Credolex Privacy Policy

Effective date: September 18, 2026
Last updated: October 26, 2026
Who we are: Credolex LLC, 806 Chewiliken Valley Rd, Riverside, WA 98849 ("Credolex," "we," "us," or "our")
Privacy contact: privacy@credolex.com

This Privacy Policy explains what personal information Credolex collects, how we use and share it, how long we keep it, and the choices and rights you have. It applies to credolex.com, app.credolex.com, the Credolex application, the public sandbox, our reminder and service emails, and our communications with you (together, the "Service").

Health-related information is also covered by our separate Consumer Health Data Privacy Policy, which is published alongside this Policy and applies in addition to it.

1. Two roles: when we decide, and when a facility decides

Credolex handles personal information in two different capacities, and your rights differ depending on which one applies.

Credolex as the business (controller). For the information we collect directly for our own purposes, such as a request submitted on our website, an account login, billing details, and support correspondence, Credolex decides how and why the information is used. Sections 2 through 8 of this Policy describe that information.

Credolex as a service provider (processor) for a facility. When a healthcare facility or other organization (a "Customer") uses the Credolex application to track credentials, screenings, health items, and training for its own personnel, the Customer decides what information to enter, whom to enter it about, and how to use it. Credolex processes that information only on the Customer's instructions under our Terms of Service and, where signed, our Data Processing Addendum. If you are an employee, contractor, agency worker, volunteer, or student whose information a Customer has entered into Credolex, the Customer is responsible for that information. Please direct questions and requests about it to your facility. We will refer any request we receive from you to the Customer and assist the Customer in responding. Section 9 describes what we hold on Customers' behalf.

2. Information we collect as the business

Starting a trial, and access requests. When you submit the form on credolex.com we collect your full name, work email address, facility name, and what kind of place it is. We also record the date and time of the submission, the version of these terms you accepted, and whether the address you gave is a work address. A work address opens a facility on a free trial immediately and we email a sign-in link to it; any other address goes into a queue for a person to answer, and we email you about it. We use a hidden form field to detect automated submissions; it collects nothing from a human visitor.

Account and login information. When a Customer invites you to the application we collect your email address, the role assigned to you (owner, staff, or read-only), the facility you belong to, and the time your account was created. Sign-in is by a one-time link sent to your email; we do not collect or store a password. Our authentication provider records the time and IP address of sign-in events for security purposes.

Facility settings. The facility name, state, facility type, time zone, the date any free trial ends, whether the facility keeps health paperwork in Credolex, and the notification email address a Customer designates to receive reminder digests.

Billing information. For paid plans, the billing contact's name and email address, the plan tier, and billing history. Payment card details are collected and stored by our payment processor, not by Credolex; we receive only a confirmation of payment and the last four digits and expiration of the card used.

Support and other correspondence. The content of emails and other messages you send us, including to hello@credolex.com, support@credolex.com, privacy@credolex.com, and security@credolex.com.

Usage and technical information. When you use the Service, our hosting and database providers automatically receive standard technical information from your browser, including your IP address, browser type and version, operating system, the pages or screens requested, and timestamps, in server logs kept for security and operations. We do not use analytics tools, advertising pixels, session-recording tools, or tracking cookies of any kind. The application uses your browser's local storage to keep you signed in and to remember a few things about this browser: whether you chose the dark screen, which facility you last viewed, whether you have been shown the welcome walkthrough, the result of your last staff-list import, and, if you are looking at the demonstration, your demonstration pass and which kind of facility you asked it to show. None of that reaches us. The application loads typefaces from Google Fonts, which means Google receives your IP address when the font files are requested; Google's handling of that request is described in its privacy policy at policies.google.com/privacy.

Error reports. When a screen of the application fails, the application sends us the address of the screen, the error message and the developer stack that came with it, which build of the application you were on, and your browser's own description of itself, so that we can find and fix the fault. We remove anything that looks like an email address or a credential from the message and the stack before it is sent, and again when it arrives. These reports are readable only by Credolex staff and are deleted after 30 days.

The demonstration. The demonstration is reached at app.credolex.com/#/demo, either with a code we issued you or with a pass the door issues on request. Anything you type into it is stored in one shared facility that every other visitor can see and edit, and is deleted every night. Do not enter real personal information in it. We do not associate demonstration activity with any customer account, and we record the following about a visit: which code or pass was used, which screens were opened, how many times and for how long, how far you got through the welcome walkthrough, your browser's own description of itself, and, for a visit with a code we issued to a named person, the IP address the request came from. Where we issued a code to a named person, we also hold the name, work email address and organisation given when it was asked for, or when the code was issued, so that we know who has looked at the product. A pass issued at the door is not issued to a name: we keep a one-way fingerprint of the network address it was issued to, to limit how many can be issued in a day, and not the address itself. A record of each attempt to open the demonstration, kept to stop codes being guessed, is deleted after 24 hours.

As the business, we do not collect Social Security numbers, home addresses, government identification numbers, precise geolocation, or biometric information about you, and the Service is not designed to hold them. A facility may record a date of birth for one of its own people, and Section 9 says what that is used for.

3. How we use information

We use the information described in Section 2 to:

1. evaluate access requests and contact you about onboarding;
2. create and secure accounts, deliver one-time sign-in links, and enforce roles;
3. provide the Service, including sending reminder emails and digests to the addresses a Customer designates, and text messages from the text program Credolex LLC runs for the employers that use Credolex, sent only to people who agreed in writing to receive them;
4. bill for paid plans and maintain billing records;
5. respond to support, privacy, and security inquiries;
6. monitor, detect, investigate, and prevent security incidents, abuse, and fraud, and maintain audit logs;
7. send service communications, such as notices of changes to the Service, these terms, or scheduled maintenance;
8. comply with legal obligations and enforce our Terms of Service;
9. find and fix faults from the error reports described in Section 2;
10. run the demonstration, apply the limits on it, and know who has looked at the product; and
11. analyze usage in de-identified, aggregated form to understand how the Service is used and to improve it.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising. We do not use personal information for advertising of any kind.

Artificial intelligence. We do not train any artificial intelligence or machine-learning model on personal information, and we do not permit anyone else to train one on it. The Service uses an outside model in exactly one place, described in Section 4: reading a credential document, or a staff list, that a facility chooses to have read, so that the dates or names printed on it are proposed for a person to check rather than typed. We use the paid tier of that service, under which the provider is contractually barred from using what it is sent to train or improve its own products and does not have human reviewers read it. Nothing a model proposes becomes a record until a person at the facility saves it, and no decision about any individual is made by a model.

4. How we share information

We share personal information only in the following circumstances.

Service providers (subprocessors). We use a small number of third-party providers to host and operate the Service. Each processes information only on our instructions and under contractual confidentiality and security obligations. Our current providers are:

The full list, and exactly what each provider receives, is published at credolex.com/subprocessors and is the list our Data Processing Addendum points to. Two things about the document reading are worth stating here rather than leaving to be inferred: a document attached to a health item is never sent to be read, whatever a facility's settings say, but the Add screen sends whatever is dropped on it, so a facility should keep health papers off it; and reading a staff list is switched on one file at a time, with the file named on screen, and never happens in the background.

Our payment processor, once paid plans are billed, will be added to this list and to the subprocessor list in our Data Processing Addendum before it receives any information.

Mobile numbers and text message consent. We do not sell, rent or share mobile phone numbers, or a person's consent to receive text messages, with any third party or affiliate for their marketing or promotional purposes. Text message opt-in data and consent are never shared with third parties, except with the text message provider listed above (Telnyx LLC), and the phone carriers it hands a message to, solely to deliver the texts a person agreed to receive. The sharing described elsewhere in this policy, including with service providers, in a business transfer, for legal reasons or with your consent, excludes text messaging originator opt-in data and consent. How texting works, and how to stop it, is set out at credolex.com/sms.

Public government sources. One feature of the Service reaches a government source, and it is not a sharing of anyone's file.

1. The federal exclusion list. Once a month we download the public exclusion list published by the Office of Inspector General and compare it against a facility's roster on our own systems. Nothing about any facility or any person is sent out for this check.

Customers. If you are an Authorized User of a facility's account, the facility's owners can see your email address, role, and the actions you take in the application, which are recorded in the facility's change log.

Legal requirements. We may disclose information if we believe in good faith that disclosure is required by law, subpoena, court order, or governmental request, or is necessary to protect the rights, property, or safety of Credolex, our customers, or the public. Where legally permitted, we will notify the affected Customer before disclosing Customer information in response to a legal demand so that the Customer may seek protective treatment.

Business transfers. If Credolex is involved in a merger, acquisition, financing, reorganization, or sale of all or part of its assets, personal information may be transferred as part of that transaction. We will require the recipient to honor this Policy or provide notice and an opportunity to delete your information before it is used in a materially different way.

With your direction or consent. We will share information in other ways when you direct us to or consent.

5. How long we keep information

We may retain information longer where required by law, to resolve a dispute, or to enforce our agreements, and we may retain de-identified, aggregated information indefinitely.

6. Security

We protect personal information with safeguards that include encryption in transit (TLS) and at rest, database-enforced isolation between customers so that each facility can reach only its own data, database-enforced roles, one-time sign-in links in place of passwords, a strict content-security policy and related browser protections on the application, an append-only change log that records who changed what and when, and a scheduled job that can be started only with a secret held outside the application. Our Data Processing Addendum describes these measures in more detail. Text messages are the exception to encryption in transit: phone carriers do not encrypt them, so a text never names a health item.

No system is perfectly secure. If you believe your account or information has been compromised, contact security@credolex.com immediately. We acknowledge security reports within two business days.

7. Your choices and rights

Regardless of where you live, you may ask us to:

1. tell you what personal information we hold about you as the business;
2. correct inaccurate information;
3. delete your information, subject to the retention obligations in Section 5;
4. provide a copy of your information in a portable format; and
5. stop sending you marketing email.

Send requests to privacy@credolex.com from the email address associated with the information, or write to us at the address above. We will verify your identity by confirming control of that email address and will respond within 45 days. We will not discriminate against you for exercising these rights. If we decline a request, we will explain why, and you may appeal by replying to our response with the word "Appeal" in the subject line; a different person will review the appeal and respond within 45 days.

Residents of Washington, California, and other states with consumer privacy laws. Credolex does not currently meet the revenue or volume thresholds that make most state consumer privacy statutes apply to it, and much of the information it handles is processed in an employment context that those statutes exclude. We nonetheless honor the requests listed above for everyone. Health-related information is subject to the Washington My Health My Data Act, and our Consumer Health Data Privacy Policy describes the rights that law provides. If you believe we have not resolved your concern, you may contact the Washington State Attorney General's Office at atg.wa.gov or your own state's attorney general.

If your information was entered by your facility. Your facility controls that information. Ask your facility's administrator to view, correct, or delete it, or to stop reminder emails to you. To stop texts, reply STOP to any text or write to support@credolex.com. Credolex runs the text program and stops texts for every employer at once. If you contact us instead, we will forward your request to the facility and help it respond. Reminder emails to workers are sent at the facility's direction and contain only your first name, the item that is due, the facility name, and the date.

8. Children, international visitors, and links

The Service is intended for businesses and organizations in the United States and for adults acting on their behalf. We do not knowingly collect information from anyone under 18. If you believe a minor has provided information to us, contact privacy@credolex.com and we will delete it.

The Service is hosted in the United States. If you access it from elsewhere, you understand that your information will be transferred to, stored, and processed in the United States, where privacy laws may differ from those in your jurisdiction.

The Service may contain links to regulatory sources and third-party sites. This Policy does not apply to those sites.

9. Information we hold on behalf of Customers

This Section describes, for transparency, what the Credolex application stores on a Customer's behalf. The Customer, not Credolex, decides to collect it and is responsible for it.

For each person on the facility's roster: full name; job role; worker type (employee, contract, agency, volunteer, or student); department; hire date; end date, if any; whether the person is active; and, if the facility enters them, an email address and a telephone number for contacting the person, and a date of birth. A date of birth is optional, and the application uses it for one purpose only: telling that person apart from a different person with a similar name on the federal exclusion list.

For each tracked requirement: the dates the facility records (for example, an issue date, an expiration date, or a completion date), a number of hours where a requirement accumulates hours, a topic, any note the facility types, and, for a professional credential, the credential number and the state that issued it where the facility enters them. Requirements include professional licenses and registry listings, certifications such as CPR, training and in-service completion, employment eligibility verification, background and exclusion screening status, and employee health items such as tuberculosis screening, hepatitis B vaccination or declination, influenza vaccination, and respirator fit testing. Health items are stored as dates and completion status. The Service does not ask for, and Customers agree not to enter, clinical results, diagnoses, or medical details in any field it provides. Where a facility keeps health paperwork in Credolex, a document it attaches to a health item may itself say more than the date, which is why a facility can switch health documents off; our Consumer Health Data Privacy Policy describes that in full.

Documents: where a facility chooses to attach one, the photograph or PDF it attached as proof of a date, and who attached it and when. A facility may switch health documents off entirely, after which the application refuses to store one.

Check results: what the monthly federal exclusion list comparison returned about that facility, including any possible name match and whether somebody at the facility has looked at it and written it off, and, for a nursing licence the facility enrols, what the board of nursing reports about it through Nursys e-Notify. A possible match is kept once it has been raised, so that the same coincidence is not raised again every month.

Derived information: a status (current, due soon, expired, or missing) that the application computes from the recorded dates and the current date each time it is viewed, and is never stored.

Reminder emails: an outbox record of each reminder queued and sent, containing the recipient address, subject, body, and send time, kept so that the same reminder is never sent twice and so the facility can see what was sent.

Change log: an append-only record of every change to a person's file, the account that made it, and when.

Customers may export all of this information at any time, may delete individual records at any time, and may request deletion of the entire facility by emailing support@credolex.com from an owner's address. We complete facility deletion within 30 days of the request and, after a Customer's account ends, delete its data from production systems within 90 days and from backups as they expire.

10. Changes to this Policy

We may update this Policy from time to time. We will post the updated Policy at credolex.com/privacy with a new effective date. If a change materially reduces your rights or materially expands how we use personal information, we will give at least 30 days' notice by email to account holders and, where required, obtain consent before the change takes effect.

11. Contact us

Email: privacy@credolex.com
Mail: Credolex LLC, Attn: Privacy, 806 Chewiliken Valley Rd, Riverside, WA 98849

Security reports: security@credolex.com. Support: support@credolex.com. General inquiries: hello@credolex.com.