Privacy Policy

This Privacy Policy explains how Transparency Strategies (“we,” “us”) collects, uses, protects, and shares information in connection with TransForms (the “Service”), an online form-building and response-collection platform. By using the Service you agree to this Policy.

Some customers use TransForms to collect health information on behalf of healthcare providers. Where that is the case, the provider is the controller of that information and we act as their service provider / Business Associate, as described in Health information & HIPAA below.

1. Information we collect

• Account information — your name, email address, and password (stored only as a salted hash), and two-factor settings if you enable them.
• Form content — the forms you build and their settings.
• Form responses — data submitted to your forms by respondents, including any files or signatures. Depending on the form, this can include sensitive or health information. You, as the form owner, decide what you collect.
• Technical data — limited log data such as IP address, timestamps, and access events needed to operate and secure the Service.
• Cookies — a single session cookie to keep you signed in. We do not use third-party advertising or tracking cookies.

2. How we use information

• To provide, maintain, and secure the Service.
• To deliver form responses to you and the integrations you configure.
• To authenticate you and prevent unauthorized access.
• To send service and account-related communications.
• To comply with legal obligations.

We do not sell personal information, and we do not use form responses for advertising.

3. Data protection & security

Protecting the information in TransForms is central to how we build the Service. Our safeguards include:

• Encryption — all data is transmitted over TLS (HTTPS), and data stored in our database and file storage is encrypted at rest by our infrastructure providers.
• Access controls — accounts are protected by hashed passwords and optional two-factor authentication. Access to a form and its responses is limited to the owner and the specific people they grant access to, each with an Admin or Viewer role.
• Automatic sign-out — sessions expire after a period of inactivity to reduce the risk from unattended devices.
• Private files — on forms handling sensitive data, uploaded files and signatures are stored privately and served only to authenticated, authorized users — never through public links.
• Audit logging — we record access to responses (who viewed, exported, or downloaded them, and when) so account owners can monitor use.
• Minimization — when a form is marked as containing protected health information, we withhold response details from email notifications and disable third-party integrations so that data stays within the Service.
• Vendor diligence — our infrastructure subprocessors are bound by contract to protect the data they process on our behalf (see Sharing & subprocessors).

No method of transmission or storage is perfectly secure, but we work to protect your information using commercially reasonable administrative, technical, and physical safeguards appropriate to its sensitivity.

4. Health information & HIPAA

When a healthcare provider (a HIPAA “Covered Entity”) uses TransForms to collect Protected Health Information (PHI), that provider is the controller of the PHI and we act as their Business Associate. In those cases we handle PHI under a Business Associate Agreement (BAA) and only as permitted by it. We make the security features described above available to support the provider’s HIPAA obligations. If you are a provider and need a BAA, contact us at privacy@transparencystrategies.com.

5. Sharing & subprocessors

We share information only as needed to run the Service:

• Infrastructure providers — hosting, database, and file storage vendors that process data on our behalf under data-protection terms.
• Integrations you set up — if you connect a form to a third party (such as a spreadsheet, webhook, or messaging tool), response data flows to that service at your direction and is then governed by its terms. We disable these for forms marked as containing PHI unless you have the required agreements in place.
• Legal — where required by law or to protect rights and safety.

We do not sell or rent personal information to anyone.

6. Data retention & deletion

We retain your account and form data for as long as your account is active or as needed to provide the Service. You can delete individual responses or your entire account at any time; deleting your account removes your forms and their responses. We may retain limited records where required by law. Access-log records are kept to support security and compliance monitoring.

7. Your rights

Depending on where you live, you may have rights to access, correct, export, or delete your personal information, or to object to or restrict certain processing. You can manage much of this in your account settings, or contact us at privacy@transparencystrategies.com. If you submitted information to a form operated by another organization, please direct requests about that data to them.

8. Children’s privacy

The Service is not directed to children, and we do not knowingly collect personal information from children except where a provider lawfully collects a minor patient’s information through a form, in which case that provider is responsible for the required consents.

9. Changes to this Policy

We may update this Policy from time to time. We will post the updated version here and revise the “Effective” date above. Your continued use of the Service after a change means you accept the updated Policy.

10. Contact us

Questions about this Policy or your information? Email privacy@transparencystrategies.com.