Room 1. The company standing behind this page
Fortify 24x7 owns the storefront, holds the vendor contracts, signs the agreement, and answers for everything described below. Care Secure Systems is simply the name it trades under when it sells to healthcare. Send anything you want to raise to support@caresecuresystems.com. A human reads that address.
Room 2. Two kinds of data, kept firmly apart
This page separates two things that get muddled constantly on vendor websites, because the rules governing them are not the same.
- Account data. Who bought a subscription, which lines they hold, and how to reach them. This notice governs that.
- Clinical data. Whatever the tools encounter inside your environment, which will include protected health information on several of the lines. Your service agreement and the business associate agreement covering it govern that.
Where this notice and a business associate agreement disagree, the business associate agreement is the one that counts. Settle it before agents are deployed, not after somebody notices.
Room 3. What the storefront itself picks up
Very little, and that is a design choice rather than an accident. These pages are static files. They call two endpoints on the billing service, one for published rates and one to open a checkout session, and they pull typefaces from Google. No advertising network, no analytics tracker, and no behavioral pixel is loaded on any page here.
- The service list you are assembling lives in your own browser storage under the key care_cart. It stays on that device until you press the checkout button.
- A portal sign-in token lives in the same storage under care_portal_session. Signing out deletes it immediately.
- The hosting platform writes ordinary web server logs. Those hold network addresses, browser strings, and timestamps, and they exist for diagnosis and for dealing with abuse.
Room 4. What checking out tells us
Stripe runs the payment. Card numbers travel from your browser to Stripe and are never seen here, which is probably the single most useful line on this page.
- Stripe passes back a billing name, an email address, a country, the card brand and its final four digits, and whether each charge succeeded.
- We keep the shape of your subscription: the lines, the counts, and the monthly total those add up to.
- That email address becomes the key to the portal, which is a good argument for using one attached to the practice rather than to one individual.
Room 5. Support cases
Cases live in the service desk platform that Fortify 24x7 runs. A case holds what you wrote, what we wrote back, the times of both, and which account it belongs to.
Please keep patient details out of a case. When we genuinely need a sample file, an affected mailbox, or a specific record in order to reproduce something, we will ask you directly and name a route that suits the material.
Room 6. Other companies in the chain
Running a managed service means bringing in other companies. Each is under contract for its own part, and none of them receive your information to use for purposes of their own.
- Stripe processes payments and holds card details.
- Microsoft Azure hosts the billing service and serves these pages.
- The platforms named throughout this site handle whatever their own function requires: SentinelOne, Fluency, ThreatLocker, Ironscales, N-able N-sight, Addigy, Zimperium, Actifile, N-able Cove, and Dropsuite.
- The service desk platform behind Fortify 24x7 stores your case history.
Room 7. Retention
- Financial and tax records stay for whatever period the law obliges.
- Case history survives the account and a stretch beyond it, so a returning practice does not begin from an empty page.
- Whatever sits inside a security platform follows the retention set on that line. Backup windows are the obvious case, and they get agreed with you during sizing.
- Browser storage on your own machine lasts until you clear it, or until the checkout confirmation page empties the service list for you.
Room 8. Asking us for things
Mail us from whichever address the account runs on and ask for any of these. Expect us to confirm who you are first, because a request granted easily is a request granted easily to anybody.
- A copy of the account information held about you.
- A fix, where something is recorded incorrectly.
- Erasure, other than where an obligation or a statute requires the record to stay.
- An export of whatever a given platform can export. At exit we do this without being asked.
- Residents of California and of other states with their own privacy statutes hold further rights, among them the right not to be treated worse for using them. We sell no personal information and have no plans to begin.
Room 9. Keeping it safe
Traffic to this storefront and to the billing service is encrypted while it moves. Records are reachable only by staff whose work requires them, administrative access needs more than a password, and platform credentials live inside a managed secret store instead of a document somebody carries around.
No arrangement is flawless and ours is not either. Should anything happen that touches your information, you will hear about it from us directly, quickly, and with enough detail to make your own decisions about it.
Room 10. Changes
A revision date is printed above. Anything material earns a fresh date, and where it bears on a running subscription the account holder gets a message. Silent edits are not how this is handled.