This policy explains how Apex Clinical Group LLC ("we," "us") handles information in the GoodStanding for Agencies dashboard at app.goodstanding.health. It covers agency admins and the staff who connect to an agency. How the free GoodStanding app handles a provider's own information is covered by the GoodStanding app privacy policy; both policies apply together.
| Information | Where it comes from |
|---|---|
| Admin accounts: name, email, role, invites | Agency admins |
| Agency details, join codes, access requests | Agency admins and people requesting access |
| Policies, policy PDFs, versions, protocol books | Agency admins |
| Policy and protocol signatures, with date and version | Connected staff, when they sign in the app |
| Staff name, title and email, and the date they connected | Connected staff's GoodStanding profile |
| Credential name, category, issuer, issue and expiration dates | Connected staff's GoodStanding records |
| Credential numbers | License numbers, so the agency can verify the license with the state board. Other credential numbers only if the staff member chose to share them |
| Exclusion-screening log and OIG check results | Agency admins and the automatic OIG check |
Document photos of a staff member's credentials stay private to that staff member and are not shown in the dashboard. We ask agencies not to upload patient information; the dashboard is not designed to hold it.
Only to run the dashboard: showing each agency its own roster, credential status, policies and signatures; keeping its exclusion log; building its surveyor packet; and securing accounts. We do not sell personal information, use it for advertising, or share one agency's information with another.
When an agency runs the OIG check, or when it runs automatically each month, the names of that agency's connected staff are compared against the public HHS-OIG exclusion list on our own servers. Staff names are not sent to HHS-OIG or anyone else; we download the public list and do the comparison ourselves. The results are saved only to that agency's exclusion log. A name match is not a confirmed exclusion; see the Terms of Service.
These providers process information only to deliver their service to us.
Every request is checked against database row-level security rules, so admins can reach only their own agency's records. Uploaded files are stored privately and opened through short-lived signed links. Admin access is invite-only, and new agencies require approval.
We keep an agency's information while it uses the dashboard. An agency can delete policies, protocols, codes and log entries itself at any time, and can ask us to close the dashboard and delete everything by emailing info@apexclinicalgroup.com. A staff member who deletes their GoodStanding account is removed from every agency roster.
Staff can see and change what they share from the app. Anyone can ask us what information we hold about them, or ask us to correct or delete it, at info@apexclinicalgroup.com. Where a request concerns an agency's records (for example a signature), we may refer it to that agency.
If we change this policy in a meaningful way, we will update the date above and tell agency admins in the dashboard or by email.
Apex Clinical Group LLC · College Station, Texas · info@apexclinicalgroup.com · (979) 422-8510