com, HIPAAmart accounts, organization workspaces, compliance tools, training and assessment features, and other services that link to it. HIPAAmart determines how public-site, account, security, and business information is used. Information submitted through contracted organization services is processed under the organization’s instructions and applicable agreements.
2. Information collected
HIPAAmart may collect account and identity information; organization membership and roles; training, checklist, assessment, vendor, safeguard, and reviewer information; uploaded files and user content; contact communications; device, request, session, authentication, security, and audit information; and browser preferences or locally saved drafts.
3. Collection and use
Information is collected from users, organization administrators, browsers and devices, authentication providers, and operational service providers. HIPAAmart uses it to provide and secure services, authenticate users, administer permissions, save requested work, respond to inquiries, maintain auditability, prevent abuse, troubleshoot, enforce agreements, and meet legal obligations.
4. HIPAA, PHI, and BAAs
Public forms, search, and ordinary email are not approved PHI channels. Using the public website does not create a business associate relationship or BAA. A signed BAA governs PHI for a designated service and controls if it conflicts with this policy regarding PHI. Unless a signed BAA and product documentation expressly permit PHI, do not enter or upload it.
5. Contact requests
The public contact form collects the name, email, and message provided. The website application database does not save the message body; the configured delivery provider and HIPAAmart mailbox process it for delivery and response. Security-verification information and a limited IP-derived indicator help prevent automated abuse. Do not include PHI, passwords, or access tokens.
6. Cookies and browser storage
HIPAAmart uses operational cookies and browser storage for secure sessions, short-lived authentication, interface settings, color preference, locally recovered drafts, and temporary guest progress. The current public website does not use personal information for cross-context behavioral advertising.
7. Disclosures
Information may be disclosed to providers supporting hosting, databases, private file storage, authentication, security, and email delivery; to Cloudflare Turnstile for abuse prevention; to Resend or the configured delivery provider for communications; to authorized organization members; to professional advisers or authorities when legally necessary; or to a business successor subject to appropriate protections.
8. Security and organization access
HIPAAmart uses safeguards including authenticated access, role-based permissions, private file delivery, time-limited upload authorization, encrypted transport, session controls, activity records, and abuse prevention. No system is completely secure. Organization administrators control workspace roles and must remove unnecessary access and use only approved channels for regulated data.
9. Retention
Information is retained as reasonably needed to provide services, maintain security and auditability, comply with agreements and law, resolve disputes, and enforce rights. Sessions generally expire after seven days and temporary authentication cookies expire sooner. Workspace records, files, mailbox communications, and backups follow applicable agreements, operational controls, and legal obligations.
10. Privacy rights
Depending on location and legal exceptions, individuals may request access, correction, deletion, restriction, objection, portability, or an appeal. Requests may be sent to privacy@hipaamart.com. HIPAAmart may verify identity and authority and may coordinate requests involving organization-controlled information with that organization.
11. Children, international use, and external links
HIPAAmart is intended for adults and professional organizations, and users must be at least 18. Service providers may process information where they operate, subject to applicable transfer requirements. Third-party websites control their own privacy and security practices.
12. Changes and contact
Material changes will be reflected by an updated effective date and notice when required by law. Contact privacy@hipaamart.com for privacy requests and security@hipaamart.com for security reports. Do not include PHI in an initial public email.