Privacy-by-Design Architecture
Privacy Policy
How we collect, encrypt, and handle clinical consent data across our decentralized SaaS network.
Version 1.0.0 · Last Updated: May 25, 2026
1. Overview
ConsentCollect ("we," "our," "us") provides digital consent infrastructure built for high-stakes healthcare environments. We operate a "Privacy-by-Design" philosophy where data security, local isolation, and defensive cryptography are built directly into the codebase. This Privacy Policy describes how we process information, our strict data boundaries, and your rights.
2. Granular Data Collection Matrix
The Platform segregates data based on its sensitivity and processes it according to the following matrix:
| Category | Data Fields | Storage Method | Subprocessors Engaged |
|---|---|---|---|
| Clinician PII | Name, Email, Professional Title, Organization Name, Phone, Website | Plaintext in database, indexes active | Kinde Pty Ltd, Convex Inc, Resend Inc (restricted to transactional email notifications / OTPs; strictly contains zero PHI) |
| Patient PII/PHI | Patient Name, DOB, MRN, Procedure Type, Signature Image, Witness Attestations | AES-256-GCM client-side encrypted before storage; storage URLs secured | Convex Inc, Cloudflare Inc (R2 Storage) |
| Technical Logs | API Call counts, server latency metrics, authentication timestamps | Standard server logs | Convex Inc |
| Forensic Telemetry | IP Address (redacted), Browser User-Agent, Screen Resolution, Client/Server Time Drift | Appended to audit events chain; cryptographic signature seals active | Convex Inc |
| AI Analytics | Metadata aggregates (e.g. signature speed, quiz pass/fail rates) | De-identified patterns, no raw PHI used in AI training | OpenAI (Clara Feature) |
| Marketing & Product Telemetry | Anonymized page views, clicked CTAs, engagement duration milestones, referral sources, client system properties (browser language, screen size) | Anonymized first-party pixel logs, hashed client IP; strictly contains zero PII/PHI | Umami (Cloud Analytics) — **strictly restricted to public marketing pages; 100% disabled within the secure auth-gated workspace (/app and /admin routes)** |
3. Legal Bases for Processing
We process data under the following highly distinct jurisdictional legal frameworks:
HIPAA (US Healthcare): ConsentCollect acts as a "Business Associate" for all accounts operating under our standard clickwrap Business Associate Agreement (BAA) executed during onboarding, or a custom offline BAA (Enterprise Tier). On all tiers, the platform operates under a strict client-side zero-knowledge encryption model. All patient ePHI is encrypted locally on the device prior to network transit, rendering the database and hosting infrastructure blind to Protected Health Information (PHI).
GDPR (EU Citizens): The platform processes processing activities according to:
- Article 6(1)(b) (Contractual Performance): For administrative and clinician portal management features.
- Article 6(1)(f) (Legitimate Interests): For forensic security event auditing, platform resource usage optimization, and network defense logs.
- Article 9(2)(a) (Explicit Consent): For processing specific special categories of data (health metrics, electronic signatures) initiated directly by the patient through the SignerGateway interactive workflows.
CCPA/CPRA (California): We act strictly as a Service Provider. We do not "sell" or "share" patient PHI or clinician registration details with third parties for commercial cross-context advertising.
DPDP Act (India): For users processing personal data within the territory of India, ConsentCollect operates strictly as a Data Processor on behalf of the user, who acts as the sole Data Fiduciary.
- No Self-Serve Processing Without a Contract: In strict compliance with Section 8(2) of the DPDP Act, 2023, users on self-serve tiers explicitly agree that these Terms of Service, paired with our standard Data Processing Addendum (DPA), constitute the binding legal contract governing all processing.
- Zero-Knowledge Technical Isolation: Because the platform enforces client-side encryption (AES-256-GCM) at the edge, ConsentCollect does not "possess" or "read" readable digital personal data of patients. The Data Fiduciary retains absolute control over the data lifecycle, consent architecture, and key custody.
4. Data Retention & Disposal Schedules
We maintain strict record lifecycles to minimize data footprint:
- Active Drafts: Unsigned drafts are subject to auto-archiving. An automated daily cron job flags expired drafts, and they are deleted after 90 days.
- Completed Records: Sealed clinical consent records and signature files are retained for the duration of the clinician's active subscription, or as mandated by regional healthcare record retention laws.
- Terminal Account Closure: Upon account closure, a 30-day export window is opened. After this window, the platform runs a cascading terminal erasure job that deletes all database entries and explicitly deletes orphaned signatures, avatars, and identity scans from storage.
- Audit Logs: To satisfy HIPAA 45 CFR § 164.530(j) and clinical trial regulations, the cryptographic audit trail (redacted log files showing action codes, timestamps, and pseudonymized actor IDs) is retained for six (6) years.
5. Patient Rights Management
Because we encrypt patient data client-side (Zero-Knowledge), we cannot read or retrieve patient identities directly without the clinician's specific access key. Patients seeking to exercise their rights must direct their requests to the clinician or clinical organization that issued their consent form.
General Rights (GDPR/CCPA): Patients may request access, rectification, porting, or erasure. The clinician can execute withdrawals or run erasures directly from the dashboard, which programmatically executes database deletions and clears media caches.
Data Principal Rights (India): In alignment with the DPDP Act, Indian patients (Data Principals) maintain the right to access, correction, completion, and erasure of their personal data, as well as the right to withdraw consent at any time. Because ConsentCollect processes only encrypted data strings, Data Principals must direct all requests to the respective Data Fiduciary (the Clinician or Hospital). The platform provides the Data Fiduciary with a programmatic deletion hook (
executeTerminalErasure) to fulfill erasure requests instantly across the production database and Cloudflare R2 storage assets.6. Comprehensive Security Architecture
The Platform's defense architecture features multiple layers of security to prevent unauthorized access:
- Web Crypto API E2EE: Plaintext patient data is encrypted in the user's browser using AES-256-GCM. Keys are derived locally using PBKDF2 with 100,000 iterations from a salt based on the form ID. Plaintext keys are never transmitted.
- Clinician Identity & Access Management: To ensure secure administrative access, clinician registrations and portals are protected via standard secure single sign-on (SSO) protocols or encrypted credentials. Clinicians are responsible for safeguarding their login credentials to maintain secure workspace sessions.
- HMAC-SHA256 Cryptographic Audit Chain: Every event (creation, access, signing, verification) is hashed and linked to the previous event's hash in a secure HMAC chain. Any attempt to modify a past log entry breaks the chain and triggers immediate security alerts.
- Point-in-Time Forensic Logging: To satisfy eIDAS and 21 CFR Part 11 requirements, signing events trigger a point-in-time snapshot capture of device fingerprints, redacted IP addresses, screen ratios, and NTP time drift to verify signature authenticity and ensure non-repudiation.
- Automatic PHI Shielding: To prevent data leaks, clinical metadata processed for analytics is scanned with
compromise.jsNLP and regex to remove identifying information before indexing or transmission to third-party tools.
7. Public Telemetry & Product Analytics (Umami)
We use Umami Cloud, a privacy-first web analytics platform, to gather anonymous usage trends and optimize our web presence.
- Zero Cookies & Identifiers: Umami does not set cookies, use persistent browser cache identifiers, or track users across third-party websites. All tracking is completely anonymized.
- No PHI/PII Processing: Under no circumstances is patient Protected Health Information (PHI) or clinician Personal Identifying Information (PII) processed by or transmitted to Umami.
- Strict Dashboard Exclusion: Telemetry tracking is active strictly on public pages (such as our landing page, template library, free tools, and free builder landing/sandbox). **Tracking scripts are programmatically unmounted and disabled completely** the moment a user signs in or enters the secure auth-gated dashboard workspace (`/app` and `/admin` routes). No session tracking or interaction logs are recorded within these secure clinical zones.
Contact Us
For compliance questions or data practice audits, please contact our privacy officer at hello@consentcollect.com.