Privacy Policy
Effective October 21, 2026. We collect as little as we can: no tracking cookies, no tracking pixels, no ads.
On this page
Who we are
hipaa.systems ("we", "us") is an independent HIPAA information site run by an individual publisher — not a company or a law firm. The operator — and the controller of the personal data described here — is the individual entrepreneur named in our Terms of Sale and on our contact page. Questions about this policy: hello@hipaa.systems.
What we collect
When you browse. Our host, Cloudflare, processes technical data needed to deliver and protect the site — your IP address, browser type and the pages you request — and gives us aggregate traffic statistics. We do not use tracking or advertising cookies, tracking pixels, advertising networks or third-party analytics scripts, and we don't track you across other sites.
One cookie, only for access you bought. When you open an access link from a purchase email (or the owner's own access link), we set one cookie, hs_course, so this browser can open the training you paid for and show "My purchases". It holds a signed reference to your order and when access ends — not your name or email — and it expires when that access ends (at most two years). It is strictly necessary for the service you asked for, it is never used for tracking, and nothing else is set. You can delete it at any time in your browser settings; you can open your access link again to restore it.
When you report a mistake. The form sends the page address, your message, an optional source link and, if you give one, your email. We store it as an item in our private GitHub repository (GitHub, Inc.) so we can check and correct the fact.
When you download the free Vendor & BAA Register. We store your email, whether you are a practice or business associate, whether you asked to hear about our kit's launch, the page you signed up on, the date, and the version of the consent text you agreed to. They are kept in a Cloudflare database. We use them to send you the register's updates and, if you opted in, to tell you when our kit launches. We send these emails through Resend, our email delivery service (see "Who processes your data").
When you join a kit or course waitlist. We store your email, which kit or course option you asked about — or, if you asked for one we don't list, the practice type, state or learning system you typed — the page you signed up on, the date and the version of the consent text. We use it only to send the one notification you requested when the relevant kit, course or delivery option becomes available, and we count requests to help prioritize development. It is kept in the same Cloudflare database, separately from the register sign-ups. The launch-list record does not include your IP address; Cloudflare may process network information to deliver and protect the site, as described under "When you browse".
When you use a free training episode. Your progress is kept only in your own browser. We count, without any identifier, that an episode was started, finished or its procedure panel opened, and which choice was made first at each decision and whether it was right. We store the episode, its version, the event and the date — no IP address, no email, no free text. We use these counts to improve the course.
When you buy a kit. Checkout is run by Creem (Armitage Labs OÜ, Estonia), our reseller and merchant of record. Creem collects your name, email, billing details and payment details and processes them as an independent controller under its own privacy notice; we never see your card details. Creem sends us the order details we need — your email and name, billing country, the order and product, price and date — through its notification to our server. We keep that in a Cloudflare database to send your download, updates and fixes, to answer support requests and to keep the records the law requires for sales. We use your purchase email for messages about your kit; marketing emails only if you opted in.
When you download your kit or ask for support. For each order we count downloads and keep the date of the last one — no IP addresses. The support form stores your email, the edition, version and file you name, and your message, to answer it; a report of an error in the kit is also copied, without your email, to our private issue tracker so we can fix it for every buyer. Never send us patient information.
When you email us. We keep your message and address to reply.
Why we use it (legal bases)
Where laws such as the GDPR apply: to deliver what you asked for — the kit, its updates and fixes, or the free register (contract); to answer support requests, keep the site secure and correct facts (legitimate interests); to keep sales and tax records (legal obligation); and to send launch news or other marketing emails only if you opted in (consent, which you can withdraw at any time).
What we don't collect
Please never send us protected health information or any patient details. We don't sell your personal information, don't share it for advertising, and don't pass it to vendors we write about.
Who processes your data
Cloudflare (hosting, security, statistics, database) and GitHub (correction reports) process data on our behalf. Creem processes purchases as merchant of record (see above). Resend delivers the emails we send — download links, kit updates, launch emails and replies — so it processes your email address and the content of those emails; our sending is set up in its EU (Ireland) region. Emails you send to hello@hipaa.systems are forwarded by Cloudflare to our Google mailbox. Their infrastructure may process data in several countries.
How long we keep it
Sign-ups: until you unsubscribe or ask us to delete them. Waitlist — for a kit, the course, team access or an LMS option: until six months after that notification is sent; deleted earlier if the planned kit, course or option is cancelled, if 12 months pass without it becoming available, or if you ask. Training-episode counts: kept without any identifier, as long as they help improve the course. Purchase records: for as long as you are entitled to updates and fixes, and as long as tax and accounting law requires. Correction reports: as long as they are useful as a record of how a fact was checked. Technical data: as set by Cloudflare's own retention.
Your choices
Ask us at hello@hipaa.systems to see, correct or delete what we hold about you. Every email we send includes a way to unsubscribe. You can delete the access cookie in your browser at any time. We don't sell or share personal information as those terms are used in California privacy law.
Children
This site is for professionals and is not directed to children under 13. We don't knowingly collect their information.
Security
Traffic is encrypted (HTTPS), stored data is limited to what is listed above, and access is restricted to the people who run the site.
Changes
We will update this page and its effective date when our practices change, and note material changes in Updates.