Privacy Policy
1. Scope
This Privacy Policy describes how ReMyll, LLC collects, uses, discloses, and protects personal information in connection with abastyan.com, the Abastyan portals, and related services. It applies to website visitors, prospective customers, and Authorized Users of the Service.
Abastyan is designed around organizational records and is not designed to collect or store Protected Health Information ("PHI"). Any PHI a customer submits is incidental. It is protected with the same safeguards applied to all Customer Data, and any Business Associate Agreement executed with that customer governs it. This Policy does not override such an agreement.
2. Information We Collect
Information you provide: name, work email, organization, role, facility size, current compliance systems, and messages submitted through demo, pilot, checklist, and contact forms, and through the website chat assistant (see Section 4A). Account information: credentials, role assignments, and profile settings for Authorized Users. Customer Data: policies, incident records, credentials, vendor agreements, meeting records, and other content your organization uploads to the Service.
Information collected automatically: IP address, browser and device type, pages viewed, referring URLs, and interaction events, collected through server logs and the cookies described in our Cookie Policy. Within the Service, we maintain tamper-evident audit logs of user actions (view, edit, export, login) as a core security and compliance feature.
3. How We Use Information
To provide, secure, and support the Service; to authenticate users and enforce role-based access; to respond to demo, pilot, and inquiry requests and route them to the appropriate team; to send research and product communications you have requested; to analyze and improve website and Service performance; to detect, investigate, and prevent security incidents and fraud; and to comply with legal obligations.
We do not use Customer Data, including any incidental PHI, to train machine-learning models. Regulatory alerting and crosswalk features operate on published regulatory sources, not on customer content.
4. Legal Bases and Marketing Choices
Where applicable law requires a legal basis, we process personal information to perform our contract with you, to pursue legitimate interests in operating and securing the Service, with your consent (for marketing communications), and to comply with legal obligations. Every marketing email includes a one-click unsubscribe. You may also opt out through the Contact us form on abastyan.com.
4A. Website Chat Assistant
abastyan.com offers a chat assistant that answers questions about the Service and can hand off to our team or the demo scheduler. Chat transcripts, the page path on which the chat was opened (query strings removed), and any contact details you provide are retained so a team member can follow up. Transcripts with no contact details are deleted after thirty (30) days; transcripts tied to a contact are tagged in our CRM as an inquiry. Where the assistant is automated, that is indicated in the chat window; you may request a human at any time.
The chat is a marketing and support channel, not part of the Service. Do not enter Protected Health Information, patient identifiers, or other sensitive data in the chat. Transcripts are not covered by a Business Associate Agreement and are retained under Section 7 as prospect information. If PHI is inadvertently submitted, contact us through the Contact us form on abastyan.com and we will delete it on request.
5. Disclosure of Information
We share personal information only with: service providers acting on our instructions under written agreements (cloud hosting, email delivery, analytics, customer relationship management, and the chat platform that powers the website assistant); professional advisors under confidentiality obligations; authorities where required by law, subpoena, or to protect rights and safety; and a successor in a merger, acquisition, or asset sale, subject to this Policy.
We do not sell personal information and do not share it for cross-context behavioral advertising. Subprocessors that could encounter incidental PHI in Customer Data are bound by written confidentiality and security terms, including subcontractor BAAs where a customer BAA requires them.
6. Security
Personal information and Customer Data are protected by AES-256 encryption at rest and TLS 1.2 or higher in transit, least-privilege role-based access control, multi-factor authentication for administrative access, network segmentation, continuous monitoring, and tamper-evident audit logging. Our program is designed to the SOC 2 Trust Services Criteria and the HIPAA Security Rule. No system is perfectly secure; we will notify affected customers of security incidents as required by law and our agreements with them.
7. Retention
Prospect and marketing information is retained while there is an active relationship or until you opt out, then deleted or de-identified within twelve (12) months of last activity. Customer Data is retained for the Subscription Term and the sixty (60) day export window described in the customer agreement, after which it is deleted from production systems and expires from backups within ninety (90) days, except where retention is legally required.
8. Your Rights
Depending on your jurisdiction, you may have the right to access, correct, delete, or receive a copy of your personal information, to restrict or object to certain processing, and to withdraw consent. Requests may be submitted through the Contact us form on abastyan.com. We will verify your identity and respond within the time required by law. If you are an Authorized User of a customer organization, requests about Customer Data should be directed to that organization; we will assist as required by our contract.
Residents of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, and other states with comprehensive privacy laws may exercise the rights those laws provide. We do not discriminate against individuals for exercising privacy rights.
8A. California Privacy Rights
This section supplements the Policy for California residents under the CCPA as amended by the CPRA. In the preceding twelve (12) months we collected the following categories of personal information: identifiers (name, work email, IP address); professional information (organization, role, facility size, current systems); internet activity (pages viewed, interaction events, chat transcripts); and inferences drawn from the above for lead routing. Sources: you, your device, and our service providers. Business purposes: providing and securing the Service, responding to inquiries, marketing to business contacts, analytics, and legal compliance. Categories of third parties: service providers and contractors under written contract. We do not sell personal information and have not sold it in the preceding twelve months. We do not share personal information for cross-context behavioral advertising. We do not collect sensitive personal information from website visitors and do not use it to infer characteristics.
You have the right to know, delete, and correct your personal information, to opt out of sale or sharing, to limit use of sensitive personal information, and not to be discriminated against for exercising these rights. Submit a request through the Contact us form on abastyan.com or through the "Your Privacy Choices" link in the site footer. We verify requests by matching the information you provide to our records and may ask for additional confirmation. An authorized agent may submit a request on your behalf with signed written permission. We respond within forty-five (45) days and may extend once by a further forty-five days with notice. We honor Global Privacy Control browser signals as an opt-out of analytics and attribution cookies. We do not offer financial incentives in exchange for personal information. Requests received in the previous calendar year and our response times are available on request.
9. Children
The Service is intended for use by healthcare organizations and their workforce. We do not knowingly collect personal information from individuals under sixteen (16).
10. International Transfers
The Service is hosted in the United States. If you access it from outside the United States, your information will be transferred to and processed in the United States under appropriate safeguards.
11. Changes and Contact
We will post revisions to this Policy with an updated effective date and, for material changes, notify customers by email or in-product notice. Questions may be directed through the Contact us form on abastyan.com or by mail to ReMyll, LLC, Attn: Privacy, 625 Kenmoor Ave SE, Suite 350, Grand Rapids, MI 49546.