Compliance Guide

• We don’t sell your vault. Sensitive documents and customer personal information are not sold, rented, or handed to third parties for their marketing or unrelated commercial use. Processors only help us run the Service.
• We may look—because that’s the job. By using Rep Re: Vault, you authorize Alyssa Boyd LLC d/b/a Rep Re: Vault to view and handle vault contents for credentialing workflows, optional paid Managed Review, and fraud/quality/security audit.
• Core platform is free; Managed Review is optional. Facilities that subscribe get administrative review help. Your facility remains the final authority on who gets vendor access. We don’t certify representatives.
• Assistive ≠ perfect. We don’t promise to catch every wrong name, expired file, mismatch, or forgery. Facilities should keep their own verification practices.
• If a review incident happens: we use a written acknowledgment, may pause that facility’s Managed Review while you keep DIY tools, and then discuss whether to continue—without treating “reported discrepancy” language as an admission of liability.

Paid subscribers should review the Facility Managed Review Subscription Addendum and use the Review Incident Acknowledgment for a reported discrepancy or review incident.

What it is

Rep Re: Vault is a free vendor-credentialing vault. Medical device representatives store professional compliance documents in one place and share them with hospitals and facilities they have joined. Facility Admins review those materials according to requirements their organization chooses to configure.

What it is not

• Not a patient electronic health record (EHR) or charting system
• Not a guarantee of hospital admission or vendor badge access
• Not a background-check bureau, SSN vault, or driver’s-license repository
• Not a law firm, compliance consultancy, or clinical decision-maker
• Not an open broadcast of every rep’s documents to every facility on the platform

Facilities decide access. Rep Re: Vault provides software; your facility’s policies and staff make the final call.

We built the product around three principles:

If a facility needs identity or background-check documentation that Rep Re: Vault does not support, the facility should collect it through its own approved offline or third-party process—not by asking users to force prohibited data into the vault.

Commonly stored (categories)

Depending on what users upload and what facilities request:

• Account identifiers (name, email, phone for verification)
• Company / employer and role
• Home territory or state
• Certificates of insurance / general liability (COI/GL)
• Immunization records (with declination path where accepted)
• TB screening documentation
• Training certificates and education records
• Professional licenses or certifications
• Facility policy acknowledgments and e-signatures
• Membership / join status and related metadata (upload dates, expiration fields, document types)

Not collected / not supported in the core vault

• Social Security numbers
• Driver’s license or state ID numbers
• Full background-check dossiers or consumer investigative reports
• Patient charts or patient PHI

See the Privacy Policy for fuller detail on processing purposes and rights.

Representative owns vault
        │
        ├── uploads permitted credential docs
        │
        └── requests to join Facility A, B, C…
                    │
                    ▼
         Facility Admin reviews / approves
                    │
                    ▼
     Facility A can view shared docs for that membership
     Facility B (not joined) cannot see that vault via join model

Unjoin / leave: When a membership ends, the facility loses access to that membership view inside Rep Re: Vault (subject to logs and any copies the facility retained under its own policies).

Operators / subprocessors: Cloud hosting, authentication, and related providers may process data as needed to run the Service, under our instructions and contracts.

Core credentialing vault

Documents in Rep Re: Vault are typically the Representative’s own compliance materials (insurance, immunizations, training, licenses, etc.) used for vendor access programs. That is generally not patient protected health information (PHI).

We do not intend to store patient medical records.

User rule

Do not upload patient PHI into Rep Re: Vault.

Business Associate Agreement (BAA)

• Some facilities may determine—based on their specific use of a tool—that a BAA is appropriate.
• Rep Re: Vault offers a hospital/facility BAA on request.
• Request a BAA via support@reprevault.com or Contact Us.
• Whether a BAA is required is a legal determination for the facility (and its counsel), not something the platform alone decides.

This Guide does not expand or limit any signed BAA. If a BAA is executed, it controls for the HIPAA subject matter it covers as between Rep Re: Vault and that facility.

We use modern cloud practices designed to protect accounts and documents, including:

• Authenticated access with role-based permissions
• Encrypted transit (HTTPS/TLS) where supported by browsers and our stack
• Infrastructure hosted with reputable cloud providers (including Lovable Cloud / Supabase and similar)
• Administrative access limited to personnel and systems that need it to operate and support the Service
• Logging and monitoring oriented toward security and reliability

Residual risk: No online service is perfectly secure. Users must protect passwords, use unique credentials, and report suspected incidents quickly.

Incident / security contact: support@reprevault.com

We describe practices at a high level intentionally; publishing excessive technical detail can help attackers. Procurement teams may request additional questionnaire responses through support.

To operate Rep Re: Vault we engage categories of providers such as:

• Cloud hosting and databases
• Authentication services
• Email delivery
• Analytics providers (as enabled; see Cookie Notice)

Exact vendor lists may change as we scale. When we add advertising or new analytics, we will update the Privacy Policy and Cookie Notice.

Representatives are responsible for

• Uploading accurate, unaltered documents
• Keeping credentials current
• Not uploading patient PHI or prohibited data (SSN, DL numbers, BG dossiers)
• Joining only facilities they intend to work with
• Securing their account credentials
• Complying with employer and facility policies that apply to them

Facilities are responsible for

• Defining vendor credentialing requirements
• Approving or denying join requests
• Deciding physical / vendor access independently of the platform
• Managing Facility Admin accounts
• Applying their own verification and risk programs
• Determining whether a BAA or other contracting is required
• Handling any offline collection of data types Rep Re: Vault does not support

Rep Re: Vault is responsible for

• Operating the Service consistent with the Terms and Privacy Policy
• Maintaining joined-facility sharing controls in the product design
• Offering a BAA on request where a facility’s use case requires it
• Processing privacy and deletion requests within a reasonable time, subject to legal retention
• Engaging infrastructure providers under appropriate arrangements

Rep Re: Vault may allow facilities to indicate which document categories they expect. That configuration is a convenience. It does not:

• Create a warranty that any set of documents is legally sufficient
• Replace Joint Commission, CMS, state, or system-specific requirements
• Obligate Rep Re: Vault to police every facility policy

Facilities should treat the product as one intake channel among possibly several.

We may verify that the requester controls the relevant account or is an authorized facility contact before fulfilling sensitive requests.

Retention reminder: We keep data while accounts are active and as needed for legal and security purposes. On unjoin, facility access to that membership view ends in-product. Account deletion is processed within a reasonable time subject to lawful retention and backups. Details: Privacy Policy.

• Privacy Policy
• Terms of Service
• Cookie Notice
• Contact Us

Email: support@reprevault.com
Web: Contact Us

Governing law for our user agreements is Indiana, USA, as stated in the Terms of Service.