Privacy-by-Design Architecture
Privacy Policy
How we collect, encrypt, and handle clinical consent data across our decentralized SaaS network.
Version 1.0.0 · Last Updated: May 25, 2026
1. Overview
ConsentCollect ("we," "our," "us") provides digital consent infrastructure built for high-stakes healthcare environments. We operate a "Privacy-by-Design" philosophy where data security, local isolation, and defensive cryptography are built directly into the codebase. This Privacy Policy describes how we process information, our strict data boundaries, and your rights.
2. Granular Data Collection Matrix
The Platform segregates data based on its sensitivity and processes it according to the following matrix:
| Category | Data Fields | Storage Method | Subprocessors Engaged |
|---|---|---|---|
| Clinician PII | Name, Email, Professional Title, Organization Name, Phone, Website | Plaintext in database, indexes active | Kinde Pty Ltd, Convex Inc, Resend Inc (restricted to transactional email notifications / OTPs; strictly contains zero PHI) |
| Patient PII/PHI | Patient Name, DOB, MRN, Procedure Type, Signature Image, Witness Attestations | AES-256-GCM client-side encrypted before storage; storage URLs secured | Convex Inc, Cloudflare Inc (R2 Storage) |
| Technical Logs | API Call counts, server latency metrics, authentication timestamps | Standard server logs | Convex Inc |
| Forensic Telemetry | IP Address (redacted), Browser User-Agent, Screen Resolution, Client/Server Time Drift | Appended to audit events chain; cryptographic signature seals active | Convex Inc |
| AI Analytics | Metadata aggregates (e.g. signature speed, quiz pass/fail rates) | De-identified patterns, no raw PHI used in AI training | OpenAI (Clara Feature) |
3. Legal Bases for Processing
We process data under the following highly distinct jurisdictional legal frameworks:
HIPAA (US Healthcare): ConsentCollect acts as a "Business Associate" for all accounts operating under our standard clickwrap Business Associate Agreement (BAA) executed during onboarding, or a custom offline BAA (Enterprise Tier). On all tiers, the platform operates under a strict client-side zero-knowledge encryption model. All patient ePHI is encrypted locally on the device prior to network transit, rendering the database and hosting infrastructure blind to Protected Health Information (PHI).
GDPR (EU Citizens): The platform processes processing activities according to:
- Article 6(1)(b) (Contractual Performance): For administrative and clinician portal management features.
- Article 6(1)(f) (Legitimate Interests): For forensic security event auditing, platform resource usage optimization, and network defense logs.
- Article 9(2)(a) (Explicit Consent): For processing specific special categories of data (health metrics, electronic signatures) initiated directly by the patient through the SignerGateway interactive workflows.
CCPA/CPRA (California): We act strictly as a Service Provider. We do not "sell" or "share" patient PHI or clinician registration details with third parties for commercial cross-context advertising.
DPDP Act (India): For users processing personal data within the territory of India, ConsentCollect operates strictly as a Data Processor on behalf of the user, who acts as the sole Data Fiduciary.
- No Self-Serve Processing Without a Contract: In strict compliance with Section 8(2) of the DPDP Act, 2023, users on self-serve tiers explicitly agree that these Terms of Service, paired with our standard Data Processing Addendum (DPA), constitute the binding legal contract governing all processing.
- Zero-Knowledge Technical Isolation: Because the platform enforces client-side encryption (AES-256-GCM) at the edge, ConsentCollect does not "possess" or "read" readable digital personal data of patients. The Data Fiduciary retains absolute control over the data lifecycle, consent architecture, and key custody.
4. Data Retention & Disposal Schedules
We maintain strict record lifecycles to minimize data footprint:
- Active Drafts: Unsigned drafts are subject to auto-archiving. An automated daily cron job flags expired drafts, and they are deleted after 90 days.
- Completed Records: Sealed clinical consent records and signature files are retained for the duration of the clinician's active subscription, or as mandated by regional healthcare record retention laws.
- Terminal Account Closure: Upon account closure, a 30-day export window is opened. After this window, the platform runs a cascading terminal erasure job that deletes all database entries and explicitly deletes orphaned signatures, avatars, and identity scans from storage.
- Audit Logs: To satisfy HIPAA 45 CFR § 164.530(j) and clinical trial regulations, the cryptographic audit trail (redacted log files showing action codes, timestamps, and pseudonymized actor IDs) is retained for six (6) years.
5. Patient Rights Management
Because we encrypt patient data client-side (Zero-Knowledge), we cannot read or retrieve patient identities directly without the clinician's specific access key. Patients seeking to exercise their rights must direct their requests to the clinician or clinical organization that issued their consent form.
General Rights (GDPR/CCPA): Patients may request access, rectification, porting, or erasure. The clinician can execute withdrawals or run erasures directly from the dashboard, which programmatically executes database deletions and clears media caches.
Data Principal Rights (India): In alignment with the DPDP Act, Indian patients (Data Principals) maintain the right to access, correction, completion, and erasure of their personal data, as well as the right to withdraw consent at any time. Because ConsentCollect processes only encrypted data strings, Data Principals must direct all requests to the respective Data Fiduciary (the Clinician or Hospital). The platform provides the Data Fiduciary with a programmatic deletion hook (
executeTerminalErasure) to fulfill erasure requests instantly across the production database and Cloudflare R2 storage assets.6. Comprehensive Security Architecture
The Platform's defense architecture features multiple layers of security to prevent unauthorized access:
- Web Crypto API E2EE: Plaintext patient data is encrypted in the user's browser using AES-256-GCM. Keys are derived locally using PBKDF2 with 100,000 iterations from a salt based on the form ID. Plaintext keys are never transmitted.
- Mandatory Kinde MFA & TOTP: To ensure secure clinician identity and access management, every single user registration on the platform strictly requires Multi-Factor Authentication (MFA) utilizing Time-based One-Time Passwords (TOTP) managed natively by Kinde. Clinicians are strongly recommended to download and securely store their MFA recovery codes immediately. Accounts are completely and permanently unrecoverable by the platform in any scenario if MFA credentials or recovery codes are lost or verification fails.
- HMAC-SHA256 Cryptographic Audit Chain: Every event (creation, access, signing, verification) is hashed and linked to the previous event's hash in a secure HMAC chain. Any attempt to modify a past log entry breaks the chain and triggers immediate security alerts.
- Point-in-Time Forensic Logging: To satisfy eIDAS and 21 CFR Part 11 requirements, signing events trigger a point-in-time snapshot capture of device fingerprints, redacted IP addresses, screen ratios, and NTP time drift to verify signature authenticity and ensure non-repudiation.
- Automatic PHI Shielding: To prevent data leaks, clinical metadata processed for analytics is scanned with
compromise.jsNLP and regex to remove identifying information before indexing or transmission to third-party tools.
Contact Us
For compliance questions or data practice audits, please contact our privacy officer at hello@consentcollect.com.