Privacy Policy

Who we are

NetCare Share provides a secure way for organizations to deliver documents — such as care coordination packets, benefits summaries, and vendor files — to specific recipients through unique, expirable links. We act as a data processor for content that our customers share through the Service, and as a data controller for the account and website information described below.

Information we collect

Information you provide

• Account & access requests: name, work email, organization, and team when you request or use an operator workspace.
• Recipient details supplied by customers: recipient email addresses and optional names that a customer enters to generate share links.
• Document content: the files and text a customer chooses to share through the Service.
• Support correspondence: messages you send to our support address.

Information collected automatically

• Usage & log data: pages and share links accessed, timestamps, referring URLs, and event outcomes (for example, opened, verified, authorized).
• Device & connection data: IP address, browser type, operating system, and device type.
• Approximate location: we derive an approximate country/region/city from the IP address for security and analytics. We do not collect precise GPS location.
• Cookies: a strictly necessary session cookie is used to keep operators signed in. We do not use advertising cookies.

How we use information

• Deliver the Service — generate and serve share links, authenticate recipients, and display shared documents.
• Send transactional notifications about shared documents (see Email & communications).
• Secure the Service — detect abuse, fraud, and unauthorized access, and maintain an audit trail.
• Support and communicate with operators and organizations.
• Improve reliability and performance through aggregate analytics.
• Comply with legal obligations and enforce our Terms and Acceptable Use & Anti-Spam Policy.

We do not sell personal information, and we do not use shared document content for advertising or model training.

Legal bases (EEA/UK)

Where the GDPR or UK GDPR applies, we process personal data on the bases of performance of a contract, our legitimate interests (operating and securing the Service), compliance with legal obligations, and — where required — consent. For customer-provided content, our customer is the controller and is responsible for the lawful basis of sharing.

Sharing & subprocessors

We share personal information only as needed to run the Service:

Category	Purpose
Email delivery providers (e.g., Postmark, Amazon SES, Mailgun)	Send transactional notifications and process delivery, bounce, and complaint events.
Cloud hosting & infrastructure	Host the application and store data securely.
IP geolocation provider	Resolve approximate location from IP addresses for security and analytics.
Professional advisors & authorities	When required by law, or to protect our rights, users, and the public.

Subprocessors are bound by contractual confidentiality and data-protection obligations. We may share information in connection with a merger, acquisition, or asset sale, subject to this policy.

Email & communications

The Service sends transactional email — notices that a document has been shared, along with delivery-related messages. These emails are sent to recipients whom our customers have a legitimate relationship with. We honor unsubscribe and suppression requests, and we maintain a suppression list so that addresses that bounce, complain, or opt out are not contacted again. See our Acceptable Use & Anti-Spam Policy.

Data retention

We keep personal information for as long as needed to provide the Service and for legitimate business or legal purposes. Visitor and log records are retained on a rolling window (by default 90 days) and then purged. Customers can request deletion of their content and account data as described below.

Security

Public surfaces are served over HTTPS/TLS. Share links use high-entropy tokens, there is no public file index, and operators can revoke a single share or freeze all active links instantly. We apply access controls, encryption in transit, and audit logging. No method of transmission or storage is perfectly secure, but we work to protect your information using reasonable safeguards.

Your rights

Depending on your location, you may have rights to access, correct, delete, or port your personal information, to object to or restrict certain processing, and to withdraw consent. If your data was provided by an organization using NetCare Share, please contact that organization; we will assist them as their processor. To exercise a right directly, email privacy@netcareshare.com. You may also lodge a complaint with your local data-protection authority.

International transfers

We may process and store information in countries other than your own. Where required, we use appropriate safeguards (such as Standard Contractual Clauses) for cross-border transfers.

Children

The Service is intended for business use and is not directed to children under 16. We do not knowingly collect personal information from children.

Changes to this policy

We may update this policy from time to time. Material changes will be reflected by the “Last updated” date above and, where appropriate, communicated to account holders.

Contact

Questions about this policy or your data? Contact us: