Privacy Policy

Rep Re: Vault is operated by Alyssa Boyd LLC d/b/a Rep Re: Vault. For privacy questions, access requests, or other privacy-related inquiries:

• Email: support@reprevault.com
• Contact form: Contact Us (or the Contact Us page on our site)

We may ask you to verify your identity before fulfilling certain requests.

We designed Rep Re: Vault with these principles in mind:

1. Free core platform. Representatives and facilities use the credentialing vault at no charge for core storage, join, share, and review tools.
2. Joined-facility sharing only. Credential documents and related profile details you share through the vault are made available only to facilities you have joined (and, as needed, our service providers who help operate the Service)—not as an open broadcast to every facility on the platform.
3. We do not sell or rent your sensitive documents or customer personal information to third parties for their marketing or other unrelated commercial use. We do not share vault documents with unrelated third parties for those parties’ own marketing or commercial purposes.
4. Operator access for service delivery. Alyssa Boyd LLC d/b/a Rep Re: Vault personnel may view and handle vault contents solely to operate the Service—including credentialing workflows, optional Managed Review when a facility subscribes, and fraud, quality, security, and audit reviews.
5. We do not collect Social Security numbers, driver’s license numbers, or background-check dossiers as part of the core Service.
6. Facilities decide access. We provide a tool (and, when subscribed, administrative review assistance). Each facility remains the final authority on vendor access decisions. We do not “certify” representatives.

This Policy applies to:

• Our marketing website and product application
• Accounts for Representatives and Facility Admins
• Information we collect through the Service, support channels, and (when enabled) cookies or similar technologies

This Policy does not apply to:

• Third-party websites or services we link to (their own policies apply)
• Information a facility collects from you outside Rep Re: Vault (for example, paper forms, badge desks, or offline background checks the facility runs itself)
• Patient medical records or electronic health records—we do not intend to operate as a patient chart system

Your employer or facility may also have its own policies that apply to your use of the Service.

5.1 Account and profile information

Depending on your role, we may collect:

• Name and display name
• Email address and phone number (including for verification)
• Password or authentication credentials (stored in hashed or otherwise protected form via our authentication provider)
• Company / employer name
• Role (Representative or Facility Admin)
• Home territory or state (and similar professional location information you provide)
• Facility affiliation details for Facility Admins

5.2 Facility membership and join activity

• Join requests, approvals, declines, and unjoin / leave events
• Which facilities a Representative has joined
• Facility-side notes or status related to membership (as configured in the product)

5.3 Credential documents and professional information

Representatives may upload or enter materials that facilities commonly request for vendor credentialing, such as categories including:

• Certificates of insurance / general liability (COI/GL) and related coverage documentation
• Immunization or vaccination records, with a declination path where a facility accepts declinations
• Tuberculosis (TB) screening documentation
• Training certificates and education records
• Professional licenses or certifications
• Facility policy acknowledgments and electronic signatures
• Other professional credential documents a joined facility asks you to provide through the Service

We also store metadata about those documents (for example, document type, upload date, expiration date you or the facility associates with an item, and file name).

You control what you upload. Facilities control what they require. Do not upload information that is not needed for credentialing or that we prohibit (see below).

5.4 Communications and support

• Messages you send to support
• Emails or in-product notices we send you (and related delivery/engagement metadata)
• Feedback or survey responses you choose to provide

5.5 Device, log, and usage data

When you use the Service, we and our infrastructure providers may automatically collect:

• IP address, browser type, device type, and operating system
• Approximate location derived from IP address
• Pages or screens viewed, features used, timestamps, and referral URLs
• Diagnostic, security, and performance logs

Optional precise location (facility check-in). Precise device location is never required and is never collected automatically. If you choose to opt in on the check-in screen, we request a single location reading from your device to suggest the closest facility, and we may store those coordinates and their accuracy with the visit record you create. We do not use it for continuous or background tracking, we do not sell it, and you can turn the setting off at any time on the check-in screen; turning it off stops any future location collection.

5.6 Cookies and similar technologies

We may use cookies, local storage, and similar technologies for essential operation of the Service and, in the future, for analytics or advertising. See our Cookie Notice for categories and controls.

5.7 Information we do not collect (core Service)

As of the date above, the core Rep Re: Vault Service is not designed to collect or store:

• Social Security numbers (SSNs)
• Driver’s license or state ID numbers
• Background-check dossiers, full criminal history reports, or similar investigative packages

If a facility requires those items, it may collect them outside Rep Re: Vault under its own processes and policies. Do not upload SSN, driver’s license numbers, or full background-check reports into the vault.

We also do not intend for you to upload patient protected health information (PHI) or patient charts. See Section 10.

We collect information from:

• You — registration, profile, uploads, and communications
• Your facility or employer — invitations, membership decisions, or facility-configured requirements (as applicable)
• Automated means — logs, cookies, and similar technologies
• Service providers — authentication, hosting, email delivery, and (when enabled) analytics providers acting on our behalf

We do not currently purchase consumer data brokers’ lists to build your credential profile.

We use information to:

• Create and manage accounts and authenticate users
• Operate the credential vault and share relevant profile/document information with facilities you have joined
• Process join requests and membership changes
• Send transactional notices (for example, account verification, security alerts, join status, document expiration reminders, and facility-related credentialing notices)
• Provide customer support and respond to inquiries
• Maintain security, prevent fraud and abuse, and enforce our Terms
• Improve, troubleshoot, and develop the Service (including aggregated or de-identified analytics)
• Comply with law, respond to lawful requests, and protect rights and safety
• If and when advertising helps fund the Service: deliver or measure ads, and distinguish marketing communications from transactional notices (see Sections 8 and 16)

We do not sell your personal information for money today. See Section 8 regarding “sale” / “share” under California law and future advertising.

Operator Access (Alyssa Boyd LLC d/b/a Rep Re: Vault)

By creating an account and uploading or submitting information or documents to the Service, you authorize Alyssa Boyd LLC d/b/a Rep Re: Vault and its authorized personnel to view, store, process, and handle that information and those documents solely for:

1. Credentialing workflows — operating the vault, join/membership flows, facility-configured requirements, notifications, support, and related Service features;
2. Optional Managed Review Subscription — when a facility has an active paid subscription, assisting that facility with administrative review / approval marks against the facility’s stated requirements (assistive only; the facility remains the final decision-maker); and
3. Fraud, quality, security, and audit — detecting forged, altered, mismatched, expired, or otherwise suspicious uploads; protecting the integrity of the Service; enforcing our Terms; and complying with law.

We do not use vault documents or customer personal information to sell, rent, or license them to third parties for those parties’ marketing or unrelated commercial use.

Absolute no-sale / no-rent / no unrelated commercial sharing of vault content

We do not sell, rent, or trade your credential documents or customer personal information to third parties for their marketing or other unrelated commercial purposes. We do not share vault documents with unrelated third parties so those parties can use them for their own marketing or commercial use.

Sharing is limited to:

• Joined facilities — only facilities a Representative has joined, for that membership relationship;
• Service providers (processors) — only as needed to run and secure the Service (hosting, authentication, database, email delivery, payments for optional paid features, and similar infrastructure), under our instructions;
• Legal / safety / business transfers — as described below; and
• Your direction — when you ask us to or clearly consent to a specific disclosure.

8.1 Joined facilities

If you are a Representative, facilities you have joined may access the credential profile and documents you share for that membership relationship. If you unjoin a facility, that facility loses access to that membership view of your vault, subject to any copies or records the facility may have exported or retained under its own policies, and subject to our legitimate retention of logs for security or legal purposes.

Facility Admins see information appropriate to their facility’s joined Representatives and facility settings—not an open feed of all users on the platform.

8.2 Service providers (subprocessors)

We engage cloud hosting, authentication, database, email delivery, payment processors (for optional paid subscriptions), and similar providers only as needed to operate the Service. These processors handle information on our behalf to provide their services—not to market your documents or personal information for their own unrelated purposes.

8.3 Legal and safety

We may disclose information if we believe in good faith that disclosure is required by law, regulation, legal process, or governmental request, or is necessary to protect the rights, property, or safety of Rep Re: Vault, our users, facilities, or the public.

8.4 Business transfers

If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, personal information may be transferred as part of that transaction, subject to appropriate confidentiality and continued protections consistent with this Policy.

8.5 Aggregated or de-identified data

We may share aggregated or de-identified information that does not reasonably identify you.

8.6 With your direction

We may share information when you ask us to or consent to a specific disclosure.

8.7 Sale / share status (California and similar laws)

We do not sell personal information for monetary consideration. We do not sell or rent sensitive credential documents. We also do not knowingly “share” personal information for cross-context behavioral advertising today.

If we enable advertising or analytics in a way that constitutes a “sale” or “share” under the California Consumer Privacy Act as amended by the CPRA (or similar state laws), we will update this Policy and provide required notices and opt-out mechanisms before or when that practice begins.

Facilities may upload their own vendor policies, acknowledgments, and related materials for Representatives to view and attest. Those materials are the facility’s content. Rep Re: Vault does not certify that any Representative has met a facility’s legal, clinical, or accreditation obligations merely because a policy was viewed or an e-signature was captured in the product.

Exact screens and permissions may evolve with the product; the joined-facility-only principle remains central.

Rep Re: Vault stores your professional compliance and credentialing documents so that facilities you join can review them for vendor access programs. That is different from storing patient medical records.

• The core credentialing vault is generally not patient PHI. We do not intend to store patient charts or operate as an electronic health record.
• Do not upload patient PHI or information about identifiable patients into the Service.
• Immunization, TB, and similar documents about you as a vendor may be sensitive. Treat them carefully and upload only what a facility legitimately requires.
• If a facility’s particular use of the Service requires a Business Associate Agreement (BAA) under HIPAA, we offer a hospital/facility BAA on request. Contact support@reprevault.com. Whether a BAA is required depends on the facility’s use case and legal analysis—not on Rep Re: Vault alone.
• Facilities decide vendor access policies. The platform is a tool; it does not replace the facility’s compliance program.

We retain personal information:

• While your account is active, and
• As needed afterward for security, dispute resolution, backups, audit logs, and legal or regulatory obligations

Unjoin: When you leave or are removed from a facility, that facility loses access to that membership view in the Service. We may still retain account-level records and security logs.

Account deletion: You may request deletion of your account by contacting support@reprevault.com (or using in-product controls if available). We will process deletion requests within a reasonable time, subject to legal retention needs, backup cycles, and any information a facility independently retained outside the Service.

We may retain limited information as required to honor opt-outs, prevent fraud, or comply with law.

We use administrative, technical, and organizational measures designed to protect personal information, including measures appropriate to a modern cloud application (for example, encrypted transit where supported, access controls, and authenticated accounts). Our hosting and authentication partners provide additional infrastructure controls.

No method of transmission or storage is 100% secure. You are responsible for safeguarding your password and for activity under your account. Notify us promptly at support@reprevault.com if you suspect unauthorized access.

Rep Re: Vault is a professional tool for adults. The Service is intended for users 18 years of age or older. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us personal information, contact us and we will take appropriate steps to delete it.

The Service is operated from the United States. If you access the Service from outside the United States, you understand that your information may be processed and stored in the United States, where privacy laws may differ from those in your country. By using the Service, you acknowledge that transfer.

15.1 Account controls

You may review and update certain profile information by logging into your account. You may unjoin facilities subject to product and facility rules.

15.2 Marketing communications

You may opt out of marketing emails using the unsubscribe link in those messages or by contacting us. You will still receive transactional messages related to your account, security, and credentialing activity.

15.3 Cookies

See our Cookie Notice for browser and product controls.

15.4 California privacy rights (CCPA/CPRA)

If you are a California resident, you may have the right to:

• Know / access the categories and specific pieces of personal information we collected about you
• Delete personal information we collected from you, subject to exceptions
• Correct inaccurate personal information
• Opt out of sale or sharing of personal information (when applicable)
• Limit use and disclosure of sensitive personal information (when applicable)
• Non-discrimination for exercising your rights

Categories we may collect (depending on your use of the Service) include identifiers (name, email, phone); commercial or professional information (company, credentials, documents); internet or electronic activity (logs, usage); geolocation approximations (IP-based or territory you provide); and inferences we might draw for security or product improvement. Sensitive categories may include health-related immunization/TB documents you choose to upload for credentialing.

How to exercise: Email support@reprevault.com with the subject line “Privacy Request” and describe your request. We will verify your identity (for example, by confirming control of your account email) before fulfilling certain requests. You may use an authorized agent as permitted by law; we may require proof of authorization.

Shine the Light: California residents may request certain information about disclosure of personal information to third parties for their direct marketing. We do not disclose personal information to third parties for their own direct marketing in the manner covered by that statute today; contact us with questions.

Do Not Track: Some browsers send “Do Not Track” signals. We do not currently respond to DNT signals in a uniform way across the Service; see our Cookie Notice for practical controls.

15.5 Other U.S. state privacy laws

Residents of other states with comprehensive privacy laws may have similar rights (access, deletion, correction, opt-out of targeted advertising or sale). Contact us at support@reprevault.com to exercise applicable rights. We will honor requests as required by applicable law.

We will not treat transactional credentialing notices as marketing solely because they mention the product.

The Service may link to third-party sites (for example, training providers or facility websites). We are not responsible for their privacy practices. Review their policies before providing information.

A current summary of categories of subprocessors appears in Section 8.2 and in our Compliance Guide. We may publish a more detailed subprocessors list as the product matures.

We may update this Privacy Policy from time to time. We will post the revised version with an updated “Last updated” date. If changes are material, we may provide additional notice (for example, email or in-product notice). Continued use of the Service after the effective date of changes constitutes acceptance of the updated Policy, except where applicable law requires a different form of consent.

Questions about this Privacy Policy or our privacy practices:

Email: support@reprevault.com
Web: Contact Us