CONQER Privacy Policy

Version 2026-10-10

Effective October 10, 2026

This Privacy Policy explains how CONQER LLC, doing business as CONQER Systems ("CONQER," "we," "us" or "our"), collects, uses, shares and protects personal information through our website at https://conqersystems.com (the "Website") and through the account features of the CONQER EHR service at https://app.conqer.org (the "Service").

1. What This Policy Covers

This policy covers:

• visitors to the Website, including people who request a demo or contact us;
• account and contact information about the people who use the Service on behalf of our customer organizations, such as administrators and staff; and
• billing contacts for customer organizations.

This policy does not cover protected health information ("PHI") or other records that our customers enter into the Service about the people they serve. That information belongs to the customer organization. We handle it only as the customer's business associate, under the CONQER EHR Business Associate Agreement and the CONQER EHR Terms of Service, and the customer's own notice of privacy practices explains how the customer uses it. If you have questions about records an agency keeps about you, please contact that agency directly.

2. Information We Collect

Information you give us on the Website. If you request a demo, use the contact form, or email us, we receive the information you provide, such as your name, work email, organization, role, what you are interested in, and your message. The Website contact form opens a pre-filled email in your own mail program; we receive the request only when you send that email. Please do not send health information about the people your agency serves through the Website or by email.

Account and contact information. When a customer organization subscribes to the Service, we collect information about its account owner, administrators and staff users, such as name, work email address, phone number, role, the locations or programs a user is assigned to, and multi-factor authentication enrollment status. Customer administrators add and manage most of this information.

Billing information. Payments are processed by Stripe, Inc. We receive billing contact details and limited payment information from Stripe, such as the card brand, the last four digits, the expiration date and payment status. CONQER does not store full payment card numbers.

Usage and audit logs. When people use the Service, we automatically record technical and activity information, such as sign-in times, IP address, browser and device type, pages and features used, error logs, and audit logs of actions taken in the Service. We use these records to operate and secure the Service and to support our customers' compliance obligations.

Website connection logs. The host that delivers the Website may keep ordinary connection logs, such as IP address, browser type, the page requested, and the time. These logs are used to serve the Website and keep it available.

3. Cookies and Analytics

The Website does not set advertising cookies and does not load third-party analytics or advertising pixels. We do not use Google Analytics or an advertising network on the Website. Your browser may store files it needs to load the pages, such as cached fonts and scripts that ship with the Website.

The Service uses only the cookies and browser storage needed to sign you in, keep your session secure, and remember your settings. The Service does not use advertising cookies.

4. How We Use Information

We use personal information to:

• respond to demo requests, questions and support requests;
• create and manage customer accounts and user access, including multi-factor authentication;
• provide, operate, maintain and improve the Service;
• process payments, send invoices and receipts, and manage subscriptions;
• send service, security, billing and account notices;
• monitor, investigate and prevent security incidents, fraud and misuse;
• maintain audit logs and business records; and
• comply with law and enforce our agreements.

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.

5. How We Share Information

We share personal information only as described below.

Service providers (subprocessors). We use the following providers to operate the Website and the Service:

These providers process information on our behalf and under contracts that limit how they may use it. Customer data is not used to train AI models.

Customer organizations. Information about a user's account and activity in the Service, including audit logs, is available to that user's organization and its administrators.

Legal and safety reasons. We may disclose information if required by law, subpoena or other legal process, or if we believe in good faith that disclosure is needed to protect the rights, property or safety of CONQER, our customers or others.

Business transfers. If CONQER is involved in a merger, acquisition or sale of assets, information may be transferred as part of that transaction, subject to this policy and our customer agreements.

6. Where Information Is Stored

We store and process information in the United States.

7. How Long We Keep Information

We keep account and usage information for as long as the customer organization's subscription is active and for the period after cancellation described in the CONQER EHR Terms of Service, including a 90-day read-only export window followed by deletion. Backup copies are deleted as backups expire on their schedule (daily backups are kept for 14 days and weekly backups for 14 weeks). We keep billing records and other business records for as long as needed to meet tax, accounting and legal obligations. We keep correspondence long enough to respond and to retain an ordinary business record of the conversation. Website connection logs are kept on the host's schedule.

8. Security

We use administrative, physical and technical safeguards designed to protect information, including encryption in transit and at rest, role-based access controls, required multi-factor authentication for administrators and for staff access to resident charts, automatic sign-out after inactivity, and audit logging. No method of transmission or storage is completely secure. HIPAA is a legal framework, not a certification, and we do not claim any government or third-party certification or attestation.

9. Your Choices and Rights

You may ask us to provide, correct or delete personal information we hold about you, or to stop sending you non-essential communications, by emailing privacy@conqer.org. We will respond as required by applicable law and will not discriminate against you for making a request. We may need to verify your identity before acting on a request, and we may keep information where we need it to maintain a record of a business relationship or to meet a legal duty. We will not ask you to send health information in order to make a request.

If you use the Service as a member of a customer organization, your account is managed by that organization. We may refer requests about your account to your organization's administrator, and some changes, such as removing a user, are made by the administrator.

10. Children

The Website and the Service are intended for business use by adults. They are not directed at children, and we do not knowingly collect personal information from children through the Website or the account features of the Service. Records that a customer agency keeps in the Service about the people it serves, including minors, are handled under that customer's agreement and the Business Associate Agreement, not this policy.

11. Changes to This Policy

We may update this policy from time to time. When we do, we will post the new version on this page with a new version and effective date and, where the change is material, we will notify customer account owners by email or in the Service. Continued use of the Website or the Service after a change means the updated policy applies from its effective date.

12. Contact Us

Questions and requests about this policy or our privacy practices can be sent to privacy@conqer.org or 617-209-9127. Please use a work address and do not include health information about the people your agency serves.

CONQER LLC, doing business as CONQER Systems

Principal office: 172 Warren Ave, Unit 1, Lewiston, ME 04240

Mailing address: 770 Roosevelt Trail Ste 8 PMB 1032, N. Windham, ME 04062

Questions about records inside CONQER EHR should go to your agency's administrator.