Privacy notice
No advertising trackers, no third-party profiling, and no cookies set by us. Here is the detail — including what changes when you become a client and we can reach systems holding patient data.
Short version: this website collects almost nothing. There are no advertising trackers, no third-party analytics profiling you, and no cookies set by us. What follows is the detail, including what changes when you become a client.
This website
| Cookies | None set by us. There is no consent banner because there is nothing to consent to. |
|---|---|
| Analytics | Cloudflare Web Analytics — cookieless and aggregate. It reports page counts and referrers. It does not build a profile of you, does not track you across sites, and does not use a device fingerprint. |
| Advertising | None. No advertising or social pixels of any kind. We consider these inappropriate on a healthcare site and we advise clients against them — see HIPAA and your website. |
| Server logs | Our CDN keeps standard request logs (IP address, timestamp, page, user agent) for a short period for security and abuse prevention. We do not mine them. |
| Fonts | Typefaces load from Google Fonts, so your browser contacts Google to fetch them. We send nothing to Google ourselves. |
| Local storage | Not used. Support search runs entirely in your browser and stores nothing. |
When you email us
We receive whatever you send: your address, your message, and anything you attach. Mail is delivered through our email provider and read by the people who need to answer it. We keep correspondence as long as it is useful for the work, and business records for as long as tax and accounting rules require.
When you pay an invoice
Billing runs through QuickBooks Payments. Card and bank details are entered on Intuit's own systems and never reach ehrexpress.com. We see that an invoice was paid, and the billing contact details needed to raise it — not how you paid. Intuit's handling of that data is governed by their own privacy policy. See Pay your invoice.
When you become a client
Delivering managed IT, hosting, migration or interoperability work means we may be able to reach systems that contain protected health information. When that is the case:
- We work under a signed Business Associate Agreement — see our guide on BAAs.
- We apply minimum necessary access: only the people doing the work, only the systems the work touches, only for as long as it takes.
- We do not copy patient data out of your systems except where a migration requires it, and then only into environments agreed with you in writing.
- Access is revoked when the engagement ends, and we confirm in writing that working copies have been returned or destroyed.
Your patients' information is yours. We never use it to improve a product, never sell it, and never share it with anyone outside the engagement.
Who else touches your data
We keep this list short deliberately. Our infrastructure providers are Cloudflare (website hosting and CDN), ForwardEmail (email delivery) and Intuit (billing). Client project data lives in systems agreed with you. We do not sell data to anyone, and we do not share it except where the work requires it or the law compels it.
Your choices
You can ask us what we hold about you, ask for it to be corrected, or ask us to delete it where we are not required to keep it. Email info@ehrexpress.com and we will respond within one business day. If you are a patient of one of our clients, we are not the right people to ask — contact the practice directly, and see Fulfilling a patient Right of Access request.
Changes
If we change how we handle information, we update this page and change the date below. We do not make quiet changes.