Privacy Policy

Effective 27 October 2026

Fieldstone Health, LLC, a Massachusetts limited liability company located at 14 Algonquian Drive, Natick, MA ("Fieldstone," "we" or "us"), makes software for healthcare organizations, including Secure Form (secure-form.com). This policy explains what information we collect through our websites and services, how we use it, and the choices you have.

The short version

• We never sell personal information.
• We don't market to you. If you ask us for help, we follow up once, by call or email, as you choose. We don't add you to mailing lists.
• We don't track you. We don't follow you across websites for advertising, and we use no advertising cookies, tracking pixels or social widgets. We keep only the operational and security records described below.
• We process what you submit through a customer's form for the organization that asked you to fill it in, under our written agreement with that organization and applicable law. We never sell it or use it for marketing or to train AI models.

1. Who this policy covers

This policy covers:

• visitors to our websites, including secure-form.com and fieldstone-health.com;
• people who contact us, request a free form or try our demo; and
• staff at our customers who sign in to our services.

If you fill in a form for one of our customers, such as your healthcare provider, section 2 explains how your information is handled.

2. Information submitted through customer forms

When you fill in a form on Secure Form, Fieldstone receives and processes your submission on behalf of the healthcare provider or other organization that asked you to fill it in. When that organization is subject to HIPAA, we act as its business associate, or as a subcontractor of its business associate, under the written agreement HIPAA requires. When it isn't, we protect your information under our written agreement with the organization and applicable privacy law; that agreement doesn't make the organization subject to HIPAA or create HIPAA rights. The organization's privacy notice, including its HIPAA Notice of Privacy Practices where applicable, explains how it uses your information. This policy doesn't replace that notice or reduce your rights.

• What forms may collect: whatever the organization's forms ask for. That can include your name, contact details, date of birth, Social Security number, insurance details and card images, driver's license or other ID images, medical history, signatures and files you upload.
• What we do with it: we protect it and process it to provide, support and secure the service the organization chose, following its instructions, our agreement with it and applicable law. Where the organization is subject to HIPAA, the agreement also allows limited uses for our own administration and legal obligations, within HIPAA's limits; otherwise we use it only to provide, secure and support the service and to comply with law. How long we keep it depends on the service. On Secure Form Direct Delivery, we delete each submission from our active systems 30 days after our email provider accepts the delivery email to the organization, and backup copies expire within a further 30 days; a submission that couldn't be delivered is resolved with the organization and deleted 30 days after that, never kept indefinitely. On Secure Form Workflow Portal, submissions stay in the organization's portal while it is our customer, or for the shorter period the organization chooses, and backup copies expire 30 days after a submission is deleted. For organizations covered by HIPAA, each submission containing HIPAA-protected information is also written once to a locked archive copy that nobody, including us, can change or delete for one year; we use an archive copy only to restore the organization's records at its request or when the law requires, and each archive copy is deleted when its own one-year lock ends, including after the organization leaves. Organizations not covered by HIPAA have no locked archive. Separately, we keep a record of who viewed or downloaded each submission, and of each form received and where it was delivered (with no form answers), for six years. Where the law requires us to keep or delete information on a different schedule, the law prevails. Copies delivered to the organization's own email or systems are under its control.
• What we never do with it: sell it, use it for marketing, or use it to train artificial-intelligence models.
• Your browser: our current form pages set no cookies, run no analytics and load no scripts from other companies, and we don't store your answers in your browser. Your browser or device may still keep information through features outside our control, such as autofill, history or downloads. The earlier forms described below work differently.
• Your rights: to see, correct or ask questions about your submission, contact the organization that asked you to fill in the form. If you contact us instead, we'll securely pass your request to that organization within 2 business days, or sooner if the law requires. We'll help the organization respond, and we'll meet any duties the law places directly on us; passing on a request doesn't end our responsibilities. Whether information can be deleted depends on the law and the organization's record-keeping duties; HIPAA does not give a general right to have medical records deleted.

Some organizations still use our earlier form service. For those forms, LuxSci receives your submission and delivers it by email to the organization requesting the form. Our earlier application does not maintain a database of completed submissions. The requesting organization controls copies delivered to its own systems.

These forms load LuxSci's scripts. After submission, you may reach a confirmation page on secure-form.com. That page does not receive your form answers, although a visit generates the security logs described in section 4.

Descriptions of the current platform's portal, customer-specific encryption keys, and Direct Delivery and Workflow Portal retention periods do not describe this earlier service. The agreements applicable to the earlier service continue to govern until the organization completes its transition. For questions or requests concerning your submission, contact the organization that requested it.

3. Information you give us

• Requests and questions. When you ask for a free form, a quote or security documents, or send us a question, we collect your name, organization, email address, whether you'd like a call or an email, your phone number if you want a call, your message, and any form you upload.
• Uploads must be blank. Please submit only blank templates through our business contact and upload channels, without patient information. If we discover patient information received through these channels, we restrict access, stop unnecessary processing, and assess whether it was accessed or disclosed improperly. We contact the verified sender or responsible organization as appropriate and provide incident notices required by applicable law and our agreements. We arrange secure return or deletion and may retain a limited, protected incident record where necessary for compliance. We do not use this information for AI processing and may request a blank replacement.
• Demos. Our demos are for fictional patient information and blank forms only. The demo form on our website is for made-up details, and what you type stays in your browser. None of it is sent to us. When you ask for the sample PDF, we make it from our own fictional patient and return it straight to your browser without storing or emailing it, and the website demo asks for no email address. Before a practice signs up, we may build one of its blank forms as a free demo. It is marked as a demo, accepts no file uploads, takes a limited number of test submissions, sends them only to the person who requested it, and expires after 15 days unless, within that time, the practice signs our agreements and we activate its service. Before using it, that person must accept our Free Demo Terms, confirming for themselves and their organization that they won't enter real patient information or share the demo for patient use. Using a form with real patients requires the signed agreements and our activation of the service. We delete practice demo submissions when the demo ends, their backup copies expire within 30 days, and copies of demo emails kept by our email provider are deleted within 30 days, with its backups expiring within a further 30 days. Our demo controls enforce these limits but can't recognize real patient information, so if it is entered in a demo anyway, we restrict access to it, assess whether anyone must be notified, and securely delete or return it.
• Email. If you email us, we receive whatever you include.
• Customer accounts. For staff who sign in to our services, we keep a name, email address, username, organization and role. Passwords are stored only in scrambled (hashed) form. For passkeys we store only the public key. We also keep the settings for your other sign-in methods, including your mobile number if you choose to receive sign-in codes by text message, when you last signed in, and a record of which submissions you viewed or downloaded and which settings you changed.
• Customer organizations. We keep each customer's name, address, phone number, website, logo, main contact, and the email addresses where its forms are delivered. We bill customers by emailed invoice, paid by check or bank transfer, and use no outside billing or payment service.

4. Information collected automatically

When you send us a request, we also record when you sent it, the page you sent it from, any campaign tags in the link you followed (such as utm_source), and a keyed hash of your IP address (a code derived from it) that we use to block spam. The hash is a security tool, not a promise of anonymity. Our hosting provider's logs, described below, keep the IP address itself for 30 days.

Cookies. We use only the cookies our services need to work and stay secure. We use no advertising or tracking cookies.

Scroll sideways to see every column.

Analytics. We use no audience-analytics service today. The form counts and security records described in this policy help us run the service. We may later add a tool that counts total visits to our marketing websites, but only after checking what it collects and updating this policy first. Patient form pages and the portal will not use analytics.

Server logs. Our hosting provider records each request's IP address, the page requested and the time, and keeps these records for 30 days for security and troubleshooting. Because a page address can show that someone used a healthcare service, we keep patient details out of page addresses and protect these logs accordingly. Our own application logs are designed to leave out patient answers and other personal information we don't need. To limit spam and repeated failed sign-ins, we keep keyed hashes of IP addresses for up to one hour, or up to one day for the daily limit on our website demo's sample PDFs; these shorter periods don't apply to the hosting provider's logs.

Nothing from other companies. Our current websites and form pages load no scripts, fonts or images from other companies, and we use no tracking pixels, social media widgets or advertising networks. The earlier forms described in section 2 load LuxSci's scripts. Our hosting and security providers still handle each request, as described in this policy.

Do Not Track and Global Privacy Control. We don't track you across websites for advertising, sell personal information or share it for advertising, so we already do what a Global Privacy Control signal asks. Neither signal changes the processing we need to run and secure our services. We don't allow other companies to collect information about your online activities over time and across other websites when you use our websites.

5. How we use information

We use the information in sections 3 and 4 to:

• answer your request and build your free form;
• provide, secure and support our services, including sign-in codes, delivery notices and alerts;
• prevent spam, abuse and fraud;
• count activity on our forms, such as views, starts and submissions, with no personal details, to run our services and report to customers; and
• meet our legal obligations.

When you ask us for help, we follow up once, in the way you chose. We don't send marketing email.

6. Blank forms and AI

We use an AI service, currently OpenAI, to extract questions and field structure from approved blank templates and convert them into structured data used to build online forms.

An authorized person must review each template before approving and initiating its submission to the AI service. This review includes checking for patient information, filled-in answers, and hidden or embedded data. If a template contains patient information, we do not submit it to the AI service or use it for form conversion. We request a clean blank replacement and handle the original through the secure return or deletion process described in section 3. These restrictions apply to identifiable patient, donor and other health information, whether or not HIPAA applies.

We use AI services only under terms and settings that prohibit using our submitted content to train their models. The provider may retain approved template content to provide and secure its services, subject to the terms and retention settings applicable to the product and features we use.

We may select or change AI models based on evaluations of accuracy, reliability, speed and cost. Evaluations use reviewed blank templates or synthetic examples, never real patient information. Any model we use must remain consistent with the restrictions and safeguards described here.

7. Who we share information with

We never sell personal information or share it for advertising. We use service providers only for the purposes in this policy, under contracts that limit what they may do with it. Every provider that handles patient information for us (hosting, file storage and backup, secure email, and our own email) is covered by a business associate agreement, either directly with us or through our hosting provider's agreements. Our applications, databases and files are hosted in the United States. We give our customers the current list of those providers, with what each does and where it processes the information, when they sign with us, and on request to security@fieldstone-health.com. A contractor who provides support and emergency access to our systems works under a confidentiality and business associate agreement with us. If a customer turns on sign-in codes by text message, we send those codes through Twilio, which receives only the staff member's mobile number and the code, never patient information. Text-message codes are off for every customer unless it asks us to turn them on.

For information we hold for our own business, we may disclose it when the law requires, or where the law allows and it's reasonably necessary to protect someone's rights, safety or security. That never permits a use of patient information beyond our agreements and the law. If Fieldstone is merged or sold, information may pass to the new owner only as the law and our existing commitments allow, and patient information only as our agreements allow.

8. How long we keep information

9. How we protect information

• Every connection to our services is encrypted (HTTPS). Secure email delivery, and each organization's responsibility for its own systems, are covered in our agreements with customers.
• Patient answers and files are encrypted before they're stored, with a key unique to each customer that is itself protected in a separate key-management service.
• Each customer's records are kept apart by our application and by controls in the database, which we test.
• Staff sign in with a password and a second step, or with a passkey. A device you choose to trust can skip the second step for up to 30 days.
• Every view and download of a patient submission is recorded, including by our own staff and contractor and any emergency access; our application can't decrypt a submission without recording who asked.
• Our current service stores patient information in U.S. data centers, run by providers covered by business associate agreements.

No system is perfectly secure. If a breach requires notice, we'll meet the duties that apply to us. For information we process for an organization, we report incidents to it as our agreement and the law require, and help it give any notices it must give. Our Security page describes more of the protections in our current service.

10. Your choices and rights

• See, correct or delete your information. Email us at hello@secure-form.com. We'll respond within 30 days, or sooner if the law requires; if the law allows more time and we need it, we'll tell you within that period. We may need to confirm your identity, and we may keep information the law requires us to keep. For information we hold for an organization, we'll help that organization respond.
• People who fill in customer forms. Contact the organization that asked you to fill in the form (section 2).
• Staff accounts. Your organization's administrator can update or deactivate your account.
• Email. We don't send marketing email. Service emails, such as sign-in codes, continue while you have an account.
• Other rights. Depending on where you live and our role, you may have other rights, such as to get a copy in a portable format, withdraw consent, appeal a refusal or complain to a regulator. Contact us and we'll explain how. We won't treat you differently for using your privacy rights.

11. Children

Our business websites and account administration are intended for adults. Patient forms may contain information about children submitted by a parent, guardian, or another authorized adult on behalf of a healthcare organization. Forms concerning children under 13 are intended to be completed by an authorized adult.

If we learn that we collected personal information directly from a child under 13 without any required parental consent, we restrict further use and work promptly with the requesting organization to address applicable notice, consent, and deletion requirements. Please contact us at hello@secure-form.com if you believe this has occurred.

Access to a child's healthcare information remains subject to applicable healthcare privacy and consent laws.

12. Outside the United States

Our services are meant for U.S. organizations, and our current service stores patient information in the United States. If you send us information from another country, it may be transferred to the United States. If your local law gives you rights over your information, contact us.

13. Changes to this policy

We'll post any update here with a new effective date. For a material change, we'll also email our customers at least 30 days before it takes effect, and give other affected users notice where appropriate. We'll ask for consent first where the law requires it. An update won't let us use information we already hold in ways the earlier version didn't allow, and it never changes a Business Associate Agreement.

14. Contact us

Fieldstone Health, LLC · 14 Algonquian Drive, Natick, MA 01760 · hello@secure-form.com · 617-237-0220

To report a security concern or a vulnerability in any of our websites or services, email security@fieldstone-health.com or call 617-237-0220.