Privacy Policy

What Tacet is, in privacy terms

Tacet provides HIPAA training and audit-ready completion records for drivers at NEMT (non-emergency medical transport) vendor organizations. Tacet does not process patient health information — no patient names, medical conditions, or trip details ever pass through this system. The personal data Tacet handles is limited to driver workforce data (name, an employer-issued driver ID, training completion records) and vendor admin account data (email address, organization details).

What we collect

• Drivers: full name, an employer-issued driver ID, a shared verification code (stored as a salted hash, never in plain text), and training completion records (score, date, expiration).
• Vendor admins: email address and organization name/contact info, used for account login and to operate the roster dashboard.
• Demo organization: the demo at /train/demo uses a single fictitious driver (“Demo Driver”, ID DEMO-1) on a shared public roster. Completing it writes a training record for that fictitious driver, not for you; no personal data about the person running the demo is collected.

Why we collect it

To authenticate a driver against their employer’s roster before issuing a training certificate, and to give vendor organizations an auditable record they can produce for their own compliance purposes. We do not use driver or admin data for advertising, and we do not sell personal data.

Retention

Real (non-demo) training completion records are retained to support the retention period referenced in 45 CFR §164.530(j) — a vendor’s own workforce training documentation requirement, not a claim that Tacet itself is a HIPAA covered entity or business associate. Demo-organization records are illustrative and may be reset or pruned at any time. Driver roster entries persist until the vendor organization removes them.

Who can see what

A driver’s training records are visible to the vendor organization that added them to its roster. Public certificate verification (via QR code or link) shows only validity status, training version, completion date, and expiration date — never a driver’s name, ID, or score. Driver secret codes are stored as one-way salted hashes; Tacet cannot recover them.

Your rights

To request access to, correction of, or deletion of personal data Tacet holds about you, contact brad@tacetcert.com. If you’re a driver, your employer (the vendor organization) manages your roster entry and can also action removal requests directly.

Contact

Questions about this policy: brad@tacetcert.com