What ServiceSalute collects when someone thanks a caregiver, what becomes permanent, and what we cannot undo.
Someone thanks a member of a care team by choosing from a short list of prepared phrases. We store that thank-you privately, and we publish a separate record containing no personal information at all — only a one-way code proving the stored details have not been altered.
We do not collect any information about medical care. The form has no free-text box, so there is nowhere for it to be entered even by accident.
The one-way public code is permanent and cannot be deleted by anyone, including us. The private details behind it can be deleted on request, and deleting them is enough to remove the personal information entirely.
When you thank a caregiver, we record only structured choices you make on the form:
There is no free-text field anywhere in the recognition form. You cannot type a comment, and we cannot receive one. This is a design decision rather than a policy promise: the risk of someone entering medical detail is removed by making it impossible, not by asking them not to.
We do not ask for your name, and we do not collect your date of birth, contact details, insurance information, medical record number, diagnosis, treatment, or any other information about your care. We do not ask about wait times, cleanliness, billing, or satisfaction — ServiceSalute is not a patient-experience survey and collects none of that data.
We record the network address of a submission briefly, and only to limit how many submissions can come from one place in a short period. It is used to prevent abuse and for nothing else.
Every recognition is recorded on an independent public record that ServiceSalute does not own or control. This is how a caregiver can prove years later that a recognition is genuine, even if they change employer and even if ServiceSalute no longer exists.
What is written to that record is a one-way code derived from the recognition, plus the fact that a recognition occurred and which organization issued it. It contains no name, no phrase you selected, and nothing about you. It cannot be reversed to recover the underlying details.
Two consequences follow, and both are permanent. First, that entry cannot be edited or deleted by anyone — not by the organization, not by us, not by a court order directed at us — because no one holds that power over a record of this kind. Second, this is precisely why the entry contains no personal information: we assumed from the outset that anything published there is published forever.
Private records are held in a managed database hosted in the United States. The website and its servers are also operated in the United States.
The public record described above is globally distributed. Entries on it are replicated worldwide and are publicly readable by anyone. Again, those entries contain no personal information.
For a healthcare organization in the United States, collecting feedback about the quality of care its own staff provide falls within Health Care Operations under the HIPAA Privacy Rule, as quality assessment and improvement activity. Separate written authorization is not required for that internal purpose.
Publishing a recognition where the public can see it is a different matter and is never done on that basis. It happens only where the person giving the recognition has affirmatively chosen to publish, on the form, at the time.
ServiceSalute is not a healthcare provider and does not provide medical advice, diagnosis, or treatment.
A recognition appears on an organization’s public recognition wall only if the person giving it chose to publish it. If they did not, the recognition still counts and still reaches the caregiver — it simply is not displayed.
The public wall shows the caregiver’s name and role, the phrases selected, and how the giver knows them. It never shows the giver’s name, because we never collected one.
We show an aggregate count of recognitions for an organization. We deliberately do not publish per-caregiver counts, rankings, or any measure that would make the absence of recognition visible. Low participation makes absence meaningless, and a number that can be read as a performance score changes what the service is for.
You may ask us to delete the private details behind a recognition. Write to the privacy address below. When we do this, the recognition’s personal details are erased and the content-free public code remains, and the verification page shows that the details have been withheld. That is the intended outcome: the proof survives and the personal information does not.
We must be straightforward about a limit. Because we never collect your name or contact details, there is generally no way for us to find “your” recognitions from your identity alone. If you ask us for a copy of your information, or to correct it, we usually cannot locate it — not because we refuse, but because the anonymity that protects you also makes you unfindable to us. Where you can identify a specific recognition (for example, you have the link), we can act on that one.
A caregiver who has been recognized may ask the issuing organization to withdraw a recognition, or may write to us directly.
Depending on where you live, state law may give you additional rights over personal information. Where those rights apply, we honor them; the practical limit described above applies to them equally.
Private recognition records are kept while the issuing organization is a client, and for a reasonable period afterwards so that credentials remain verifiable for the people who earned them. Rate-limiting records are kept briefly and then discarded.
The public record entry is permanent, as described above.
We do not sell personal information. We do not share it for advertising, and we do not use it to train machine-learning models.
We use service providers to operate the service. They process information on our instructions and for no purpose of their own.
The organization that issued a recognition can see the recognitions issued by that organization. It cannot see any other organization’s.
We may disclose information where required by law. Note that we cannot remove a public record entry in response to such a demand, because no one can.
The service is not directed at children and we do not knowingly collect information from them. Because we collect no identifying information at all, we have no way to detect a child’s use — a further reason the form collects nothing beyond prepared choices.
Private records are held under strict access controls, and the values used to produce each credential’s public code are never exposed outside our systems.
No system is perfectly secure. What we can say is narrower and more useful: the information at risk in a breach of our database is a caregiver’s name, the prepared phrases chosen, and a role category. There is no medical information to lose, because we never collected any.
We record which version of this policy was in effect when a consent was given, so it is always possible to establish what a person actually agreed to. Material changes will be reflected in a new version identifier and effective date shown at the top of this page.
This service is operated by Popup Investments LLC (Florida document number L24000349056), doing business as ServiceSalute.
Postal address: 9225 Bay Plaza Blvd., Tampa, FL 33619, United States.
Privacy and data-rights requests: privacy@servicesalute.com. This inbox is monitored and is the correct route for any request to delete information.
Legal notices and general enquiries: support@servicesalute.com. Telephone: +1 202 557-4444.
Accountable for privacy: Evelyn Lozada, Privacy Officer.
This policy is governed by the laws of the State of Florida and applicable United States federal law, including HIPAA where a covered entity or business associate relationship exists. Any dispute will be brought in the state and federal courts located in Hillsborough County, Florida.