Privacy

Privacy draft

Draft written for owner review on October 18, 2026. Not an effective date.

This page describes the public website at https://www.maseclearinghub.com, operated as MASE Clearinghouse. It is a working note so visitors can see what the site actually collects today. It is not a finished privacy policy. The owner and legal counsel need to replace it. Rights that depend on where a person lives are not listed here, because counsel has not written them.

Demo and contact form

The demo and contact forms store the name, email, organization, phone if you enter one, message, form source (demo or contact), plan if you select one, and the time the row was saved. Storage is the application database the rest of MASE Clearinghouse already uses. The purpose of the row is so the team can reply. This draft does not set a retention period, does not name who inside the team may read the row, and does not authorize selling the contents. Those decisions are open until the owner documents them.

Do not put patient names, member IDs, clinical notes, or claim files in the form. The form is not a channel for medical records.

Portals

The admin and provider portals are separate from the public form. They require a sign-in. After a successful sign-in, the site sets an httpOnly session cookie named mase_session. In production that cookie is marked secure. It uses SameSite=Lax and expires after seven days. This draft does not describe how claim, patient, or eligibility data inside the portals is handled. That needs its own review.

Analytics

Production builds may load Vercel Analytics, which can receive page-view data. The owner should confirm whether that product stays on, what it stores, and whether the privacy draft should name it in more detail.

What is not on this page

There is no business associate agreement here. There is no completed list of subprocessors, no stated sale or sharing program, and no contact email published yet. To ask a privacy question, use the contact form and say that the question is about privacy. Counsel should add a monitored address if one should be public.