Privacy policy

Two different roles

VitalFax handles personal data in two distinct capacities, and they are governed differently.

• As a service provider to our customers. Documents, fax numbers, contacts and audit records belong to the customer organization. VitalFax processes them on that organization’s instructions under a Business Associate Agreement or equivalent contract. This policy does not govern that data; the agreement does.
• For our own website and account records. Visitor analytics, enquiry forms and the accounts of people who sign in are ours to explain, and that is what the rest of this policy covers.

What we collect on this website

VitalFax uses no third-party analytics, advertising or tracking services. There are no third-party cookies and no advertising pixels.

• A first-party visitor identifier. A random value stored in a cookie so we can tell whether a visit came from a search, a link or a campaign. It contains no personal data and is not connected to a person unless they submit a form.
• Page and referrer. The path visited and the host of the referring site. We store the referring host only, not the full referring URL, because full URLs can carry search terms and other data.
• What you type into a form. Your name, work email, organization, role and message. We use it to reply to you and to understand demand.

What we collect in the service

• Account records. Name, work email, role and organization membership for each person who signs in.
• Security records. Session activity, sign-in attempts, the IP address and browser used, and the audit events described in the security page.
• Usage records. Counts of pages sent and received, numbers held and storage used, for billing and capacity.

What we do not do

• We do not sell personal data.
• We do not use customer documents for advertising or for training models.
• We do not put document content, names or fax numbers into application logs. The logger redacts those fields before anything is written.
• We do not put clinical detail into notifications. A notification says a document arrived, never what it contains.

Cookies

VitalFax sets a small number of first-party cookies and no third-party cookies.

• Session cookie. Keeps you signed in. Marked HttpOnly and SameSite, and transmitted only over HTTPS in production.
• CSRF cookie. Protects against cross-site request forgery on state-changing actions.
• Visitor cookie. The random attribution identifier described above.

How long we keep things

Website enquiries are kept while they remain relevant to a conversation. Account records are kept for the life of the account. Document retention inside the service is configured by each customer organization in its own security settings, and documents past the retention period are surfaced for deletion rather than removed silently.

Who we share with

Only the service providers listed on the subprocessors page, each for the purpose stated there. We will also disclose data where we are legally required to, and where we can we will tell the affected customer first.

Your choices

You can ask us what we hold about you, ask us to correct it, or ask us to delete it. If you are a user of a customer organization’s VitalFax account, we will direct requests about that organization’s data to them, because it is their data and they decide.

Security

The controls that protect this data are described in detail on the security page, including what is not yet done.

Contact

Privacy questions and data requests: privacy@vitalfax.com. Security reports: security@vitalfax.com.

Changes

When this policy changes materially we will update the effective date and notify customers with an active agreement.