Credentialing Workspace Privacy Notice
Effective 2026-10-02 · how the Ultra Credentialing workspace handles account and credentialing-service data.
Data processed in the workspace
The service can process account details, practice/client information, provider credentialing records, payer-enrollment workflow data, tasks, audit/security events, communication metadata and private credential evidence uploaded by authorized users.
Purpose
Workspace data is used to provide credentialing workflow functions, secure access, billing, support, delivery of requested communications, backups/exports, operational diagnostics and features explicitly enabled by the customer.
Data minimization
The workspace is designed for provider credentialing administration, not patient care. Customers are instructed not to enter patient information, SSNs, payer passwords, tax IDs, bank details or clinical records.
Private files
Where credential uploads are enabled, Ultra requires private storage outside the public WordPress web root and serves files through authorized application paths rather than public Media Library URLs.
External processors
Payment processing may use Stripe. Transactional email may use the configured email provider. Optional AI Assistant and document-extraction features use a separately configured external AI provider and require explicit workspace opt-in before customer credentialing context or selected document files are processed.
Public-source assistance
NPI Registry assistance retrieves public NPPES information for human review. Imported public-source values are recorded as assistance/provenance and are not treated as credential verification.
Retention and deletion
Authorized workspace administrators can configure supported audit/security/communication retention and use preservation controls. Account/workspace deletion and data-export workflows are subject to authorization and operational safeguards. Customers should align retention settings with their approved organizational policy.
Security and access
The service includes role/client/location scoping, two-step verification, session controls, audit history, private-file access logging and security-event records. No security control eliminates all risk; customers remain responsible for appropriate user administration and endpoint security.
Support access
When authorized support access is used, Ultra creates a short-lived audited support session rather than obtaining a customer's password or two-step code. Support tickets and credentialing exports are kept as separate data domains.
Your organization’s responsibilities
Customers determine what credentialing information they are authorized to collect, the lawful basis and notices required for their use, retention periods, user permissions and any contractual or regulatory obligations applicable to them.
Contact
Privacy questions can be sent to sale@ultramedicalsolutions.com. Service contact: Ultra Medical Solutions · sale@ultramedicalsolutions.com.