Privacy Policy
Last updated: October 17, 2026.
What CredTrack stores
CredTrack stores provider administrative data entered by a practice: provider names, NPIs, specialties, contact details for the practice's own staff, credential metadata (type, issuer, number, issue/expiry dates), payer enrollment records (payer, status, dates), and copies of credential documents the practice chooses to attach (for example a scanned license). It also stores an audit log of changes to that data. Attached documents are copies the practice uploaded; CredTrack does not verify them with issuers, and patient documents must never be attached.
What CredTrack never stores
Patient data. CredTrack has no fields for patient information and must not be used to store it. If patient data is sent to us by mistake, tell us at don+credtrack@lifeofmorr.com and we will delete it and confirm the deletion.
How data is used
Registry data is used only to operate the service for the practice that owns it: computing statuses, generating digests, and maintaining the audit log. We do not sell registry data, share it with third parties for marketing, or use it to train models.
Isolation and access
Each practice's data is accessible only with that practice's API key; keys are stored as SHA-256 hashes. Practices cannot see each other's data.
Retention and deletion
After cancellation, data remains readable for 30 days, exports are available on request within 7 days, and data is deleted within 30 days after the read window.
Payments
Subscriptions are processed by Stripe. We do not store card numbers.
Contact
Privacy questions: don+credtrack@lifeofmorr.com.