How we collect, use, disclose, protect, and retain individually identifiable information — and the rights available to individuals under the Trusted Exchange Framework and Common Agreement (TEFCA).
RecordsFlow (“we,” “our,” “us”) provides Individual Access Services (IAS) that allow individuals to securely access their individually identifiable information (“III”). This notice explains how we collect, use, disclose, protect, and retain III, and describes the rights available to individuals under TEFCA.
This notice is publicly available at recordsflow.com/rf-privacy-and-security-notification.
We keep this notice publicly accessible and current at all times. We will:
We provide this notice before an individual first uses RecordsFlow IAS. It is written in plain language and available electronically. Individuals may contact us with questions at privacy@recordsflow.com.
RecordsFlow does not provide bidirectional services. You have the ability to request access to your health information via TEFCA exchange. You will not be able to use RecordsFlow to share your health information with other participants in TEFCA.
III is accessed, used, and disclosed only for exchange purposes permitted under the TEFCA Common Agreement and applicable law. RecordsFlow will act in accordance with its then-current privacy and security policy.
RecordsFlow does not use, analyze, or disclose your III obtained via TEFCA for any marketing, cross-contextual behavioral advertising, or promotional purposes. We strictly prohibit the use of your health profiles, conditions, prescription histories, or diagnostic data to serve targeted advertisements, sponsored recommendations, or marketing communications within or outside of our platform.
RecordsFlow complies with HIPAA requirements to the extent applicable to its activities and services. Where RecordsFlow participates in treatment-based exchange, applicable network data sharing agreements and associated flow-down requirements govern the exchange relationships with participating provider organizations. RecordsFlow does not require a Business Associate Agreement with provider organizations solely as a condition of treatment-based exchange where such agreement is not required under applicable law or the applicable network framework.
We do not access, use, exchange, or disclose III to assert any claim against an individual, except for the collection of fees owed.
We disclose III only to service providers who support our IAS operations:
We require applicable service providers, vendors, subcontractors, and other third parties that support our IAS operations and have access to III to maintain appropriate privacy and security safeguards, and to use and disclose III only for the purposes authorized by RecordsFlow and applicable agreements and law.
We do not sell III or receive remuneration for III. RecordsFlow collects, accesses, uses, exchanges, and discloses only the minimum necessary III required to fulfill the permitted purposes described in this notice. Broad or unrestricted data sharing is strictly prohibited.
We retain III for 18 months unless a longer period is required by law.
We use III only for:
We do not de-identify III.
We may disclose III relating to reproductive health or gender-affirming care only when required by a valid subpoena, warrant, or other compulsory legal demand, unless prohibited from notifying the individual.
If we receive a compulsory legal demand for III, we will notify affected individuals within three business days unless prohibited by law. Compliance will be limited to the minimum necessary disclosure.
We use commercially reasonable efforts to protect III from unauthorized access, modification, use, or destruction. Our security practices include:
Individuals may contact us with questions or privacy-related complaints by email at privacy@recordsflow.com, by phone at 503.400.6877, or by mail at PO Box 117, West Linn, OR 97068. We maintain a process for documenting privacy-related complaints and our responses.
We obtain express written and informed consent before accessing, exchanging, using, or disclosing III, except where required by law. Our consent process includes:
Individuals may revoke their consent at any time within the RecordsFlow application. Step-by-step instructions for revoking consent are provided within the application. Upon revocation, RecordsFlow will cease accessing, using, exchanging, or disclosing III based on that consent, except as otherwise permitted or required by applicable law. Revocation does not invalidate actions taken before the revocation became effective.
Individuals have the right to:
We provide clear instructions for exercising rights and implement choices within seven business days. We are not aware of any applicable law that prevents us from honoring deletion requests.
RecordsFlow does not charge individuals directly for IAS. Fees are billed to our customers, who may choose to pass costs to their end users at their sole discretion.
Effective date: May 1, 2026. Version format: date stamp plus revision number (for example, 2026 05 01 Rev1).
Published 10 April 2026 · RecordsFlow