Privacy Policy

Introduction

MyN95Certificate.com ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and services to obtain OSHA 1910.134 respirator medical clearance certification.

By using our services, you consent to the data practices described in this policy. If you do not agree with our policies and practices, please do not use our services.

Information We Collect

Personal Information

When you create an account and use our services, we collect:

• Full name, email address, phone number, and date of birth
• Mailing address
• Job title and employer information
• Account credentials (password is stored in hashed form)

Protected Health Information (PHI)

To provide medical clearance services, we collect health-related information through the OSHA Appendix C medical questionnaire, including:

• Medical history and current health conditions relevant to respirator use
• Responses to OSHA-mandated health screening questions (e.g., respiratory conditions, cardiovascular conditions)
• Type of respirator you use or intend to use
• Working conditions related to respirator use

Payment Information

We use Stripe as our payment processor. When you make a payment, Stripe collects your payment card information directly. We do not store your credit card number on our servers. We only receive and store:

• Transaction confirmation and amount
• Last four digits of your card (for reference only)
• Billing address

Automatically Collected Information

When you access our website, we automatically collect:

• IP address and browser type
• Device information and operating system
• Pages visited and time spent on pages
• Referral source

How We Use Your Information

We use the information we collect to:

• Process your medical clearance questionnaire
• Evaluate your fitness for respirator use (performed by licensed healthcare providers)
• Generate and deliver your certification documents
• Process payments for our services
• Send you important notifications about your account and certification status
• Send expiration reminders to help you maintain compliance
• Respond to your customer service requests
• Improve our website and services
• Comply with legal obligations

Protected Health Information (PHI) Handling

We understand the sensitive nature of your health information and have implemented strict safeguards:

Security Measures for PHI

• Encryption at Rest: All questionnaire responses and health information are encrypted using AES-256 encryption before storage
• Encryption in Transit: All data transmitted between your browser and our servers uses TLS/SSL encryption (HTTPS)
• Access Controls: PHI is only accessible to authorized Medical Review Officers (MROs) who need it to evaluate your clearance
• Audit Logging: All access to PHI is logged and monitored
• Secure Infrastructure: Our servers are hosted on AWS with enterprise-grade security

HIPAA Compliance Note

While our services facilitate OSHA compliance, we implement security practices consistent with HIPAA requirements for protecting health information. We use administrative, physical, and technical safeguards to protect your PHI from unauthorized access, use, or disclosure.

Data Security

We implement a variety of security measures to maintain the safety of your personal information:

• Passwords are hashed using bcrypt with a cost factor of 12
• Account lockout after 5 failed login attempts for 15 minutes
• JWT tokens with 24-hour expiry for session management
• Regular security audits and vulnerability assessments
• Employee training on data protection and privacy practices

Third-Party Services

We use the following third-party services to operate our platform:

Stripe

We use Stripe for payment processing. Stripe is PCI-DSS Level 1 certified, the highest level of certification in the payments industry. When you make a payment, your card information is sent directly to Stripe and is not stored on our servers. See Stripe's Privacy Policy.

Amazon Web Services (AWS)

Our infrastructure is hosted on AWS, which provides enterprise-grade security, compliance certifications, and data center security. We use:

• AWS S3 with KMS encryption for secure document storage (certificates)
• AWS SES for email delivery
• AWS RDS for encrypted database storage

See AWS Privacy Policy.

Google Analytics

We use Google Analytics to understand how visitors use our website. This service collects anonymized data about page views and user behavior. See Google's Privacy Policy.

Data Retention

We retain your information for the following periods:

• Account Information: Retained while your account is active and for 7 years after account closure for legal and regulatory purposes
• Questionnaire Responses (PHI): Retained for 7 years from the date of submission, consistent with medical record retention requirements
• Certificates: Retained for 7 years from date of issuance
• Transaction Records: Retained for 7 years for tax and accounting purposes
• Audit Logs: Retained for 3 years

Your Rights

You have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate personal information
• Deletion: Request deletion of your personal information (subject to legal retention requirements)
• Portability: Request your data in a portable format
• Opt-out: Unsubscribe from marketing communications (note: transactional emails about your account and certification cannot be opted out)

To exercise any of these rights, please contact us at privacy@myn95certificate.com.

Cookies

We use cookies and similar technologies to:

• Keep you logged into your account
• Remember your preferences
• Analyze website traffic and usage patterns
• Prevent fraud and enhance security

You can control cookies through your browser settings. However, disabling cookies may affect the functionality of our website.

Children's Privacy

Our services are not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last Updated" date. We encourage you to review this policy periodically.