Privacy notice draft

Data and purposes

Private accounts use email and authentication identifiers for sign-in and security. Profile, license and certification records support personal organization. Education entries and optional signed provider completions record independent credit awards. Uploaded evidence, reviewed checklist items, selected document references and user-recorded dates support packet preparation.

Sending a packet records the specified recipient email, organization, purpose, approved manifest, consent version, snapshot and limited delivery/access events. Redacted audit and security events support abuse investigation and operation. Ordinary audit logs are not a place for document contents or invitation secrets.

Your selections define a packet

A packet includes selected evidence, its index and manifest, not a default dump of the whole wallet. Health sharing needs additional confirmation. The recipient obtains a separate copy on download and is responsible for subsequent handling. Revocation cannot recall that copy.

Private records are intended for an account’s owner under mandatory MFA. Privileged server operators and configured processors can access data; this is not end-to-end encryption or a zero-knowledge service.

Processors and extraction

The implementation uses adapters for authentication, database, private storage, file scanning and email. The production processor inventory, storage regions, vendor contracts and subprocessors must be disclosed and approved before launch. Code alone does not establish those operating arrangements.

The first checklist extractor reads bounded PDF text on the server after file clearance. It does not silently upload evidence to a remote OCR or AI service. Any later remote processing needs a separate reviewed vendor and data-flow decision.

Retention, access and deletion

Storage objects, sealed packet snapshots, transactional records, security audits and backups have different lifecycles. Precise production retention periods and a tested rights-request/deletion process have not been finalized. Do not assume revocation or expiry immediately deletes every copy or audit record.

A cleanup utility for expired/revoked snapshots exists in the implementation; production scheduling, retention acceptance and evidence of backup restoration remain deployment responsibilities. No immediate-deletion promise is made.

Promises requiring launch review

No advertising use, sale of credential/health records or private-document model training is part of this development feature. Final production commitments must be supported by actual controls and vendor terms before a live policy is offered. Public contact and operator identity appear only when explicitly configured.