Privacy policy for SuperbillDesk

Who is responsible

The controller of the personal data described here is MLJ, SASU, the company that publishes SuperbillDesk and this website. Company identification details are listed on the legal notice. The publication director, Jimenez Julien, handles privacy requests personally and can be reached at jimenezjulien42@gmail.com. This policy covers superbilldesk.com, the marketing website. Data held inside a paid SuperbillDesk practice account is governed by the data processing agreement and the business associate agreement signed with that practice.

What the contact form collects

The only form on this website is the walkthrough request on the home page. When you submit it, the following fields are transmitted and stored: name (your full name), email (your work email address), company (your practice name), role (your license or role, chosen from a list), request (what you would like from us, chosen from a list), size (the number of clinicians in your practice, chosen from a list), message (your free text answer about how your clients receive superbills today) and consent (a record that you ticked the consent box). Two hidden fields travel with the submission: a subject line identifying the site, and the recipient address that routes the message to us. A honeypot field named bot-field exists only to catch automated spam and is expected to stay empty.

Please do not include client names, dates of birth, member identification numbers, diagnoses tied to an identifiable person, or any clinical note text in the message field. The form is a sales enquiry channel and is not an appropriate place for protected health information. If a message containing such information reaches us, we delete it and reply asking you to resend a redacted version.

Why we process it, and on what legal basis

Your submission is used for one purpose: to answer you, to prepare a walkthrough of the product for your practice, and to keep a record of that conversation. Under the European General Data Protection Regulation, the legal bases are your consent, given by ticking the consent box, and our legitimate interest in responding to a business enquiry addressed to us. For residents of United States states with comprehensive privacy laws, the processing is a business purpose directly related to the service you asked about. We do not sell personal information, we do not share it for cross context behavioral advertising, and we do not use it for automated decision making or profiling.

Who processes it with us

Form submissions are received and stored by Netlify Forms, operated by Netlify, Inc., 512 2nd Street, Suite 200, San Francisco, CA 94107, United States, which also hosts this website. Netlify acts as our processor and stores the submission so that we can read it in a dashboard and by email notification. Beyond Netlify, no advertising network, data broker, customer data platform or analytics vendor receives your submission. We do not run third party analytics on this site, we set no advertising cookies, and there is no tracking pixel on any page. The only storage this site uses in your browser is what your browser itself needs to display the page.

How long it is kept

An enquiry that does not turn into a customer relationship is deleted 24 months after the last message exchanged, from both the Netlify Forms store and our mailbox. If your practice becomes a customer, the enquiry is retained for the life of the account and for 36 months after it closes, because it forms part of the commercial record. You may ask for earlier deletion at any time and we will act on it unless we are required to keep a document for accounting or tax reasons, which in France is ten years for invoices and supporting records.

International transfers

MLJ, SASU is established in France and Netlify, Inc. is established in the United States, so a submission sent from the European Union is transferred to the United States. That transfer is covered by the European Commission standard contractual clauses incorporated in the Netlify data processing addendum, together with the technical measures Netlify applies to data in transit and at rest. A submission sent from within the United States is stored in the United States. You may ask us for a copy of the transfer safeguards in place.

Your rights in the United States

If you are a resident of California, Colorado, Connecticut, Utah or Virginia, you may ask us to confirm whether we hold personal information about you, to give you a copy of it, to correct it, and to delete it. You may also ask us to tell you the categories of personal information we collected and the purposes for which we used it. We do not sell personal information and we do not process it for targeted advertising, so no opt out of sale or of targeted advertising is required, although you may still send one and we will confirm it. California residents may designate an authorized agent to make a request on their behalf. We do not discriminate against anyone who exercises a privacy right, and where a state law provides an appeal of a refused request, you may appeal by replying to our decision email and we will answer within the period the relevant state law sets.

Your rights in the European Union and the United Kingdom

Where the General Data Protection Regulation applies, you have the right of access, rectification, erasure, restriction of processing, data portability and objection, and the right to withdraw a consent you have given at any time without affecting the lawfulness of processing carried out before the withdrawal. You also have the right to lodge a complaint with a supervisory authority, which in France is the Commission Nationale de l Informatique et des Libertes.

How to exercise a right

Send your request to jimenezjulien42@gmail.com with enough detail to find your record, normally the email address you used on the form. We acknowledge requests within five business days and complete them within thirty days, or forty five days where a state law allows an extension and the request is complex. We may ask one question to verify that the request comes from you, and we do not require an account to make a request.

Children

This website addresses licensed clinicians and practice staff. It is not directed to children, and we do not knowingly collect personal information from anyone under sixteen years of age. If you believe a child has sent us information through the contact form, write to us and we will delete it without delay.

Security and changes

Submissions travel over TLS, are stored by our processor with encryption at rest, and are readable only by the publication director. Access to the mailbox is protected by multi factor authentication. If this policy changes, the revised version is published on this page with a new date at the top, and material changes affecting an open enquiry are notified by email to the address you supplied. Questions about anything written here can be sent to jimenezjulien42@gmail.com, or read more about who stands behind this product on the author page.