Credential Data & Security Addendum

1. Purpose. The Organization may collect, review, monitor, verify, and manage professional certifications, licenses, continuing-education records, training records, expiration dates, renewal states, and associated professional credential documents.
2. Authority. The Organization represents it has lawful authority for workforce credential information it submits or requests.
3. No PHI. Med-Cert Pro is not HIPAA compliant. The Organization must not upload PHI, patient records, diagnoses, treatment records, clinical documentation, insurance records, or patient identifiers. This Addendum is not a BAA.
4. No Background Checks. Med-Cert Pro does not provide or store employment background checks, criminal-history reports, consumer reports, or similar screening records.
5. Permitted Information. Professional certifications, professional licenses, credential identifiers, certification cards, training certificates, CE records, expiration dates, renewal states, verification information, and credential requirements.
6. Access Controls. Individual administrator accounts; no shared logins; least-privilege role assignment; prompt access removal; MFA may be required for privileged roles.
7. Individual Wallet Ownership. Organization membership does not transfer ownership of an individual's personal account.
8. Use Limitation. Credential information may be used for legitimate credentialing, workforce, training, compliance, employment, regulatory, or organizational purposes.
9. Med-Cert Pro Security. Reasonable safeguards including encryption, access controls, private storage, audit logging, monitoring, backups, session controls, and incident response.
10. Organization Security. Organization protects administrator accounts, exports, organization devices, downstream copies, and promptly reports suspected compromise.
11. Incidents. Each party will reasonably cooperate with investigations involving its environment; legally required notifications remain subject to applicable law.
12. Exports. Once data is lawfully exported to an Organization-controlled system, the Organization protects that copy.
13. Termination. Organization-controlled data follows the applicable retention/deletion schedule. Termination does not automatically delete independent personal accounts.
14. Service Providers. Med-Cert Pro may use infrastructure/service providers necessary to operate the platform and will disclose relevant infrastructure/service-provider information in the Privacy Policy and associated disclosure, including conditional mobile services. Providers may process data only for authorized service purposes or their independently applicable billing/distribution obligations.
15. Compliance. Each party remains responsible for laws applicable to its own processing.
16. Precedence. This Addendum controls conflicts specifically concerning credential-data privacy/security.

This addendum applies when incorporated into an accepted organization order. The accepted order identifies the organization and authorized contacts. Questions and security reports: [email protected].

Operational safeguards and incidents

Med-Cert Pro uses private credential-document storage, document encryption and access checks; no guarantee that every stored field or every backup has identical encryption is made. Actual infrastructure and recovery controls must be assessed against the deployed service. Neither party will intentionally include credential contents or authentication secrets in analytics or ordinary diagnostic messages. If either party discovers a relevant security incident, it will notify the other's designated security contact without undue delay, preserve evidence, cooperate and provide legally required information. This creates no waiver of mandatory notification deadlines and no promise of a particular recovery time unless separately contracted.

Return, deletion and providers

Authorized export and deletion requests follow the organization agreement and published retention process. Personal wallets and organization-controlled copies must be distinguished. Deleted information restored from a backup must be subject to the same deletion restrictions before the restored service is returned to production. A legal hold must identify its lawful purpose, restrict access and be reviewed when its purpose ends. Service providers do not gain a right to use credential documents for unrelated advertising or model training merely because they operate infrastructure.