Privacy Policy

01Who this covers

This policy applies to mrwebsolutionstx.com, the RouteFlow program at /routeflow, and any forms, intakes, or email you send us through those sites. It's written by MR Web Solutions TX, a web design and software business based in Prosper, Texas.

It does not cover websites we build for clients. Those are the client's own properties with their own policies.

02What we collect

“Personal information” in this policy means information that identifies, relates to, or could reasonably be linked with you — for example, your name, email address, account credentials, the documents and progress data described below, and technical identifiers like your IP address. Here's what we actually collect:

Information you give us

• Account details — your email address, a password, and the name you choose to display. Passwords are hashed by our authentication provider; we never see them.
• Program progress — which checklist items you've completed, which phases you've unlocked, and the issue dates you enter for certificates so the compliance calendar can tell you when they expire.
• Documents — files you upload to satisfy a phase gate. Covered separately in Section 3.
• Messages — anything you send through a contact or intake form, or by email.
• Order details — if you buy a lead batch, the city and radius you ask for.

Information collected automatically

• Basic technical data — IP address, browser type, device type, pages viewed, and the page that referred you. This is ordinary web server and analytics data.
• Session data — a token that keeps you signed in.

What we don't collect

We do not collect your Social Security number, driver's license number, bank account details, or payment card numbers. If you pay for a membership or a lead batch, our payment processor handles the card and we receive only a confirmation, the amount, and the last four digits.

03Documents you upload

RouteFlow gates certain phases behind proof — an insurance declaration page, a HIPAA or OSHA certificate, a DOT hazmat certificate, a completed route log. Here is exactly what happens to those files.

• They go to private storage. The storage container is not public and has no browsable address. Files are filed under your account identifier.
• Only you can open them. Access is enforced at the database level, keyed to your account. Another member cannot retrieve your file even with the exact path — the request is refused regardless of what it asks for.
• Links expire. When you open one of your own documents, the system generates a link that stops working after 60 seconds.
• Deletion is real. When you remove a document, it is deleted from storage, not hidden from your view.
• We may review them. To confirm a phase gate is genuinely met, an authorized reviewer at MR Web Solutions TX may open a document you've submitted, solely for that purpose. We do not currently maintain automated logging of that access; we are evaluating adding it. We do not read your documents for any other purpose.
• Confirming what's in them. Before a document reaches us, you'll be asked to confirm that it does not contain patient names, specimen or requisition information, or other client health data. See Section 4.

Documents are stored on infrastructure operated by Supabase, encrypted in transit and at rest. We never publish them, index them, or provide them to courier companies, insurers, lead buyers, or anyone else.

04Protected health information

Do not upload patient information to RouteFlow. That includes specimen manifests, requisition forms, chain-of-custody paperwork naming a patient, delivery logs containing patient identifiers, or anything else taken from a client's records. As described in Section 3, you'll be asked to confirm this at the point of upload.

RouteFlow is an educational and compliance-tracking program. MR Web Solutions TX is not a covered entity or a business associate under HIPAA with respect to your courier clients, and we have no business associate agreement with them. Material of that kind belongs on your client's systems under their own agreements.

If you upload it anyway, you are responsible for that disclosure. Tell us at michael@mrwebsolutionstx.com and we will delete it.

05How we use your information

• To create and maintain your account and keep you signed in
• To save your progress so it follows you between devices
• To decide whether a phase gate is satisfied
• To calculate renewal dates from the certificates you upload, and build the calendar file you download
• To deliver and support anything you've purchased
• To answer messages you send us
• To understand which pages are useful, in aggregate
• To meet legal obligations and enforce our Terms

Your data belongs to you. You own the documents and progress data you provide to RouteFlow. We don't acquire any rights to it beyond what's needed to operate the service for you, and we don't use it for any purpose beyond what's described in this policy.

We may use de-identified or aggregated information — for example, how many members complete a given checklist step, or overall usage trends — for product analytics and to improve RouteFlow. When we do, we take reasonable steps to ensure it can't be re-identified or tied back to you.

We do not use your documents or progress data to train machine learning models, and we do not build advertising profiles from them.

06Who we share it with

We do not sell your personal information. We share it only with service providers that make the product work, and only as much as each one needs:

• Supabase — authentication, database, and document storage
• Square — subscription and one-off payments, when you buy something. Card details go to them directly and never touch our servers.
• Resend — account email and replies to messages you send us
• Vercel and Cloudflare — hosting and content delivery for the site
• Vercel Analytics — counting page views
• Google Fonts — typefaces are requested from Google's servers when you load a page, which lets Google see your IP address

This is the complete list of companies we share personal information with to make RouteFlow work. If we add a new service provider that will receive personal information, we'll update this list and email account holders before the change takes effect, the same way we do for other material changes (Section 12).

We do not sell or share personal information, as those terms are defined under California law. We don't use advertising or remarketing tools that would trigger “sharing” status, and we don't run third-party ad trackers (see Section 7).

We may also disclose information if we're legally required to, or to protect our rights or someone's safety. If the business is ever sold or merged, your information may transfer with it — we'd tell you before that happened.

07Cookies and tracking

We use cookies and browser storage for two things: keeping you signed in, and holding your RouteFlow progress locally so the app works smoothly. We may also use privacy-respecting analytics to count visits.

We do not run third-party advertising trackers or sell data to ad networks. Blocking cookies is fine for reading the site, but it will stop you staying signed in to RouteFlow.

08How long we keep it

• Account and progress data — until you delete your account
• Uploaded documents — until you delete them, or you delete your account
• Messages you send us — up to three years, so we can pick up an old thread
• Payment records — as long as tax and accounting law requires, generally seven years
• Server logs — typically 30 to 90 days
• Inactive accounts — accounts and documents inactive for more than 24 months may be flagged for review; we'll email you before taking any action

Our infrastructure providers keep routine, transient backups so that a technical failure doesn't mean losing your work. These rotate out over time in the ordinary course.

When you delete your account we remove your progress and your documents from our active systems. Residual copies may remain briefly in those routine backups before they rotate out and are purged.

09Your choices and rights

Whether or not a particular privacy statute applies to a business our size, we'll honor these requests from anyone who asks:

• See it — ask for a copy of what we hold about you
• Fix it — correct anything inaccurate
• Delete it — remove your documents, or your entire account
• Take it — get your data in a portable format
• Stop the email — unsubscribe from any updates at any time. We'll still send essential account messages, like a password reset.

Email michael@mrwebsolutionstx.com and we'll respond within 45 days. We may need to confirm your identity first, which usually means replying from the address on the account.

10Security

Traffic is encrypted with TLS. Documents are encrypted at rest, and access is enforced per account at the database level rather than only in the interface. Passwords are hashed. An authorized reviewer may open a submitted document solely to confirm a phase gate is met; we do not currently log that access automatically, though we're evaluating adding it (see Section 3). We also keep the routine backups described in Section 8.

If we experience a breach involving your personal information, we'll notify affected individuals without unreasonable delay, consistent with the Texas Identity Theft Enforcement and Protection Act, and in any case no later than 60 days after we determine a breach occurred. If a breach affects 250 or more Texas residents, we'll also notify the Texas Attorney General within 30 days, as Texas law requires.

RouteFlow is operated from the United States, and the data described in this policy is stored and processed in the United States (via Supabase). If you're accessing RouteFlow from outside the United States, your information will be transferred to and processed in the United States.

No system is perfect, and we won't pretend otherwise. Use a strong, unique password and tell us immediately if you think your account has been accessed by someone else. If you believe you've found a security vulnerability in RouteFlow, we welcome a good-faith report at michael@mrwebsolutionstx.com.

11Children

Our services are for adults. We don't knowingly collect information from anyone under 18. If you believe a minor has given us information, contact us and we'll delete it.

12Changes to this policy

If we change this policy we'll update the date at the top. For changes that meaningfully affect how your information is handled, we'll email account holders before it takes effect.

13Contact us

MR Web Solutions TX
Prosper, Texas
michael@mrwebsolutionstx.com
(940) 290-1953