Privacy Policy
Last updated: May 14, 2026
1. Information We Collect
When you use our services — including our HIPAA Scanner, compliance audits, website forms, or contact us directly — we may collect the following categories of personal information:
- Identifiers: Name, email address, phone number, company or practice name
- Business Information: Website URLs submitted for scanning, business type, number of employees
- Technical Data: IP address, browser type, device type, page views, referring URLs
- Communications: Content of emails, form submissions, and support requests
- Payment Information: Processed securely through Stripe; we do not store card numbers on our servers
2. How We Use Your Information
We use the information we collect to:
- Provide, maintain, and improve our services (including HIPAA scans and compliance reports)
- Communicate with you about your account, services, and support requests
- Send relevant product updates and service announcements (you may opt out at any time)
- Analyze usage patterns to improve our platform and user experience
- Comply with legal obligations and enforce our terms of service
3. Data Sharing
We do not sell your personal data to third parties. We share information only with:
- Service Providers: Trusted vendors who process data on our behalf (e.g., Stripe for payments, cloud hosting providers, email delivery services). Each provider is contractually obligated to protect your data.
- Legal Requirements: When required by law, subpoena, or government request, or to protect the rights, property, or safety of CC3PO, our users, or the public.
- Business Transfers: In connection with any merger, acquisition, or sale of company assets, your data may be transferred to the acquiring entity.
4. CCPA Rights (California Consumers)
Under the California Consumer Privacy Act (CCPA), California residents have the following rights:
- Right to Know: You may request a copy of the personal information we have collected about you in the past 12 months.
- Right to Delete: You may request deletion of your personal information, subject to certain exceptions required by law.
- Right to Opt-Out of Sale: We do not sell personal data. You may still exercise this right by contacting us.
- Right to Non-Discrimination: We will not discriminate against you for exercising any of these rights.
To exercise your CCPA rights, contact us at legal@cc3po.com. We will respond to verified requests within 45 days.
5. HIPAA Compliance Data
Scan results are encrypted in transit and at rest. We do not store Protected Health Information (PHI) through our scanner. You own all data generated by your scan. Scan results are retained for 90 days and then permanently deleted.
6. SMS Communications
By opting in to SMS, you consent to receive text messages from CC3PO LLC. Message frequency varies. Reply STOP to cancel at any time. Msg & data rates may apply. We will not send promotional SMS without your explicit opt-in.
7. Data Retention
- Lead form submissions: retained for 12 months
- Scan results: retained for 90 days, then permanently deleted
- Account data: retained for the duration of your active subscription
- All personal data: deleted within 30 days of a verified deletion request
8. Data Security
We implement reasonable administrative, technical, and physical safeguards to protect your personal information, including encryption in transit (TLS 1.3), access controls, and regular security assessments.
9. Your Rights
In addition to CCPA rights, you may:
- Access your personal data
- Request correction of inaccurate data
- Opt out of marketing communications at any time
- Request a copy of your data in a portable format