Privacy policy
Last updated October 27, 2026
The short version
ReleaseRight never collects patient information. We store what we need to run your account and keep your practice’s audit log, we use one cookie to keep you signed in, and we don’t sell data or use advertising trackers.
What we don’t collect
We don’t collect patient names, dates of birth, contact details, or record contents. The requester’s name, request dates, and the text of response letters stay on your screen and are never sent to our servers. Our servers reject any free text in a determination, so these details can’t be saved even by accident.
What we collect
- Account information: the names, email addresses, credentials, license types, and roles of people in your practice, and a securely hashed version of each password. We never store passwords themselves.
- Practice information: your practice name, address, phone number, privacy contact, logo, and practice policies.
- Determinations: a random case reference, your multiple-choice answers, the outcome, the rule set version, which clinician made it, approvals, and timestamps. This is your practice’s audit log.
- Billing information: your plan and subscription status. Stripe processes payments and holds your card details; we receive only a customer reference.
- Technical information: limited records of sign-in attempts, kept briefly to protect accounts from password guessing, and standard server logs.
How we use it
To provide and secure the service, enforce plan limits, bill you, support you when you ask, and tell you about changes to the service or these policies. We don’t use your data to train models, and we don’t sell or rent it.
Cookies
The app uses one cookie, a session cookie that keeps you signed in. It’s required for the app to work. We don’t use analytics or advertising cookies. Our pages load fonts from Google Fonts, which means Google receives your browser’s IP address when you visit.
Who we share it with
Only the service providers that run ReleaseRight: Cloudflare, which hosts the app and database in the United States, and Stripe, which processes payments. We may disclose information if the law requires it, or to protect the rights and safety of our users or the public. If ReleaseRight is sold or merged, your data would transfer under this policy.
Who in your practice can see what
Clinicians see their own determinations. Practice owners and admins see every determination in the practice, the team list, and the audit log export.
How long we keep it
We keep your data while your account is open. Audit trail entries can’t be edited or deleted while the account is active, because their value depends on that. When a practice owner asks us to close the account, we delete the practice’s data within 90 days, except billing records we must keep by law.
Security
Connections are encrypted. Passwords are hashed with a unique salt for each user. Sessions use secure, HttpOnly cookies and expire after 30 days. Sign-in attempts are rate limited. Each practice can only reach its own data.
Your choices
You can update your own details in the app at any time. To get a copy of your practice’s data or have it deleted, email [email protected] from the account owner’s address.
Children
ReleaseRight is for licensed professionals and isn’t directed to children. We don’t knowingly collect information from anyone under 18.
Changes
We’ll post any changes here with a new date and notify account owners of material changes.
Contact
ReleaseRight, [Business mailing address]. [email protected].