This policy covers patientflows.com — the website. It does not cover the Patientflows Platform itself.
If you are a clinician or staff member using the Platform, the information in there belongs to your practice, not to us. We handle it as your practice’s Business Associate under a signed Business Associate Agreement, and what we may do with it is set by that agreement and by the Service Description — not by this policy. See Section 6.
This website does not collect protected health information, and you should not send us any. It is a marketing site. If you put patient information into a form here, we delete it.
1 · What we collect, and only this
What you type into a form
| Form | What it collects |
|---|---|
| Book a walkthrough | Your first and last name, your role, your work email, your practice or organisation, how many providers you have, your state, and your phone number. |
| Exposure and Opportunity Report | Your NPI and your email address. |
An NPI is a public professional identifier. It is published by the federal government in the NPPES registry and anyone can look it up. We use it to find the public Medicare data the report is built from. It is not health information about you, and it tells us nothing about any patient.
No form on this site asks for a Social Security number, a bank or card number, a date of birth, a password, or any information about a patient. If you send us any of those, we delete them rather than store them.
What your browser sends
Like every website, our server receives your IP address, browser type and the page you asked for, and keeps a short record of it so the site works and so we can tell real traffic from attacks. Cookies and similar technologies are covered in our Cookie Policy.
What we do not do
- We do not sell your information. Not to anyone, for any price, ever.
- We do not share it with any manufacturer or distributor — including Wilco Medical, which shares common ownership with Patientflows and is a separate company.
- We do not use it to build advertising profiles, and we do not sell or rent our list.
- We do not use anything you give us here to train an artificial-intelligence model.
2 · Why we have it
Four reasons, and nothing else.
- To answer you — to send the report you asked for, or to hold the meeting you booked.
- To talk to you about Patientflows, if you asked us to. You can stop this at any time.
- To run and protect the site — to keep it working and to stop abuse.
- To meet a legal obligation, where one applies to us.
We do not use what you give us here for any other purpose, and we do not make any automated decision about you.
3 · Email, and how to stop it
If you ask for a report, we email you the report. If you also agreed to hear from us, we send occasional messages about Patientflows. Every one of those messages carries a one-click unsubscribe and our postal address.
Unsubscribing stops the marketing email. It does not delete your information — for that, see Section 5.
4 · Who else sees it
Only companies that do a specific job for us, and only the part of the job they need.
| Who | What they do | What they get |
|---|---|---|
| Our hosting provider | Serves this website. | Server log data, including your IP address. |
| Our email provider | Delivers your report and any messages you asked for. | Your email address and the content of the message. |
| Our scheduling tool | Runs the “book a walkthrough” calendar. | Your name, email and what you entered on the booking form. |
Each of them is under a contract that limits them to doing that job and forbids them from using your information for their own purposes.
We will also hand information over where the law requires it — a subpoena, a court order, a lawful government demand. If that happens and we are permitted to tell you, we will.
If Patientflows is ever sold or merged, your information may transfer with the business. It stays under this policy until we tell you otherwise, and we will tell you before anything changes.
5 · What you can ask us to do
You can ask us to tell you what we hold about you and give you a copy; correct it if it is wrong; delete it; stop emailing you; or stop processing it while we work out a disagreement.
Email privacy@patientflows.com and we will answer within thirty days. We will not ask you why, and we will not make you sign in or create an account to ask.
Some privacy laws give residents of particular states additional rights and their own deadlines, and they apply to us depending on our size and where you live. Where a law gives you more than this section does, you get the more generous one — you do not need to work out which law applies, and neither should you have to.
We will never charge you for a request, and we will never treat you differently for making one.
6 · The line between this website and the Platform
This is the part that matters most, and it is the part most privacy policies blur.
| patientflows.com — this website | The Patientflows Platform | |
|---|---|---|
| What is in it | Marketing pages, two forms, a calendar. | Clinical records belonging to a practice. |
| Who owns the information | We do, as described above. | The practice does. Always. |
| Is there patient information? | No, and there should never be. | Yes. |
| What governs it | This policy. | The practice’s Business Associate Agreement and the Service Description — not this policy. |
We are a Business Associate to each practice that uses the Platform, never a Covered Entity, and never the owner of a patient record. A patient asking what is held about them asks their practice, who can answer because the record is theirs.
One fact worth stating plainly, because it is unusual: no third-party analytics, error-tracking or monitoring service receives Platform data. There is no such tool in the Platform. That statement is about the Platform — this website is a separate system, and the Cookie Policy says what runs here.
7 · How long we keep it
| What | How long |
|---|---|
| What you typed into a form | Twenty-four months from the last time you contacted us, unless you ask us to delete it sooner. |
| Marketing email records | Until you unsubscribe, plus the period we must keep proof that you did. |
| Server logs | Ninety days. |
When a period ends, we delete it or strip it of anything that identifies you.
8 · Security, stated honestly
We protect this information with encryption in transit, access limited to the people who need it, and providers who are contractually bound to do the same.
We will not tell you that it is impossible to breach, because no company can truthfully say that. What we will tell you is that if a breach reaches your information, we will notify you — promptly, in plain language, and whether or not a law requires us to.
9 · Children
This site is for healthcare professionals. It is not directed at anyone under eighteen and we do not knowingly collect anything from them. If you believe a child has sent us something, email privacy@patientflows.com and we will delete it.
10 · Changes, and who to ask
If we change this policy we update the date at the top and keep every prior version at /legal/privacy-policy/archive/. If a change materially reduces your protection, we will say so in the notice rather than leaving you to spot it.
Questions: privacy@patientflows.com.