Privacy Policy
We will never sell your data. We won't market to you.
That holds whether you're a customer, a patient filling in one of our clients' forms, or just trying the demo. Here is the short version. The full policy is Fieldstone Health's, linked below.
Who we are and which policy applies
Secure Form is a service of Fieldstone Health, LLC, of Natick, Massachusetts, which builds and hosts online patient intake forms for healthcare organizations in the United States. Fieldstone Health's Privacy Policy is the one policy that covers this website, the inquiry form on it, the demo form, and the way we handle information on behalf of the organizations we work for. This page sums it up in plain language; where the two differ, the full policy governs.
When a healthcare organization uses Secure Form with real patient information, we act as its business associate under HIPAA. That organization decides what its forms ask for and how the answers are used; we provide the service under a Business Associate Agreement.
What this website collects
We don't keep our own log of the pages you visit. Our hosting provider's request logs record each visitor's IP address and the page address for 30 days, to run and protect its service.
The site sets one cookie, on the pages with a form, so that a form can only be sent from the page it was served on. It identifies nobody. There are no advertising cookies, no third-party analytics and no tracking pixels.
When you contact us
When you send the contact form or ask for your first form, we keep what you tell us: your name, organization, email address, phone number if you give one, your message, the kind of request you chose, and any blank form you attach. We also record the page you sent it from and any campaign tag in the link you followed, and we store a one-way hash of your network address to limit automated abuse.
We use it to reply the way you asked, to build the form you asked for, and to keep our records of the work. We keep it for two years after our last contact with you, and then delete it.
To build your form, we may use an AI service, currently OpenAI, to read the questions from your blank form, under terms that bar it from training on what we send. Please attach blank forms only. If a form arrives with patient information on it, we keep it out of the AI service and the build, return it securely or delete it, and ask for a blank copy.
Patient information collected through our clients' forms
If you filled in a form for your healthcare provider, your provider is responsible for that information and this policy applies alongside their own. We use what you entered only to deliver it to your provider and to run the service, never for our own purposes and never for marketing.
On a Direct Delivery plan, a completed form is turned into a PDF and delivered to the practice by encrypted email. The completed submission is kept for 30 days after delivery, so it can be sent again if the email is lost, and then deleted. Backup copies of our database that still contain it expire within a further 30 days. It is never placed in a long-term archive.
On a Workflow Portal plan, completed forms are kept in the organization's portal for as long as it is our client, and the staff it authorizes can see them there. Our own administrator can also open a submission when supporting the organization, and every view and download is recorded. If the organization asks us to set a shorter retention period, submissions older than that are deleted automatically. The organization's staff can't delete submissions; we remove one, such as a duplicate, when the organization asks, and whenever the law requires. Every organization's records are kept apart from every other's and encrypted with a key used only for that organization.
On both plans, answers, signatures, PDFs and uploaded photos are encrypted with a key used only for that organization before they are stored, and files are kept in Amazon S3 under Amazon Web Services' Business Associate Agreement with us. On a Workflow Portal plan, for HIPAA covered entities and business associates, every submission is also written to a backup archive that is locked against deletion and kept for one year, which protects it against accidental deletion, changes and tampering. Direct Delivery submissions are never archived.
When an organization's agreement with us ends, and after any export it asked for, we delete its forms, submissions and account data within 30 days, and the backup copies of our database that still hold them expire within a further 30 days. We keep only our record of when each submission was delivered or opened, and by whom, for six years. Copies in the locked archive can't be deleted before their lock date, even by us, so each one is deleted when its one-year lock ends, and stays protected as patient information until then.
Questions about your own information, and requests to see, correct or delete it, go to your provider, who can involve us as needed. If you write to us instead, we pass your request to your provider within 2 business days.
The demo form
The demo form is for made-up details, so please don't enter real patient information. Even so, it is built so that nothing you type leaves your browser. When you view the sample PDF, the page asks us for a sample made entirely from our own made-up patient, and none of your answers go with that request. The PDF is sent straight back to your browser and not kept. Nothing is emailed, and the demo asks for no email address.
To stop the demo being misused, we count how many sample PDFs each connection asks for, under a keyed hash of its network address rather than the address itself, and delete each count within about a day of that connection's last request. Our hosting provider's request logs record your network address there, as they do on this website.
The free first form we build for you is a demo too, under the Free Demo Terms: for made-up details only, with no file uploads and a limited number of test submissions, which go only to the person who asked for it. It expires after 15 days unless, by then, you've signed our agreements and we've activated your service. When it ends we delete its test submissions, and backup copies expire within 30 days.
Who we share information with
We share information only with the service providers that run our systems and send our email, and only as far as they need it to do that. Where patient information is involved, each of them has signed a Business Associate Agreement with us. Fieldstone Health's Security & Privacy page names the companies that handle patient information for us, and our customers receive the current list of those providers, with what each does, when they sign with us and on request. Our systems are hosted in the United States.
We may also disclose information when the law requires it, or to protect a person's safety or the security of the service. We do not sell personal information, and we do not share it for advertising.
How we protect it
Patient answers are processed and stored only by services that meet HIPAA requirements and have signed a Business Associate Agreement with us, completed forms travel by encrypted email or stay in the organization's portal, and written policies, training and risk assessments stand behind the technology.
Your choices
You can ask us at any time what we hold about you, ask us to correct or delete it, or ask us to stop contacting you. Email or call us, and we'll respond within 30 days, or sooner if the law requires.
Changes to this policy
When Fieldstone Health's Privacy Policy changes, this summary changes with it and shows the new date. For a material change, we email our customers at least 30 days before it takes effect, and we ask for consent first where the law requires it.
How to reach us
Questions about privacy, or a request about your information, come straight to us.
By post: Fieldstone Health, LLC, 14 Algonquian Drive, Natick, MA 01760.