ComplyRer

Privacy Policy

Effective September 14, 2026 · Last updated September 14, 2026

This policy describes how ComplyRer (“we”, “us”) handles information on complyrer.com and in the hosted product at secure.complyrer.com. It is written for developmental-disabilities and other care providers that may later store workforce and program records in the product.

We do not sell personal information. We do not use marketing-site demo requests to train public models. We do not claim HIPAA compliance, HITRUST, SOC 2, or similar certifications on the strength of this page.

Who we are

ComplyRer is a software service that helps care agencies see requirements, deadlines, missing records, and evidence. The agency remains the operator of its compliance program. ComplyRer is a tool, not a regulator, surveyor, or legal advisor.

Questions about privacy or the service: info@complyrer.com.

Whose information this covers

• Website visitors who browse this marketing site or submit a demo request.
• Agency users invited into a hosted workspace (administrators, managers, nurses, DSPs, and similar roles).
• Individuals served by an agency only if that agency chooses to enter program records after the contractual and security gates below are met. Do not enter real individual or employee data into a demo or unverified environment.

Information we collect

Demo requests. Name, work email, agency name, the workflow you want to review, and the time of the request. Optional fields you type in the form. We use a hidden honeypot field to ignore obvious spam.

Accounts and workspace data. When an agency is set up, we store provider codes, usernames, role memberships, site assignments, and the operational records the agency enters (plans, training, delegations, acknowledgments, certificates, and related evidence metadata). Hosted file uploads are stored in a private bucket scoped to the agency.

Technical logs. IP address, user agent, timestamps, and request identifiers needed to operate TLS, stop abuse, and debug failures. We aim to keep document contents and secrets out of application logs.

Cookies. The marketing pages do not set advertising cookies. The product uses cookies or local storage only as needed to keep a signed-in session and remember UI state such as a dismissed demo tour.

Health information and HIPAA

Care agencies are typically the covered entity or business associate for records about the people they support. ComplyRer processes agency-entered records only as a service provider. We will not treat the product as a HIPAA environment until a Business Associate Agreement (or equivalent), the technical safeguards on the Security page, and the agency’s own operating procedures are in place.

Until those agreements exist, treat hosted workspaces as operational software with access controls—not as a declared HIPAA-compliant system of record. Interactive demos use fictional Evergreen Care data.

How we use information

• Respond to demo requests and schedule a walkthrough of one workflow.
• Create and operate the agency workspace the customer asked for, including authentication, role-based access, and audit-ready exports the agency generates.
• Secure the service, prevent abuse, and investigate incidents.
• Meet legal obligations and enforce the Terms.

We do not use customer workspace contents for advertising. We do not share those contents with other agencies.

Legal bases (where GDPR or similar law applies)

Contract (providing the service an agency requested), legitimate interests (securing the site, answering a demo form), and legal obligation. Where we need consent, we will ask for it in product rather than bury it here.

Sharing and subprocessors

We share information only with processors that help us run the service, and only as needed:

• Vercel — hosts the marketing site and the web application.
• Supabase — authentication, Postgres with row-level security, and private file storage for hosted workspaces.

We may disclose information if required by law, to protect a person from serious harm, or to defend a legal claim. We do not sell personal information or share it for cross-context behavioral advertising.

Retention

Demo requests are kept long enough to schedule and follow up, then deleted or minimized. Agency workspace data is retained while the agency’s account is active and for a limited period afterward so the agency can export records, unless a shorter deletion is required by the contract or by law. Agencies should tell us if a legal hold applies.

Security

Transport is encrypted (HTTPS). Hosted databases use deny-by-default row-level security and agency scoping. Uploaded source files are stored privately, not in a public bucket. Privileged product actions are written to an append-only audit log. Details and customer responsibilities are on the Security page.

Your rights

You may request access, correction, or deletion of personal information we hold about you, or ask us to close an account. Agency administrators control workforce accounts inside their tenant. Account deletion is requested through your agency administrator or by emailing info@complyrer.com. We will need enough information to verify the request and will not delete records an agency is legally required to keep unless the agency directs us to do so.

You may also lodge a complaint with your data protection authority. U.S. state privacy rights (access, deletion, opt-out of sale—we do not sell) can be exercised at the same email.

Children

The marketing site and product are for adult workforce users at care agencies. We do not knowingly collect information directly from children. Individual records about people an agency supports are entered only by that agency in its role as provider.

International transfers

Infrastructure is operated in the United States. If you access the service from elsewhere, your information is processed in the U.S. under this policy and the Terms.

Changes

If we make a material change, we will update this page and the “Last updated” date. Material product changes that affect an agency’s data will also be communicated in-app or by email to the agency administrator where we have a working address.