Privacy policy

Last updated: October 28, 2026

This policy explains what ISO AI Solutions LLC (“CredCarry,” “we,” “us”) collects through credcarry.com and the CredCarry app, what we do with it, and how we protect it.

The website (credcarry.com)

• We don’t use advertising trackers or analytics on the website. The page remembers whether you picked the light or dark look, and that stays in your own browser.
• Booking a call uses Calendly. When you book, Calendly collects your name, email and anything you type in. Calendly’s own privacy policy covers that, and we receive the booking so we can hold the call.
• The page loads its fonts from Google Fonts.

The CredCarry app (app.credcarry.com)

CredCarry is used by staffing agencies to keep their caregivers’ credentialing records. For each agency we hold:

• the agency’s staff accounts (name, email, role)
• its caregivers’ records: name, contact details, credentialing documents, expiration dates and registry search results
• a log of what was done, by whom and when

The agency decides what goes into CredCarry and owns that information. We handle it on the agency’s behalf, only to provide the service to that agency, under its instructions and our agreement with it.

We don’t sell it, we don’t share it for advertising, and we don’t use it to train AI models.

HIPAA and patient information

CredCarry is not built to hold patient health information, and agencies agree not to upload it. HIPAA protects patients’ health information. CredCarry holds records about an agency’s own workforce: licenses, certifications, screenings and training. HIPAA’s definition of protected health information leaves out employment records an employer keeps in its role as employer (45 CFR 160.103), and that is what these records are.

So, unless we have signed a separate written agreement with an agency that says otherwise, we are not acting as that agency’s HIPAA business associate. If patient information is uploaded anyway, we may delete it, and the agency that uploaded it is responsible for it.

Health-related items about a caregiver, such as a physical or TB test, are still treated as sensitive: they are visible only to the signed-in staff of that caregiver’s own agency.

Who else touches it

We use a small number of service providers to run CredCarry:

• hosting and the database (Railway, Supabase)
• sending and receiving email (Resend, Postmark)
• reading documents (Anthropic, OpenAI), under business terms that keep what they read out of model training
• domain and DNS (Cloudflare)

They handle data only to provide their part of the service. The current list is available on request. We may also disclose information when the law requires it, for example to answer a valid court order.

How we protect it

• Stored in the US. The database sits in US data centers and is backed up daily.
• Encrypted. Data travels over HTTPS and is encrypted at rest.
• Walled off. Every request is checked against the signed-in person’s own agency, and the database itself refuses direct access to every table.
• Never at a public address. Documents live inside the database and open only for signed-in staff of that agency.
• Sign-in. There is no public sign-up. Agencies can require a code from an authenticator app at sign-in, and new-device sign-ins raise a security alert.
• Roles and records. Administrator and staff roles, with only administrators able to send anything out. Every filing, change and send is logged with who did it and when.

We take these steps seriously, but no system connected to the internet can be made perfectly secure, and we can’t promise that information will never be reached without permission. If we learn that it was, we tell each affected agency within 10 days of confirming it, with what we know and what we are doing about it.

Caregivers

If your agency uses CredCarry, your credentialing documents are kept in your agency’s workspace. You may receive emails from your agency about missing or expiring documents. Each one is approved by a person at your agency before it is sent.

You can stop those emails with your email app’s unsubscribe button, or by replying with just the word STOP. To see, correct or delete your records, ask your agency, since it controls them. We will help the agency answer. You can also contact us below.

How long we keep it

We keep an agency’s data while it uses CredCarry. When it leaves, we return an export on request and delete the data within 30 days, unless the law requires us to keep it longer.

Children

CredCarry is a tool for businesses and is not meant for anyone under 18.

Changes and contact

If this policy changes, we’ll update the date above. If a change matters to how an agency’s data is used, we will tell the agency first.

Questions: isoaisolutions@gmail.com.