Privacy Policy
Last Updated on October 25, 2026.
1. Who we are
This Privacy Policy explains how CredAlt Corporation, a Delaware corporation doing business as Lanyard Health, based in Houston, Texas (“Lanyard Health,” “we,” “us,” or “our”), handles personal information. It covers our website at https://lanyardhealth.com, the Lanyard Health platform at https://portal.lanyardhealth.com, and the credentialing and enrollment services we provide (together, the “Services”).
Our customers are healthcare practices. This policy describes our practices for the people whose information we handle: people who use the platform on behalf of a practice, the providers whose credentialing information a practice manages with us, and visitors to our website.
2. Two roles we play
For our customers. When a practice uses the Services, it decides what information to load about its providers, owners and staff, and we process that information on the practice’s behalf and under its instructions. Our contract with the practice (our Terms of Service and Business Associate Agreement) governs that information. If you are a provider or staff member and want to access, correct or delete information a practice holds about you in Lanyard Health, please contact that practice first. We will help them respond.
For ourselves. We decide how to handle information about our website visitors, our business contacts (for example, people who fill out our contact form), and the account details we need to run and secure the platform.
Where information is protected health information under HIPAA, our Business Associate Agreement with the practice controls. If this policy and that agreement conflict, the agreement wins.
3. Information we collect
Information practices and providers give us
Depending on how a practice uses the Services, this can include:
• Identity and contact details: name, former names, email, phone, home and practice addresses, date of birth, gender, languages spoken.
• Government and tax identifiers: Social Security number, taxpayer identification numbers, and DEA and state controlled-substance registration numbers.
• Professional background: NPI, specialties, state licenses, board certifications, education and training, work history, hospital affiliations, professional references, and covering colleagues.
• Background disclosures: malpractice insurance, malpractice claims history, disciplinary actions, and answers to credentialing attestation questions. Claims history can include limited details about a patient that are part of the claim record, such as age, gender and a description of the alleged injury. We do not otherwise collect patient records.
• Demographic information that payers ask for in enrollment applications, such as race, ethnicity, place of birth and citizenship status.
• Banking details needed for payer electronic funds transfer enrollment, such as bank name, account holder, routing number and account number.
• Sign-in details for credentialing systems, such as CAQH ProView and payer portal credentials, when a practice asks us to work in those systems for it.
• Documents such as licenses, certificates, photo identification, W-9 forms and voided checks.
• Practice ownership details: owners’ names, Social Security numbers, dates of birth, home addresses and ownership percentages, when a payer application requires them.
Information about platform users
For people who sign in to the platform, we collect name, email, phone, role, sign-in and multi-factor authentication settings, and a record of actions taken in the platform, including IP address, browser type and time. When a practice administrator accepts our Terms of Service and Business Associate Agreement, we record who accepted, which versions, when, and from which IP address and browser.
When someone signs a document through the platform, we record their name, signature, email, the verification steps they completed, and the time, IP address and browser used, so the signed document can be proven authentic.
Text messages and calls
If you turn on text updates in Settings, we collect:
• the mobile number you give us;
• when you confirmed it;
• which version of the texting consent you agreed to, and when;
• your STOP and START choices; and
• the texts we send you and the texts you send us.
If you text or call our status line, we record:
• the number you used;
• the time; and
• what you texted, or the menu option you pressed on a call.
This applies even if you don’t have an account. We do not record calls.
Billing information
For our customers, we keep billing contact details and invoice history. Payments are handled by our payment processor; we do not store full card or bank numbers used to pay us.
Information from other sources
At a practice’s direction, we collect information from:
• CAQH ProView, to import and update provider profiles and documents.
• Public registries, such as the national NPI registry (NPPES) and Medicare enrollment data published by CMS, to check identifiers and enrollment status.
• Health plans and payer portals, such as application status and effective dates.
For our own sales and marketing, we may also collect business contact details (such as name, job title, work email and practice name) about people at healthcare organizations from commercial business-contact databases such as Apollo and professional networking sites such as LinkedIn.
Information from our website
• Contact form and chat: what you send us, such as your name, work email, phone, practice name and message. Our website chat is provided by Crisp.
• Meeting booking: if you book a call, the scheduling tool collects your name, email and chosen time.
• Usage data: pages visited, referring site, approximate location based on IP address, device and browser type, collected through the tools described in Section 7.
4. How we use information
We use information to:
• provide the Services a practice asks for, including preparing and submitting credentialing and enrollment applications to CAQH and health plans, tracking their status, and sending reminders about expiring credentials;
• create and secure accounts, verify identity at sign-in, and prevent fraud and misuse;
• send service messages, such as invitations, sign-in codes, reminders, alerts and weekly summaries;
• send the credentialing text updates you asked for, and answer texts and calls to our status line. We never use mobile numbers for marketing;
• provide support and respond to questions;
• tell people at healthcare organizations about our Services, which you can opt out of at any time;
• understand how our website and platform are used so we can fix problems and improve them;
• comply with law, enforce our agreements, and protect our rights and the safety of others.
No AI training. No sale. We do not use customer information to train, fine-tune or evaluate any artificial intelligence or machine-learning model, and we do not send it to third-party AI providers. We do not sell personal information, and we never use customer information for advertising. Our website uses Google advertising tools to measure our own ads, as described in Section 7.
5. How we share information
We share information only as described here: • At a practice’s direction: with health plans, CAQH, credentialing organizations and similar recipients, to complete the credentialing and enrollment work the practice asks for. • With a practice’s own systems: if a practice connects its systems to Lanyard Health, we send the event notifications it sets up, such as enrollment status changes. • With service providers that help us run the Services, under contracts that limit their use of the information to serving us. These include cloud hosting and databases, document storage, sign-in and authentication, email delivery, error monitoring (with sensitive fields removed before reports are sent), website hosting and analytics, website chat, and meeting scheduling. • For legal reasons: when required by law, subpoena or court order, or when needed to protect rights, property or safety. • In a business transfer: as part of a merger, acquisition or sale of assets, subject to this policy.
Text messaging. We do not share mobile information with third parties or affiliates for marketing or promotional purposes. The only company that receives your mobile number and messages is the provider that delivers our texts and calls, and it does so only on our behalf. All the above categories exclude text messaging originator opt-in data and consent; this information won’t be shared with any third parties.
6. Security
We protect information with administrative, technical and physical safeguards, including: • encryption in transit and at rest; • an additional layer of encryption for the most sensitive fields, including Social Security numbers, dates of birth, DEA and controlled-substance numbers, tax identification numbers, bank account and routing numbers, and saved sign-in credentials for credentialing systems; • multi-factor authentication, which platform users must set up after a short grace period; • access limited by role, with actions recorded in an audit log; and • links for invitations, e-signatures and document downloads that expire. No system is perfectly secure. If we learn of a security incident affecting information we hold for a practice, we will notify the practice as our agreement with it requires.
7. Cookies, browser storage and analytics
The platform uses browser storage to keep you signed in and to remember your preferences. It does not use advertising or analytics trackers. It sends error reports to our error-monitoring provider, with sensitive fields removed first. Our website uses: • Google Analytics and Framer’s analytics to measure visits and page performance; • Google Ads conversion measurement on our contact page, to learn whether our ads lead to inquiries; • Crisp for website chat; and • Apollo’s website visitor tool, which uses your IP address to identify the company you may be visiting from, so we can reach out to organizations that seem interested in our Services. We do not use it to identify you personally. These tools may set cookies or similar technologies. You can block or delete cookies in your browser settings, install the Google Analytics opt-out browser add-on (https://tools.google.com/dlpage/gaoptout), and manage Google ad personalization at https://adssettings.google.com. Our website does not currently respond to “Do Not Track” signals.
8. How long we keep information
• Customer information: for as long as the practice’s account is active. After an account ends, the practice can request an export within 30 days, and we return or delete its information within 60 days, as described in our Terms of Service and Business Associate Agreement. Backup copies are deleted on our regular backup cycle. • Records we must keep: we keep security audit logs and completed e-signature evidence for at least seven years, or longer where the law requires, to protect the integrity of those records. They stay protected under this policy and our agreements. • A single provider’s record: when a practice asks us to delete one provider, we do so within 30 days of the request, subject to the same exceptions. • System and error logs: about 90 days. • Website and business contact information: for as long as needed for the purpose we collected it, then deleted.
9. Your choices and rights
You can ask us to: • give you a copy of your personal information; • correct information that is wrong or incomplete; or • delete your information, subject to legal limits and our obligations to our customers. You can opt out of marketing emails, and of optional alert and summary emails, using the unsubscribe link in them or by emailing us. You can stop text updates at any time by replying STOP to any text from us, or by turning them off in Settings. We will still send messages needed to run your account, such as sign-in codes and security notices. If your information was provided by a practice, we will refer your request to that practice or handle it on their instructions. To make a request, email privacy@lanyardhealth.com. We will verify your identity, usually by confirming the email address we have for you, and respond within 30 days. Depending on where you live, you may have additional rights under state law, and we will honor them where they apply.
10. Children
The Services are for healthcare businesses and professionals. They are not directed to children, and we do not knowingly collect information from anyone under 18.
11. Where information is stored
We operate from the United States, and we store and process platform and customer information in the United States. Some tools on our public website, such as our chat provider, may process website chat and visit data outside the United States.
12. Changes to this policy
We may update this policy. We will post the new version here with a new date and, for material changes, notify practice account administrators by email or in the platform.
13. Contact us
Questions or requests: privacy@lanyardhealth.com CredAlt Corporation d/b/a Lanyard Health 1207 Delaware Ave #1941 Wilmington, DE 19806