Privacy Policy

What We Collect

Site visitors: This site uses Plausible Analytics, a privacy-focused analytics tool that collects no personal data, uses no cookies, and does not track individuals across sites. We see aggregate page views and referral sources. We do not see who you are.

Contact form submissions: When you submit your email through our contact form, that information is stored securely. We use it to respond to your inquiry. We do not sell, share, or distribute your contact information.

Portal accounts: The Crescent Navigator Portal uses encrypted authentication and role-based data storage. We store your email address and role assignment. Portal data is transmitted over HTTPS and stored with row-level security policies that restrict access by role.

Member Clinical Data

If you are a member receiving services through Crescent, your clinical information — including screening results (such as the Edinburgh Postnatal Depression Scale), care navigation records, and outcome data — is protected under HIPAA. Crescent operates as a Business Associate of your employer's health plan.

• Your employer never sees your individual clinical data.
• Your employer receives only aggregate, de-identified outcome reports.
• You are not individually identifiable in any report shared with your employer, their broker, or their stop-loss carrier.
• Your navigator has access to your information solely to coordinate your care.
• Administrative users see aggregate data and utilization trends only.

Role-Based Access

The Crescent portal enforces role-based access controls:

• Members see only their own screenings, care plans, and navigator communications.
• Navigators see member data only for individuals assigned to their caseload.
• Employers see aggregate program metrics. They never see individual member data.
• Administrators manage configuration and view system-level analytics.

What We Don't Do

• We do not sell personal data.
• We do not use tracking cookies.
• We do not use tracking pixels.
• We do not share member data with advertising platforms.
• We do not retain clinical data beyond the period necessary for care coordination and outcome measurement.

Data Security

All data is transmitted over TLS/HTTPS. Authentication is managed with encrypted credential storage and magic-link sign-in. Clinical and personal data is stored with row-level security policies, ensuring that each user can access only the data appropriate to their role.

Your Rights

You may request access to, correction of, or deletion of your personal data at any time by contacting us at joe.nalley@showyourwork.health.

Contact

Questions about this policy: joe.nalley@showyourwork.health