Privacy Policy

1. Who we are and our role

RestDoc360 provides an administrative coordination platform to licensed funeral homes, crematories, and funeral service organizations (“Customers”). Customers decide what information to enter and how to use the Service; for that information we generally act as a service provider or processor on the Customer’s behalf. For information collected through our public website (for example, a demo request), we act as the controller.

RestDoc360 is an administrative coordination tool. It does not replace state death registration systems or the legal responsibilities of licensed funeral directors.

2. Information we collect

2.1 Administrative decedent data (entered by Customers)

Customers enter administrative information needed to coordinate a death certificate: the decedent’s name, dates of birth and death, place of death and state, disposition details, case reference numbers, and status history. The Service intentionally does not provide fields for cause or manner of death or for Social Security numbers, and outbound messages are screened to prevent such content from being sent through the Service.

2.2 Staff contact data

Names, work email addresses, phone numbers, job titles, roles, authentication credentials (stored as salted hashes), multi-factor authentication secrets (encrypted), login and activity records, and audit trail entries for Customer personnel who use the Service.

2.3 Certifier professional contact data

Professional contact details for physicians, medical examiners, coroners, and other medical certifiers that Customers add to their directory: name, practice or office, professional email, phone and fax numbers, preferred contact method, communication consent and verification notes, and the record of follow-up messages sent and responses received.

2.4 Family contact data

When a Customer enables family updates: the name, relationship, email address, and/or phone number of the family contact, the secure portal link issued to them, and a log of status updates sent. Families are shown plain-language progress only; no medical details are displayed.

2.5 Website and account information

Information you submit through our website (demo requests, contact messages), billing contact details and subscription status (card numbers are handled only by our payment provider), and technical information such as IP address, browser type, and pages visited, used for security and to operate the site.

3. How we use information

• To provide, operate, secure, and support the Service, including sending follow-up messages, escalations, and status updates that Customers configure.
• To authenticate users, enforce roles and permissions, and maintain audit logs required for accountability.
• To respond to demo requests, contact messages, and support inquiries.
• To manage subscriptions, trials, usage limits, and billing.
• To produce aggregated, de-identified reporting about Service performance that does not identify any individual.
• To comply with law, enforce our Terms, and protect the rights and safety of users, Customers, and the public.

When RestDoc AI features are used, administrative case information selected by the user may be processed by an AI provider to generate suggestions. Suggestions are advisory and labelled as such. Where no AI provider is configured, a deterministic rules engine runs entirely within the Service.

4. We do not sell personal information

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We do not use Customer data to train general-purpose AI models.

5. How we share information

We share information only as needed to operate the Service:

• Recipients you choose. Messages a Customer sends through the Service are delivered to the certifiers, families, and staff the Customer designates.
• Subprocessors. Infrastructure, email delivery, SMS delivery, AI, and billing providers, each only when configured by the Customer or required to run the Service, and each bound by contractual confidentiality and security obligations. A current list of subprocessors is available on request and will be published before general availability.
• Legal requirements. When required by law, subpoena, or court order, or to protect rights, safety, or the integrity of the Service. We will notify affected Customers where legally permitted.
• Business transfers. In connection with a merger, acquisition, or sale of assets, subject to this Policy.

Platform administrators employed by RestDoc360 cannot view Customer case details except through a time-limited, Customer-approved, fully audited support access grant.

6. Security

We maintain administrative, technical, and physical safeguards appropriate to the sensitivity of the information, including strict tenant isolation on every data query, encryption in transit (TLS) and encryption of secrets at rest, salted password hashing, optional and administrator-enforceable multi-factor authentication, role-based least-privilege access, comprehensive audit logging, and secure development practices. No system is perfectly secure; if we become aware of a breach affecting your information we will notify you as required by applicable law and our agreements.

7. HIPAA note

RestDoc360 is designed with HIPAA-aware safeguards. Whether HIPAA applies to a particular Customer’s use of the Service depends on the Customer’s status and the information entered, and must be assessed by the Customer. Where a Customer determines that a Business Associate Agreement (BAA) is required, a BAA must be executed with RestDoc360 before any protected health information is entered into a live account. RestDoc360 does not claim HIPAA certification; no such certification exists.

8. Retention

We retain Customer data for the life of the Customer’s subscription and for a limited period afterwards to allow export and to meet legal obligations, after which it is deleted or de-identified. Audit logs are retained for the period required for accountability and compliance. Demo and contact submissions are retained for up to 24 months unless you ask us to delete them sooner. Customers may configure shorter retention for certain data categories on eligible plans.

9. Your choices and rights

Customer personnel, certifiers, and family contacts should direct requests about information held in a Customer’s account to that Customer, who controls it; we will assist the Customer in responding. For information we control, you may request access, correction, deletion, or a copy of your information, and may object to or restrict certain processing, by contacting us as described below. We will verify your request and respond within the time required by applicable law.

Certifiers and family contacts can stop receiving messages at any time by using the opt-out link or reply instructions in any message, or by contacting the funeral home.

10. State privacy laws

Residents of states with comprehensive privacy laws (including, for example, California, Colorado, Connecticut, Oregon, Texas, Utah, and Virginia) may have additional rights, including the right to know what personal information is collected, to delete it, to correct it, to opt out of its sale or sharing, and not to be discriminated against for exercising these rights. We do not sell personal information or use it for targeted advertising. To exercise your rights, contact us as described below. You may designate an authorized agent where permitted by law.

11. Children

The Service is intended for business use by funeral professionals and is not directed to children under 16. We do not knowingly collect personal information from children.

12. International use

The Service is designed for funeral homes operating in the United States and is hosted in the United States. If you access the Service from elsewhere, your information will be transferred to and processed in the United States.

13. Cookies

We use a strictly necessary session cookie to keep you signed in and to protect against cross-site request forgery. We do not use advertising or cross-site tracking cookies on the Service.

14. Changes to this Policy

We may update this Policy from time to time. We will post the revised Policy with a new effective date and, for material changes, notify Customers through the Service or by email.

15. Contact

Questions, requests, or concerns about this Policy can be sent through our contact form with “Privacy” in the subject line, or to the postal address that will be listed here on publication.