1. Scope
This Privacy Policy applies to personal information PatientLock collects through its website, customer and administrator interactions, VitalSec account and service operations, support, and professional services.
2. Information we collect
Depending on how you interact with PatientLock, we may collect contact and account information, authentication and authorization records, support communications, service and audit metadata, device and security telemetry, configuration and control-state information, and information you choose to provide during an advisory or managed-service engagement.
VitalSec is designed primarily to work with security, infrastructure, identity, device, control, and operational evidence rather than clinical records. Customers should not intentionally place protected or regulated content into fields that are not designed for it.
3. How we use information
We use information to provide and secure services, authenticate users, operate customer workspaces, investigate support and security issues, maintain service records, communicate with customers, improve reliability and usability, comply with law, and perform obligations in an executed agreement.
4. Service providers and subprocessors
PatientLock uses service providers to operate portions of its technology and business. The current public list is maintained at Subprocessors. Service-specific providers may also be identified in an Service Order, SOW, DPA, or BAA.
5. Managed security and advisory services
Where a customer purchases PatientLock MDR powered by SilverSky or another service delivered through an identified supplier, information required to deliver that service may be processed by the supplier under the applicable agreement and supplier terms. Advisory engagements may involve customer-provided security, policy, incident, or assessment information.
6. Protected health information
When PatientLock acts as a Business Associate and creates, receives, maintains, or transmits PHI on behalf of a Covered Entity, the parties' executed Business Associate Agreement governs that PHI.
7. Data retention
PatientLock retains information for the period reasonably needed to provide the service, maintain security and business records, satisfy contractual commitments, and meet legal obligations. Customer-specific retention requirements may be stated in an executed agreement.
8. Security
PatientLock uses administrative, technical, and organizational safeguards appropriate to the information and service involved. Additional information is available in Security & Trust. A cloud or service provider's certification does not by itself represent a PatientLock certification.
9. Your privacy rights
Depending on applicable law and your relationship with PatientLock, you may have rights to request access, correction, deletion, restriction, portability, or information about use of your personal information. Where PatientLock processes information for a customer as processor or service provider, requests may need to be directed to that customer as controller or business.
Requests may be sent to privacy@patientlock.net.
10. International data handling
PatientLock does not promise a particular data-residency region on this public page. Where residency, localization, or transfer requirements apply, the applicable architecture and contractual mechanism must be documented in the customer's executed agreement before production use.
11. Changes
PatientLock may update this policy to reflect changes in law, services, or data practices. Material changes will be posted with a revised update date.