Privacy

The health center corpus is assembled from public federal records — HRSA’s Uniform Data System, IRS Form 990 filings, CMS cost reports and the Federal Audit Clearinghouse. Almost all of it describes organisations.

Three kinds of named individual are in it. All of them come from public federal records, and all of them are there in a professional capacity:

• Project directors. HRSA collects each health center’s project director and their work email address on the UDS HealthCenterInfo sheet, and publishes both. We show the name on the center’s page, and the name and email are available to subscribers in the Contacts columns of a CSV export.
• Officers and key employees. The IRS publishes their names, titles and compensation on Form 990. We reproduce that filing.
• Names quoted from audit reports. Single-audit reports posted to the Federal Audit Clearinghouse name the audit firm and, in their notes, the organisation’s lenders and partners. Those are organisations, but an individual’s name occasionally appears inside a quoted passage.

We reproduce these records. We do not collect them from anywhere else, enrich them, append anything to them, infer anything about the individual, or combine them with data about that person from any other source. We do not sell a contact list as a product: contact fields are columns in a dataset about organisations.

If you are named in this product and want to discuss it, see Being named in this product below.

Write to admin@paliocagroup.com. We will tell you exactly what we hold about you, which federal filing it came from, and where to find that filing. If you ask us to remove your name or your email address from this product, we will do it, and we will not ask you for a reason.

Two honest caveats. The underlying federal filing stays public whatever we do, because HRSA and the IRS publish it and we do not control that. And a copy a subscriber exported before you asked is already out of our hands — though the licence they agreed to restricts what they may do with it.

We will answer a request like this whether or not any privacy law requires us to. We hold very little about any individual and it is not worth arguing about.

Your email address and name

To create and identify your account, and to contact you about it.

Held by Clerk, our authentication provider. This application stores only Clerk’s opaque user id, never your password.

Your subscription and payment status

To know what your seat includes and when it renews.

Card details are entered on Stripe’s own pages and never reach this application. We store a Stripe customer id, a subscription id, a status and a renewal date.

What you save inside the product

Saved views, tracked health centers, and your organisation’s category.

Our database, keyed to your account id.

A record of every CSV export

Each export carries a visible id, and we log which account made it, when, and what it covered — so a file that turns up where it should not can be traced.

Our database. Described openly in the terms rather than done quietly.

Messages you send us

The in-product feedback button and the public contact form.

Our database, with the page you were on and your browser’s user-agent string for context. The contact form is open to people with no account.

Error reports when something breaks

So a failure that affects real people gets found and fixed.

Sentry. Configured to collect no personal information — no account details, no cookies, no request or response bodies, no query strings — and with headers, query strings and request bodies scrubbed before anything is sent. The only identifier sent is your Clerk user id — never your email or name.

Your HubSpot connection, only if you connect one

To write health center figures onto company records in your own CRM, which you preview before anything is written.

An OAuth token in our database. It is yours, it is used only for writes you initiate, and disconnecting deletes it.

These are our processors. Each does one job, and none of them receives your data for their own purposes.

Clerk.

Authentication and account records

Stripe.

Payments, invoices and the billing portal

Neon.

The Postgres database this application reads and writes

Vercel.

Hosting and delivery

Sentry.

Error reporting

Resend.

Delivering the notification emails this product sends

HubSpot.

Only if you choose to connect your own account

We do not sell your data, share it with advertisers, or use it to train models. We do not build a profile of you across other sites, because we have no presence on other sites. We do not email you marketing you did not ask for.

Account and subscription records last as long as your account does. Exports are logged for as long as the log is useful for tracing a leak. Error reports expire on Sentry’s own retention schedule. Ask us to delete your account and we will delete what is ours and tell you what Stripe must retain for its own tax and accounting obligations.

Ask for a copy of what we hold about you, ask us to correct it, or ask us to delete it — by writing to admin@paliocagroup.com. There is no form and no process to navigate; a plain email reaches a person.

Depending on where you live you may have specific statutory rights — under the California Consumer Privacy Act, the GDPR, or another regime. We will honour a request under any of them whether or not the law technically applies to us, because the honest answer is that we hold very little and it is not worth arguing about.

A right you cannot exercise is not a right. If this page, or the request process, or anything we send back is difficult for you to read or use, say so and we will provide it in a format that works — by email, in plain text, or read out over a call. We aim to meet WCAG 2.1 Level AA and test against it on every change; see accessibility in the terms for what that testing does and does not cover.

If either document changes materially — a new obligation, a narrower permission, a different processor, or a change to how we limit liability — we will email account holders at least 14 days before it takes effect, and the effective date above will move. Cosmetic edits and clarifications do not move that date. Ask us for the text that was in force on any given day and we will send it.

See also the terms of use, which cover what a seat licenses and what may not be redistributed.