Privacy Policy

1. Who We Are and What This Covers

MTC Group LLC operates HealthData DueCare. This policy explains how we handle personal information about people who create accounts; people whose details our customers enter into the Service, such as their workforce, officials and vendor contacts; visitors to our website; and people who use public features, such as a customer’s Trust Hub, a vendor security questionnaire or a customer’s reporting hotline.

2. Information We Collect

• Account information: name, email address and sign-in details, through our authentication provider, Clerk, and the date and version of the Terms and Privacy Policy you accepted.
• Program information your organization enters: the organization profile, officials, workforce roster (names, emails, roles, training and screening records), systems and assets, vendors and their contacts, risks, policies, incidents, evidence files and notes.
• Billing information: plan and payment status from Stripe. We never receive full card numbers.
• Communications: support tickets, messages and your email preferences.
• Public features: a Trust Hub document request (name, email and company), vendor questionnaire responses, and hotline reports, which may be made anonymously.
• Usage information: pages used and basic technical data, through Vercel Web Analytics and server logs.
• Welcome trial and purchase questions: when your 24 hours of full access start and end; your answer, if you give one, to the optional question about when your next audit or assessment is; each time you open a Stripe checkout page, whether or not you complete it, with the plan and whether the early-signup offer applied; and your answer, if you give one, to the one-question survey at the end of the trial or after you subscribe. We use these only to understand and improve the trial and the Service; they are seen by MTC Group platform staff and are not shared.
• Abuse prevention: to protect public forms from floods, we keep a short-lived counter keyed to a one-way hash that includes the sender’s network address. It holds nothing else, is not used to identify anyone, and is deleted within about a day.
• Policy questions: when someone uses Ask the Policies, we count the question for a daily limit. We do not store the question or the answer.
• AI review of uploaded files: for each file reviewed, we keep what the file was checked against, a short summary, the points raised and what became of each one (fixed by a newer file, or dismissed with a reason). We use these to show your organization, and MTC Group, how often a point led to a corrected file. The file itself stays in your organization’s file storage, unless it is removed because it may contain patient information; then we keep only its name, checksum, who removed it, when and why. AI features are off until your Site Admin turns them on in Settings.
• Ratings and advisor profiles: the ratings and comments your organization gives a firm or an advisor, and who in your organization gave them, kept with your organization; reviewed by MTC Group and published as the Terms (section 11) describe, with your organization’s type and size, never its name or the person’s. For each engaged advisor, MTC Group publishes their name, roles, verified credentials, professional profile link and profile photo, as their agreement with MTC Group provides.
• Advisor applications: when someone applies to join MTC Group’s advisor team, the details they give on the application (name, contact details, state of residence, each credential with its certificate number and expiry, experience, frameworks, any audits they performed, availability, any note, and the name, relationship, email and phone of each professional reference they list). MTC Group platform staff use them only to consider and contact the applicant, to verify each credential with the body that issued it, and to contact the references, who may be asked to confirm an audit the applicant listed; they are not shared outside MTC Group.
• Advisor profile photos: each advisor MTC Group engages uploads a profile photo, which MTC Group requires before engaging them. It is stored privately, seen by MTC Group platform staff and the clients the advisor is assigned, and published with the advisor’s profile while they are engaged. It is deleted when the advisor is removed from our roster.
• Advisor identity verification: MTC Group confirms that each advisor it engages as an independent contractor is a real person and the person who applied. Stripe Identity checks the advisor’s driver’s license and a live selfie on Stripe’s own page, after asking for the advisor’s consent. The license images, the selfie and the face comparison stay with Stripe, which processes them for us; we receive only the outcome, the name printed on the license and whether it matches the name on the application. We ask Stripe to redact the verification when an advisor is removed from our roster, when the advisor asks, and when someone we never engaged has had no activity on our roster for 90 days.
• Penetration tests: when your organization requests a penetration test through the Service, the scope and the signatory you name; for the engagement, the targets, rules of engagement and emergency contact you give the testing firm, and two test account log-ins. The test account passwords are encrypted, shown only to the engaged firm’s testers after your signatory signs the authorization (each showing is recorded), and erased when the firm delivers its report. The firm sees only this, never the rest of your program; its report is kept as your penetration test record.
• Firm applications: when a firm applies to be listed, the services it applies for and the legal entity that delivers each, its business and contact details, its credentials, its insurance (carrier, limits and end date), and the name, organization, email and phone of each client reference it lists. MTC Group platform staff use them to vet and contact the firm and to call its references; a firm that is listed has its logo and, for each service, its business contact details, the legal entity that delivers it, verified credentials (with the date each was checked) and published prices shown to clients.

We do not want or ask for patient information (section 8).

3. How We Use It

To provide and secure the Service; to run the features your organization uses, including training assignments and reminders, deadline notices and filing workflows; to perform the fCISO and RSP Assessment services you buy; to process payments; to answer support requests; to send the weekly blog email and occasional offers, such as free-access codes and the two welcome-trial reminders, only if you opt in, which you can unsubscribe from at any time; to keep a record of which of those emails were sent to you and, through links that pass through our own site, count clicks and whether the offer was used; to measure our advertising, only with your cookie consent (section 7); and to meet legal obligations. We do not sell personal information.

4. Information Your Organization Controls

Your organization decides what information about its people and partners it enters and who within it can see that information. For that information we act on your organization’s behalf. Requests about it, for example from someone listed on a roster, are best sent to that organization, and we will help it respond.

5. Who Can See It

• People in your organization, according to the roles your administrators assign. General workforce accounts see only their own training, policy acknowledgments and support tickets, not the organization’s program records.
• MTC Group platform staff, only as needed to provide support, operate and secure the Service, and perform the fCISO and RSP Assessment services your organization buys. When staff act inside your organization’s workspace, that session is recorded against the staff member and ends automatically.
• Independent RSP Assessors, InfoSec Advisors and fCISOs MTC Group engages, under written agreements that bind them to confidentiality. An RSP Assessor sees, read only, the program of an organization assigned to them for assessment. An InfoSec Advisor sees, read only, and an fCISO sees and works in, the program of an organization that added them to its account, until that organization removes them. None of them sees your billing or your account administration, and each sees no organization other than those.
• Anyone with the link to material your organization chooses to publish on a Trust Hub.
• Anyone visiting our website: testimonials and achievements your organization submits and MTC Group approves are shown publicly under the name your organization chose when submitting them.
• Independent firms you contact through the directory, which receive only what you send them.
• Service providers acting for us: Clerk (authentication), Stripe (payments and advisor identity verification), Vercel (hosting, file storage, web analytics, and the AI Gateway that can route requests to the AI model), Neon (database), Microsoft 365 (email delivery), and Anthropic, whose AI model, when your organization has turned AI features on, answers Ask the Policies questions from your organization’s approved policies, suggests controls for a policy or risk from its text, reviews uploaded evidence files and policies against what each record asks for, drafts revisions of policies it flagged, and prepares an RSP Assessor’s first pass over your program. Requests go through the AI Gateway with zero data retention, so the provider does not keep the questions, text or files it is sent. Each processes data under its own security and privacy commitments.
• Authorities when the law requires it, and a successor if MTC Group’s business is transferred.

6. Retention

We keep account and program information while your account or subscription is active. A trial or free-access organization that ends without a subscription becomes read only, and is permanently deleted on or after 90 days later, after reminder emails 30, 10 and 3 days before and a final check by MTC Group staff; you can sign in and download your data until then, and subscribing at any point keeps it. When a paid subscription ends, the organization becomes read only and your Site Admin can download a complete export of it, every file and all the information entered in the Service, for 30 days. After that the data is not accessible unless you subscribe again, and the organization is permanently deleted on or after 90 days after the subscription ended, after reminder emails and a final check by MTC Group staff. Your Site Admin can also delete the organization in Settings at any time after downloading the export, once no subscription, retainer or assessment is active. When we delete an organization or an account, we keep only the records we must keep for legal, tax or accounting reasons, such as invoices, signed attestations and issued RSP Assessment Reports. Backups roll off on their normal schedule, within 14 days. You can ask us to delete your account or your organization at any time.

We delete an advisor or firm application twelve months after we decide on it, or eighteen months after it arrived if no decision was made. If we move an applicant forward, their details are copied to our advisor roster, which we keep while we are considering or working with them. An applicant can ask us to delete their application at any time, and an advisor can ask to be removed from the roster. Removal deletes their applications and clears their name, contact details and biography from the roster; we keep the record of the client work they did and of the checks we made before engaging them (their verified credentials, screenings, signed agreements and insurance), because those are records we must keep, and issued RSP Assessment Reports keep the name they were signed with.

7. Cookies and Measurement

Our authentication provider, Clerk, sets essential cookies to keep you signed in and protect your session; the Service cannot work without them. Vercel Web Analytics measures overall traffic without cookies and without tracking you across sites. If you accept cookies in the banner shown on your first visit, we also load conversion measurement from Google Ads, LinkedIn and Reddit to learn whether an ad led to a signup. Nothing in that group runs unless you accept, and rejecting or not choosing keeps it off. You can change your choice at any time through “Cookie Settings” in the footer.

8. Patient Information

The Service tracks a compliance program. It is not a system of record for protected health information. Please do not enter patient names, other patient identifiers or other PHI; use an internal reference number where a record must refer to a patient matter.

9. Security

We use encrypted connections, data separated by organization, role-based access enforced on every request, restrictions on the types of file that can be uploaded, request limits on public forms and access-controlled infrastructure. No system is completely secure, and we cannot guarantee absolute security. We will notify affected customers of a security incident involving their data as the law requires.

10. Your Rights

Depending on where you live, including under the California Consumer Privacy Act, the Virginia Consumer Data Protection Act or the EU and UK GDPR, you may have the right to access, correct, delete or receive a copy of your personal information, or to object to certain processing. To use any of these rights, contact us. We will not treat you differently for doing so.

11. Children

The Service is for compliance and security professionals and is not directed to, or knowingly used by, children under 13.

12. Changes to This Policy

We may update this policy. We will post the new version with its date and, for a material change, notify account holders by email or in the Service before it takes effect.

13. Contact

For privacy questions or requests: MTC Group LLC · support@mtcgroupllc.com