Privacy
Last updated 13 October 2026.
This page explains what MSP Billing Sentinel ("we", "us"; Bradford Lumley, doing business as ref(health) consulting, Tennessee, USA) collects, why, who else handles it, and your choices. We are the controller of your account data. For the personal data inside files you upload (such as your technicians' and clients' names), you decide what we receive and we act as your processor, using it only on your instructions. If you need a data processing agreement, email us and we will provide one.
What we collect, why, and for how long
| Data | Why | Kept |
|---|---|---|
| Email address, company name, salted password hash | Run your account and log you in (we cannot read your password) | Until the account is deleted |
| Your uploaded CSV files | Run the audit | Not kept after the audit finishes |
| Latest audit result: client names, ticket numbers, work summaries, technician names, amounts | Let you export CSV, draft invoices and reports | 7 days, then deleted; each new audit replaces the last |
| Audit history: date, total unbilled amount, client label | Show your past audits | Until the account is deleted |
| Client names you add (Agency) | File audits under a client | Until the account is deleted |
| Subscription status and Stripe customer ID | Give you the plan you paid for | While you are a customer, then as tax and accounting law requires |
| Single-use tokens for email confirmation and password reset (stored as hashes) | Confirm your address and let you reset your password | Until used or expired (48 hours / 60 minutes) |
| Usage events (counts and codes such as "audit run" or "upload rejected"; no file contents) and a log of our own administrative actions | Run, secure and support the service | Kept; unlinked from you when you delete your account |
| Session cookie | Keep you logged in | 30 days, or until you log out |
| Sign-in and reset-request counts by IP address | Stop password guessing and abuse | In memory only, about an hour |
Uploads may contain personal data of other people (for example technician names and your clients' contacts or company names). We use it only to run the audit for you. Our host and network providers may also keep standard request logs (IP address, time, page) for security and operations.
We use one cookie, the session cookie above, which is strictly necessary to log in. We use no advertising or analytics cookies and no tracking. We do not sell or share personal data for advertising. We send only transactional email (address confirmation and password reset), never marketing.
Why we may process it (UK and EU users)
To provide the service you asked for (contract); to keep it secure and prevent abuse (our legitimate interest); and to meet tax and accounting duties (legal obligation).
Who else handles it
- Cloudflare: hosts the service, stores encrypted-in-transit database backups (R2), and sends our emails.
- Stripe: processes payments. Card details go to Stripe and not to us. Stripe is responsible for its own use of payment data under its privacy policy.
These providers may process data in the United States and other countries. Where required, transfers rely on the providers' standard contractual clauses or equivalent safeguards. We disclose data to anyone else only if the law requires it.
Backups and security
The database is replicated continuously to Cloudflare R2. Data we delete can remain in those backups for up to about a day. Connections use HTTPS, passwords are stored only as salted hashes, and access to the system is limited to what operating it needs. No system is perfectly secure; if a breach affects your data we will tell you as the law requires.
Your rights
You can ask us to access, correct, export or delete your personal data, or to restrict or object to how we use it. Account deletion removes your account, audit history, client names and any saved audit result. We answer within 30 days. If you are in the UK or EU you may complain to your data protection authority. We do not discriminate against anyone for using these rights. California residents have the same access and deletion rights under the CCPA; we do not sell or share personal information.
Regulated and sensitive data
The service is not designed for patient or other regulated health information, payment card numbers, or government identifiers. Remove it from files before uploading. We do not sign business associate agreements.
Children
The service is for businesses and is not directed to anyone under 18.
Changes
We will update this page if our practices change and email account holders about significant changes.
Contact
Questions or requests: sentinel@refhealth.consulting.