Privacy Policy

Credentialing Now LLC — Last Updated: February 23, 2026

This Privacy Policy explains how Credentialing Now LLC ("we," "us," or "our") collects, uses, shares, and protects information in connection with our software-as-a-service platform and related services (collectively, the "Services").

By accessing or using the Services, you acknowledge that you have read and understood this Privacy Policy.

1. Who This Policy Applies To

This Privacy Policy applies to all users of our Services, including:

  • Account Holders: Organizations or individuals who purchase a subscription to the Services and manage credentialing workflows.
  • Authorized Staff: Employees or agents of Account Holders who are granted access to the platform to manage credentialing operations.
  • Providers: Healthcare professionals who are invited to access the platform to submit their credentialing information, documents, and related data.

Where this Policy distinguishes between user types, it will do so explicitly.

2. Information We Collect

a. Account Holder and Staff Information

  • Full name
  • Email address
  • Phone number
  • Organization name and details
  • Login credentials
  • Billing and payment information
  • Role and access level within the platform

b. Provider Information

Providers may be asked to submit sensitive personal and professional information, including but not limited to:

  • Full legal name, date of birth, and contact information
  • Social Security Number (SSN)
  • National Provider Identifier (NPI)
  • DEA registration number
  • State medical license numbers and expiration dates
  • Board certifications
  • Education and training history (medical school, residency, fellowship)
  • Work and employment history
  • Hospital and facility affiliations
  • Malpractice claims and litigation history
  • Professional liability insurance details
  • Professional references
  • Government-issued identification documents
  • Any other documents or information required for credentialing

Providers should be aware that the information they submit may include highly sensitive personal data. We treat all Provider data with heightened security measures as described in Section 7.

c. Usage Data

We automatically collect certain information when you use the Services, including:

  • Log files and access timestamps
  • Device type, operating system, and browser information
  • IP address
  • Pages visited and features used within the platform
  • Referring URLs

d. Cookies and Similar Technologies

We use cookies and similar tracking technologies to:

  • Authenticate users and maintain sessions
  • Remember user preferences
  • Understand usage patterns and improve functionality
  • Enhance the user experience

You may control cookie preferences through your browser settings. Disabling certain cookies may affect the functionality of the Services.

3. How We Use Information

We use the information we collect to:

  • Provide, operate, and maintain the Services
  • Authenticate users and manage account access
  • Process billing and payments (Account Holders)
  • Facilitate credentialing workflows between Account Holders and Providers
  • Communicate with users about account activity, updates, and support
  • Monitor and improve platform security and performance
  • Comply with legal obligations
  • Enforce our Terms of Service
  • Generate aggregated, de-identified analytics to improve our Services (individual users are never identified in aggregated data)

How Provider Data Is Used Specifically

Provider data is collected solely for the purpose of facilitating credentialing on behalf of the Account Holder (the organization that invited the Provider to the platform). This includes:

  • Allowing the Account Holder and their Authorized Staff to view, organize, and manage Provider credentialing information
  • Enabling the Account Holder to prepare and submit credentialing applications to payers, facilities, and other entities
  • Tracking credentialing statuses, expirations, and renewals

We do not use Provider data for marketing, advertising, or any purpose unrelated to credentialing services.

4. How Information Is Shared

a. With Account Holders (Applies to Providers)

When a Provider submits information through the platform, that information is accessible to the Account Holder (the organization that invited the Provider) and their Authorized Staff. The Account Holder may use Provider data to:

  • Complete credentialing applications
  • Submit information to payers, hospitals, health plans, and other entities as part of the credentialing process
  • Monitor credentialing status and compliance

Providers acknowledge that the primary purpose of submitting their data is to enable the Account Holder to use it for credentialing activities.

b. With Service Providers

We may share information with trusted third-party service providers who assist us in operating the Services, including:

  • Cloud hosting and infrastructure providers
  • Payment processors
  • Email and communication services
  • Analytics providers

All service providers are contractually required to protect data and use it only for the purposes we specify.

c. With Third-Party Integrations

If we integrate with external services related to credentialing (such as license verification databases, NPPES, CAQH, or similar systems), data may be transmitted to those services as necessary to perform verification or data retrieval functions. We will identify any such integrations and their data practices in our platform documentation.

d. As Required by Law

We may disclose information if required to do so by law, regulation, legal process, or governmental request, including:

  • Court orders or subpoenas
  • Regulatory audits or investigations
  • Law enforcement requests

e. To Protect Rights and Safety

We may disclose information when we believe in good faith that disclosure is necessary to:

  • Protect our legal rights or property
  • Prevent fraud, abuse, or security threats
  • Protect the safety of our users or the public

f. Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, user information may be transferred as part of that transaction. We will notify affected users before their information becomes subject to a different privacy policy.

5. Data Ownership

  • Account Holders retain ownership of all organizational data they submit to the platform.
  • Providers retain ownership of all personal and professional data they submit to the platform.
  • We do not sell user data to any third party.
  • We do not claim ownership of any data submitted by users.

6. Data Retention

  • We retain Account Holder and Staff data for the duration of the active subscription and for a reasonable period thereafter to comply with legal, contractual, and business obligations.
  • We retain Provider data for as long as the Account Holder's subscription is active and the Provider's profile exists within the platform, plus a reasonable retention period as required for legal or compliance purposes.
  • Upon termination of an Account Holder's subscription, we will retain data for a period of 90 days to allow for data export, after which it will be securely deleted unless a longer retention period is required by law.
  • Providers may request deletion of their data at any time, subject to the provisions in Section 9.

7. Data Security

We implement commercially reasonable administrative, technical, and organizational safeguards to protect information, including:

  • Encryption of data in transit (TLS/SSL) and at rest
  • Access controls and role-based permissions
  • Regular security assessments
  • Employee training on data handling practices
  • Secure development practices

For Provider data specifically, given its sensitive nature, we apply heightened security measures including strict access controls that limit data visibility to authorized personnel only.

However, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security, and users acknowledge the inherent risks of transmitting information online.

8. Data Breach Notification

In the event of a data breach that compromises the security, confidentiality, or integrity of personal information, we will:

  • Investigate the breach promptly
  • Notify affected users without unreasonable delay and no later than 72 hours after becoming aware of the breach, where feasible
  • Notify applicable regulatory authorities as required by law
  • Provide information about the nature of the breach, the data affected, and the steps we are taking to address it

9. Your Rights

All users of the Services have the following rights regarding their personal information:

  • Access: Request a copy of the personal data we hold about you.
  • Correction: Request correction of inaccurate or incomplete data.
  • Deletion: Request deletion of your personal data, subject to legal and contractual retention requirements.
  • Data Portability: Request an export of your data in a commonly used, machine-readable format.
  • Withdrawal of Consent: Where processing is based on consent, you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing performed prior to withdrawal.

Exercising Your Rights

To exercise any of these rights, contact us at support@credentialingnow.com. We will respond to verified requests within 30 days.

Provider-Specific Notes

  • Providers may request deletion of their personal data at any time. However, if the data has already been shared with or exported by the Account Holder, we cannot control or delete copies held by the Account Holder.
  • If a Provider withdraws consent or requests deletion, the Account Holder will be notified, as this may affect ongoing credentialing processes.

State-Specific Rights

  • California Residents (CCPA/CPRA): California residents have the right to know what personal information is collected, request deletion, opt out of the sale of personal information (we do not sell personal information), and not be discriminated against for exercising these rights.
  • Colorado Residents (CPA): Colorado residents have similar rights to access, correct, delete, and obtain a portable copy of their personal data.

If you believe we have not adequately addressed your request, you may have the right to lodge a complaint with your state's attorney general or applicable regulatory authority.

10. HIPAA

Unless expressly agreed in a separate written Business Associate Agreement (BAA):

  • We are not a Covered Entity or Business Associate under the Health Insurance Portability and Accountability Act (HIPAA).
  • We do not access, maintain, or transmit Protected Health Information (PHI) as defined by HIPAA.
  • The credentialing data collected through our platform is provider-identifying information used for credentialing purposes, which is distinct from patient health information governed by HIPAA.

If an Account Holder requires a BAA, please contact us at support@credentialingnow.com to discuss terms.

11. Children's Privacy

Our Services are not intended for individuals under 18 years of age. We do not knowingly collect personal information from children under 18. If we become aware that we have collected such information, we will take steps to delete it promptly.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes:

  • We will update the "Last Updated" date at the top of this Policy.
  • We will notify users via email or an in-app notification for material changes.
  • Continued use of the Services after the effective date of changes constitutes acceptance of the updated Policy.

13. Contact Us

For privacy-related questions, concerns, or requests:

Credentialing Now LLC
Email: support@credentialingnow.com