Privacy Policy - Health Response Hub

Last updated: May 2026 — Effective immediately upon registration.

1. Who We Are

Health Response Alliance ("HRA," "we," "us," or "our") operates the Health Response Hub at healthresponse.us. HRA is a nonprofit organization based in Falls Church, Virginia, focused on strengthening healthcare infrastructure resilience during public health emergencies.

2. Information We Collect

We collect only the information necessary to operate the Platform and facilitate disaster response activities:

Organizational information: facility or organization name, type, EIN, NPI (if applicable), address, county, state, and website.
Contact information: name, email address, phone number, and WhatsApp number of authorized representatives.
Account credentials: email address and hashed password (we never store plaintext passwords).
Operational data: resource requests, facility status reports, partner claims, and available resource postings submitted through the Platform.
Usage data: login timestamps, IP address, and browser information collected for security auditing purposes.

We do not collect, store, or process any patient data, protected health information (PHI), or personally identifiable information about patients.

3. How We Use Your Information

Information collected through the Platform is used exclusively to:

Verify organizational eligibility and approve Platform access;
Enable authorized facilities to submit resource requests and status reports;
Enable authorized partner organizations to view and respond to resource needs;
Notify relevant parties of requests, claims, and status changes;
Maintain security audit logs;
Improve Platform functionality and reliability.

We do not sell, rent, or share your information with third parties for marketing or commercial purposes.

4. Information Sharing

Organizational contact information and resource data may be visible to other authorized Platform users (e.g., partner organizations may see facility names and request details; HRA administrators have access to all organizational information). This sharing is inherent to the Platform's purpose and is limited to approved users only.

We may share information with government partners (e.g., ESF-8 coordinators, state health departments) in their official emergency response capacity, and as required by applicable law.

5. Data Security

We implement reasonable technical safeguards including encrypted HTTPS connections, hashed password storage (bcrypt), session-based authentication, and access logging. However, no system is completely secure. We encourage users to use strong, unique passwords and to report any suspected security incidents to HRA immediately.

6. Data Retention

We retain organizational and operational data for a minimum of five years following the conclusion of each declared emergency incident to support after-action review, grant reporting, and accountability requirements. Account data is retained for the duration of organizational participation in the Platform.

7. Your Rights

Authorized representatives may request correction of inaccurate organizational information by contacting HRA. Requests to remove an organization from the Platform may be submitted to HRA; removal is subject to operational necessity and data retention obligations.

8. Cookies

The Platform uses session cookies to maintain authenticated user sessions. These cookies are strictly necessary for Platform operation and are deleted when you close your browser or sign out. We do not use tracking cookies or third-party analytics cookies.

9. Changes to This Policy

HRA may update this Privacy Policy from time to time. Material changes will be communicated to registered users by email. Continued use of the Platform following notice of changes constitutes acceptance.

10. Contact Us

Questions about this Privacy Policy may be directed to:
Health Response Alliance
Falls Church, Virginia
[email protected]