Privacy Policy

We collect account information (name, email, role, and facility affiliation), the referral and census data you enter, and limited technical metadata (access logs, device and browser information) needed to operate and secure the service. Protected Health Information (PHI) is collected solely on behalf of, and under the direction of, the covered-entity facilities that use TRAX.

Information is used to deliver the platform’s core functions — referral tracking, census management, secure messaging, and reporting — and to maintain security, auditability, and regulatory compliance. We do not sell personal information or PHI, and we do not use PHI for advertising.

All data is encrypted in transit (TLS) and at rest (256-bit AES). Clinical communications in TRAX Connect use end-to-end encryption so that only the participating devices can read message and call content. Access is governed by role-based controls and a tamper-evident, cryptographically signed audit trail.

We share information only with the facility that owns it, with service providers bound by confidentiality and HIPAA Business Associate Agreements, or as required by law. We never disclose PHI for purposes incompatible with the originating facility’s instructions.

We retain records for as long as the facility maintains an active account or as required by applicable law and the facility’s retention policies. Audit-trail entries are retained to preserve their integrity and chain of custody.

Individuals may exercise access, correction, and other rights through the facility that maintains their records. Facility administrators can manage user access and export or delete data subject to legal retention requirements.

For privacy questions or requests, contact your facility administrator or our Privacy Officer at privacy@traxs.dev.