Privacy Policy

1. Information We Collect

FootprintsEMR may collect the following categories of information:

Personal Information

Name, email address, phone number, agency name, job title, and professional credentials.

Usage & Technical Data

Device and browser information, IP address, system logs, and user activity within the platform.

Patient & Clinical Data (PHI)

All protected health information is processed exclusively under HIPAA guidelines and pursuant to a signed Business Associate Agreement (BAA). PHI is never used for any purpose outside of providing contracted services.

Electronic Communications

We may monitor and record phone conversations or email communications between you and our employees for training and quality assurance purposes. Where required by law, we will notify you prior to recording.

Surveys

We may invite you to participate in optional satisfaction surveys. Participation is completely voluntary. If you choose to participate, you have the right to control whether your responses are disclosed or used in any identifiable way.

Testimonials and Reviews

We may display personal testimonials from satisfied customers on our website or marketing materials. We will always request your explicit consent before publishing any testimonial. You may request to update or remove your testimonial at any time by contacting us at support@blackbeansoft.com.

2. How We Use Your Information

FootprintsEMR uses personal information solely to provide, maintain, and improve our services. We will only use your information in accordance with any instructions or restrictions established in your services agreement with us.

We do not use your personal information for advertising, profiling, or any purpose unrelated to the services we provide.

3. Data Sharing & Disclosure

We do not sell personal information or PHI — ever.

We may share information only in the following limited circumstances:

• With service providers who assist in delivering our platform, under strict confidentiality obligations
• As required by law, regulation, or valid legal process
• To protect the rights, safety, or property of FootprintsEMR, our users, or the public

Location Information

Our mobile application may access your device’s location to verify service visit locations and support point-of-care features. Location data is accessed only when necessary and is handled in accordance with all applicable privacy and data protection laws.

You may disable location access through your device settings, though this may limit certain application features.

Data Storage, Retention & Deletion

Our application may store limited data locally on your device to support offline functionality. This data is automatically synchronized with our secure servers when connectivity is restored.

• Local Device Data: Data stored locally for offline use is temporary and is automatically removed when the application is uninstalled.
• Server Data (PHI): Data synchronized to our servers is retained only as long as necessary to provide contracted services and to satisfy applicable legal, regulatory, and contractual requirements. Upon termination of services, data is handled per the terms of your services agreement and BAA.

4. Security

We employ industry-standard security measures to protect your personal information from unauthorized access, loss, misuse, alteration, or disclosure.

Our security protocols and technological safeguards are regularly reviewed and updated to maintain the highest level of data protection. These measures include encryption in transit and at rest, access controls, and regular security assessments.

5. Your Individual Privacy Rights

Depending on your location and applicable laws, you may have certain rights regarding your personal information, including the right to access, correct, or delete your data.

Because FootprintsEMR operates primarily as a data processor on behalf of your agency, many privacy rights requests related to clinical or operational data should be directed to your agency as the data controller.

For questions about rights related to your personal account information, please contact us directly.

6. Changes to This Privacy Notice

We reserve the right to amend this Privacy Notice at any time. When changes are made, we will post the updated notice on our website and update the “Last Modified” date at the top of this page.

For material changes, we will make reasonable efforts to notify users directly via email or an in-app notification. We encourage you to review this Privacy Notice periodically to stay informed of any updates.

7. Contact Us

If you have questions or concerns regarding this Privacy Notice or our handling of your personal information, please contact us:

8. Cookie Policy

What Are Cookies?

Cookies are small text files placed on your device when you visit our website or use our platform. They help us recognize your device, remember your preferences, and understand how you interact with our services.

Types of Cookies We Use

Strictly Necessary Cookies

These cookies are essential for the website and platform to function properly. They enable core features such as user authentication, session management, and security. These cookies cannot be disabled as the platform will not function without them.

Performance & Analytics Cookies

These cookies help us understand how users interact with our website and platform by collecting anonymous usage data. This information is used solely to improve the performance and usability of our services.

Examples include:

• Pages visited and time spent on each page
• Features most frequently used
• Errors encountered during use

Functional Cookies

These cookies remember your preferences and settings to provide a more personalized experience, such as remembering your login credentials, display preferences, and regional settings.

Third-Party Cookies

We may use trusted third-party services that set their own cookies to support analytics or customer service features. These third parties are contractually prohibited from using your data for any purpose other than providing services to FootprintsEMR.

Note: We do not use advertising or tracking cookies. We do not share cookie data with advertisers or marketing platforms.

Managing Your Cookie Preferences

You can control and manage cookies through your browser settings. Most browsers allow you to:

• View what cookies are stored on your device
• Delete cookies individually or in bulk
• Block cookies from specific or all websites
• Set preferences for certain types of cookies

Please note that disabling certain cookies may affect the functionality of our website or platform. For instructions on managing cookies in your specific browser, refer to your browser’s help documentation.

Cookie Retention

• Session cookies expire automatically when you close your browser
• Persistent cookies remain on your device for a set period, typically no longer than 12 months, or until you delete them

For questions about our use of cookies, please contact us.

9. Data Breach Notification

Our Commitment

FootprintsEMR takes data security seriously. In the event of a security incident that results in the unauthorized access, acquisition, or disclosure of your personal information or protected health information (PHI), we are committed to responding promptly and transparently in accordance with all applicable laws and regulations.

Incident Response

Upon discovering a potential security incident, FootprintsEMR will:

1. Contain and assess the incident immediately to determine the nature and scope of the breach
2. Engage our security team and, where appropriate, qualified external forensic experts to investigate
3. Notify affected parties in accordance with the timelines required by applicable law
4. Cooperate with regulators including the Department of Health and Human Services (HHS) Office for Civil Rights (OCR) as required under HIPAA
5. Document the incident thoroughly, including the cause, scope, affected data, and remediation steps taken

Notification Timelines

HIPAA Breach Notification (PHI)

In the event of a breach involving protected health information, FootprintsEMR will comply with the HIPAA Breach Notification Rule:

• Affected individuals will be notified without unreasonable delay and no later than 60 days from discovery of the breach
• Covered entities and business associates will be notified according to the terms of the applicable BAA
• HHS will be notified as required, and for breaches affecting 500 or more individuals, notification will be made without unreasonable delay and no later than 60 days after discovery
• Media notification will be provided where required for breaches affecting 500 or more residents of a state or jurisdiction

Personal Information Breach (Non-PHI)

For breaches involving non-PHI personal information, FootprintsEMR will notify affected individuals in accordance with applicable state breach notification laws, which may vary by jurisdiction. In general, we aim to notify affected individuals within 30 days of confirming a breach.

What We Will Tell You

Our breach notifications will include, to the extent known at the time of notification:

• A description of what happened and the date of the breach
• The types of information involved
• Steps we have taken to investigate and contain the breach
• Steps you can take to protect yourself
• Contact information for questions and assistance

Remediation

Following any confirmed breach, FootprintsEMR will conduct a thorough review of the incident and implement appropriate remediation measures to prevent recurrence. This may include enhanced security controls, additional staff training, and updates to our internal policies and procedures.

How to Report a Security Concern

If you suspect a security incident or have concerns about the safety of your data, please contact us immediately:

We treat all security reports seriously and will acknowledge receipt of your report within 1 business day.