Essential operation
The public site receives the technical request data needed to deliver and protect the service. A governed first-party event rail records an approved event name, a safe page path, and an optional commercial door. It rejects contact values, query strings, free text, email addresses, organization names, CCNs, and PHI.
Optional anonymous measurement
With your permission, Credalyst uses PostHog to understand navigation, recommendation, and conversion outcomes. Autocapture and session replay are disabled. Only allowlisted event names and sanitized categorical properties are sent. Do Not Track and Global Privacy Control signals disable optional measurement. You can change this choice from Privacy choices in the footer.
Approved experiments
When optional measurement is enabled, PostHog may assign an approved presentation variant. Variants are allowlisted in code, stored in a first-party cookie, and applied by the server on a later request to prevent content flashing. Experiments do not alter evidence, pricing, product boundaries, or security claims.
Intent assistance
Command search resolves common questions with local deterministic rules. Only when you explicitly choose model assistance after those rules cannot resolve a question is that capped question sent to Anthropic. Obvious identifiers and clinical-record coordinates are rejected first. Anthropic may select only an approved intent; Credalyst supplies the route, evidence, copy, and boundary. The question is not persisted by Credalyst or sent to PostHog.
Live CMS previews
A six-digit CCN can request a point-in-time preview directly from the CMS Provider Data Catalog. The preview is briefly cached for reliability. The CCN is used to retrieve the record and is not sent to PostHog. No internal, resident, patient, or workforce record is used.
Public inquiries
When you send the contact form, Credalyst stores the business contact fields and operating question you provide so the inquiry can be reviewed and answered. The form prohibits patient, resident, workforce personal information, and protected health information. Public inquiry records expire after 180 days.
What an engagement may collect
- Public CMS records used to establish evidence-bound reality.
- Account, organization, and contact information needed to provide the service.
- Security and audit records needed to protect access and preserve replay.
- Engagement evidence only when required by the agreed work.
Protected health information
Survey Command and Due Diligence begin without PHI. If another engagement requires regulated information, applicable contract terms, including a Business Associate Agreement when required, govern that handling.
Use and sharing
Credalyst uses data to provide, secure, measure, and improve the agreed service. We do not sell customer data or use PHI for advertising. PostHog and Anthropic receive only the narrowly described public-site data when their respective conditions above are met. Other service providers receive only the access needed to perform their role under appropriate obligations.
Retention and requests
Public inquiry records are retained for 180 days. Customer and evidence retention follows the purpose of the data, the evidence trail required by the engagement, applicable law, and signed terms. To request access, correction, or deletion, write to hello@credalysthealth.com.