Privacy Policy

Contact and account information you provide when you create an account or communicate with us — such as your name, work email address, phone number, company, and role.

Usage information generated when you use the Docflow application, such as log data, device and browser information, and actions taken in the product. We use this to operate, secure, and improve the service.

Customer content processed on behalf of our healthcare customers — including documents and records that may contain protected health information (PHI) — is handled exclusively under our customer agreements and Business Associate Agreements (BAAs), and is not used for marketing.

To provide, operate, secure, and support the Docflow service; to verify your identity when you sign in (including sending login verification codes); to communicate with you about the service; and to meet our legal and compliance obligations.

We do not sell personal information.

If you provide your phone number and opt in to text-message verification, we use it solely to send account security messages, such as one-time login verification codes.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties, except as required to deliver the messages (for example, our text-messaging service provider) or as required by law. Information sharing with subcontractors in support services, such as customer service, is permitted.

Message frequency varies based on your sign-in activity. Message and data rates may apply. You can opt out of text messages at any time by replying STOP, or get assistance by replying HELP. Opting out of verification texts may require you to use an alternative verification method to access your account.

We share information only with service providers who help us operate the service (such as cloud hosting, communications, and support tooling), under contracts that restrict their use of the information; with our customers, when you use Docflow through your employer's workspace; and as required by law.

We protect information with industry-standard safeguards, including encryption in transit and at rest, role-based access controls, multi-factor authentication, and audit logging. Our platform is built for HIPAA compliance, and we enter into Business Associate Agreements with our healthcare customers.

We retain personal information for as long as needed to provide the service and meet legal, security, and compliance requirements, after which it is deleted or de-identified.

You may request access to, correction of, or deletion of your personal information by emailing [email protected]. If you use Docflow through your employer, some requests may be routed to them as the data controller for your workspace.

We may update this policy from time to time; material changes will be reflected on this page with an updated effective date.