Privacy Policy

This policy applies to personal data processed in the Thotara platform, on our public website and in support interactions. It does not apply to a customer organization's own systems, or to third-party services an organization connects using its own credentials.

Thotara is not a clinical system. It is not intended to hold patient medical records or protected health information, and customers are contractually prohibited from uploading them. Provider health attestations and immunisation records are credentialing artefacts about the clinician, not about any patient.

• Directly from the individual — intake forms, portal profile edits, uploaded documents, direct-deposit submissions and e-signatures.
• From the customer organization — records entered by recruiters, bulk imports from a prior CRM, and files received by email.
• From public and professional sources — the NPI registry, state licensing boards, certification bodies and public professional profiles.
• From optional connectors an organization enables — sourcing providers, telephony and email systems.
• Generated by the platform — audit entries, activity metrics, AI suggestions and derived matching scores.

We do not sell personal data, do not share it for cross-context behavioural advertising, and do not use customer data to train third-party foundation models.

To reduce manual data entry, Thotara looks up publicly available professional information — for example the NPI registry, licence boards and public professional profiles — and proposes field values. AI is also used to extract data from CVs and credentialing documents, to draft letters, agreements and job summaries, and to score candidate-to-job fit.

• Every AI or enrichment output is a suggestion. It carries its source, is queued for review, and is never written to a record until a person accepts it.
• No automated decision with legal or similarly significant effect is made about an individual: matching scores rank options for a recruiter, they do not hire, reject or price anyone.
• Model prompts are limited to the fields needed for the requested task, are not retained by the model provider for training, and are logged with the requesting user for accountability.
• Individuals may ask the controlling organization to correct any enriched field, and corrections override the suggested value permanently.

• Access is scoped to a single organization at the database layer through row-level security; one customer's workspace is never visible to another.
• Within an organization, role and permission checks decide which surfaces and fields a user can open; sensitive surfaces such as banking, audit and access review are restricted to administrators or a finance role.
• Providers signing in to the provider portal see only their own profile, assignments, letters, agreements, travel and timesheets.
• Facility contacts see only their own client's jobs, presented candidates, timesheets, invoices and agreements.
• Thotara personnel do not access customer records in the ordinary course. Access for support or incident response is limited to named staff, requires a business justification, and is time-bound and logged.
• Disclosure to law enforcement or a regulator is made only where legally compelled; where the law permits, we notify the affected organization first.

Each sub-processor is bound by written terms that impose confidentiality, security and data-protection obligations no less protective than this policy. Optional connectors are engaged by the organization under its own agreement with that vendor. We maintain a current sub-processor register and notify organization administrators of a material change or a new sub-processor before it begins processing, giving them an opportunity to object.

Application data is hosted in the United States. Where personal data is transferred from the UK, EEA or Switzerland, the transfer relies on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, supported by a transfer risk assessment and the technical measures described below — encryption in transit and at rest, tenant isolation and access logging. Copies of the transfer terms are available to customers on request.

Retention is enforced by a nightly scheduled purge rather than manual clean-up, and each run records what it deleted. Backups roll off on their own schedule within 35 days, so a deleted record may persist in an encrypted backup until that window closes. Where a record is subject to a legal hold, tax obligation or an unresolved dispute, it is retained until that obligation ends.

Measures include encryption in transit and at rest, organization-scoped row-level security, least-privilege roles, mandatory two-step verification (authenticator app for staff, emailed one-time code for portal users), breached-password screening, a 30-minute idle session timeout, private document storage with short-lived signed links, server-side-only secrets, immutable audit logging and constant-time verification of webhook and scheduled-job credentials. The security page documents the control set in full.

• Access — obtain a copy of the personal data held about you.
• Rectification — correct inaccurate or incomplete data; portal users can edit much of their own profile directly.
• Erasure — ask for deletion where there is no overriding legal, contractual or credentialing obligation to retain.
• Restriction and objection — ask that processing based on legitimate interests be paused or stopped.
• Portability — receive your data in a structured, machine-readable format.
• Withdraw consent — for SMS or marketing outreach, at any time, including by replying STOP or using the unsubscribe link.
• Complain — to your local supervisory authority; in the UK, the Information Commissioner's Office.

Send requests to privacy@thotara.com. We acknowledge within five business days and respond within 30 days (extendable once by a further 60 days for complex requests, with notice). We verify identity before disclosing data, and requests about a customer's records are routed to that organization as controller. There is no charge unless a request is manifestly excessive or repetitive.

Residents of California, Colorado, Connecticut, Virginia, Texas and other states with comprehensive privacy laws have rights to know, access, correct, delete, obtain a portable copy, and to opt out of sale, targeted advertising and profiling with legally significant effects. Thotara does not sell personal information, does not process it for targeted advertising, and does not conduct such profiling, so there is nothing to opt out of. We do not discriminate against anyone for exercising a right, and an authorised agent may submit a request with written proof of authority. Where Thotara acts as a service provider, the request is fulfilled by the controlling organization.

The platform is intended for professional use by adults. We do not knowingly collect personal data from anyone under 16. If such data is uploaded in error, notify us and it will be deleted.

Thotara sets only cookies and local-storage entries that are strictly necessary to run the service: session and authentication tokens, two-step verification state, the active organization selection, idle-timeout coordination between tabs and interface preferences. There are no advertising cookies, no third-party trackers and no cross-site profiling, so no consent banner is required. Clearing site data signs you out.

Confirmed security incidents affecting personal data are triaged, contained and investigated under a documented incident-response procedure. Affected organization administrators are notified without undue delay and in any event within 72 hours of confirmation, with the nature of the incident, the categories and approximate volume of data involved, the likely consequences and the remedial steps taken. Where an organization is the controller, it is responsible for notifying its own regulator and individuals, and we provide the information it needs to do so.

Material changes to this policy are announced to organization administrators before they take effect, and the "last updated" date above always reflects the current version. Privacy enquiries: privacy@thotara.com. Security matters: security@thotara.com.