Privacy Policy
FreeSRA.com is a free healthcare security risk assessment operated by Secvara. This policy covers the public site at https://freesra.com/ and the assessment application at https://app.freesra.com/ (together, the "Service").
The Service helps an organization answer a structured set of security questions, mapped to NIST CSF and, when selected, HIPAA, PCI DSS, and SOC 2, and see a summary of the result. It is an informational assessment. It is not legal advice and it does not certify compliance.
Google user data. If you sign in with Google, FreeSRA receives your name, email address, profile picture, and Google account identifier. We use that data only to create your account, keep you signed in, save your assessment, and decide whether your email is allowed to edit questions. We do not sell Google user data, use it for advertising, or use it to train generalized models. We share it only with the infrastructure that hosts the Service, when you ask us to, or when the law requires it.
Information we collect
- Google account data, when you choose Sign in with Google: name, email address, profile picture URL, and the Google account identifier.
- Assessment information you submit, such as organization type, workforce size, the frameworks you select, your answers, and the score we calculate from those answers.
- Contact details you choose to give us if you ask Secvara to follow up about the result.
- Technical data such as IP address, browser type, and pages requested, in ordinary server logs.
- A session cookie that keeps you signed in. It is an HttpOnly cookie set by the application. It is not used for advertising.
Do not enter patient names, medical record numbers, clinical notes, or other protected health information into the assessment. The questions do not ask for it.
The marketing site may load Google Tag Manager to measure visits and button clicks. That tag does not receive your assessment answers.
How we use information
- To sign you in and recognize your account when you return.
- To save and resume an assessment and show the result.
- To let an email on our editor list change questions and assessment rules. Editor status is based on the email address from Google.
- To respond if you ask Secvara to contact you about the result.
- To keep the Service secure, debug failures, and meet legal duties.
We do not use Google user data for any purpose that this policy does not describe.
How we share information
We do not sell personal information. We do not share Google user data with advertisers or data brokers.
We use service providers that host the website, the application, and its database. They process information only so we can run the Service. Cloudflare serves freesra.com. The application database is operated for FreeSRA and is not a public marketing list.
We may disclose information if a law, court order, or government request requires it, or to investigate abuse of the Service. If Secvara is sold or merges, the successor will be required to honor this policy or to ask for your consent before using the information differently.
How long we keep it
We keep account and assessment records while the account exists and you are using the Service. Server logs are kept only as long as needed for security and troubleshooting. If you email [email protected] and ask us to delete your account, we will delete the Google profile fields we stored, the session, and the assessment records tied to that account, unless we must keep a specific record to comply with law.
Your choices
You can stop using Google sign-in at any time, and you can revoke FreeSRA's access from your Google Account permissions. You can ask us for a copy of the account and assessment data we hold, ask us to correct it, or ask us to delete it, by emailing [email protected]. You can also reject non-essential cookies in your browser. The sign-in cookie is required to stay signed in.
Security
We use HTTPS for the public site and the application, and we restrict access to the database. No online service can guarantee perfect security.
Children
The Service is for organizations and their staff. We do not knowingly collect personal information from children under 16. Contact us if you believe a child has given us information and we will delete it.
Changes
If we change this policy, we will post the new version at https://freesra.com/privacy/ and change the effective date. Continued use of the Service after that date means you accept the updated policy.
Contact
Secvara, operator of FreeSRA.com
Email: [email protected]