National Recall Alert Center is a 501(c)(3) nonprofit that has monitored product recalls and drug safety signals for hospitals since 1973. This policy explains what personal information we collect, why we hold it, who we share it with, and how long we keep it.
It covers this website, the E-CLASS Tracker and the Safety Intelligence Platform.
Our web server records the ordinary technical details of a request: the pages you asked for, the time, your browser and operating system, the page that referred you, and your IP address. We use these to keep the site working and to see which pages people read. We run no analytics service, no advertising network and no third-party tracking script of any kind.
This site loads its typefaces from Google Fonts, so Google receives the IP address of anyone who opens a page here. No other third party receives anything about your visit.
If you request a demonstration or write to us, we keep what you send: your name, work email address, facility name, role, and the substance of your message. We use it to answer you and to arrange the service you asked about. We do not sell, rent or trade it, and we do not share it with anyone for their own marketing.
Operating recall management for a member hospital means holding a working record of that facility: its name and addresses, the people we correspond with, their titles, phone numbers and email addresses, the accounts-payable contact for billing, and the commercial terms of the membership. We hold it to deliver the service and to bill for it, and for no other purpose.
We use recall records and the safety data a facility submits only to operate the service on that facility’s behalf. We do not disclose one member’s records to another member.
Subscriptions to the Safety Intelligence Platform are held by a facility rather than by a person. For the facility we keep its name and address; for each person who signs in we keep a name and a work email address. We do not ask for a phone number or a personal address.
Against each subscription we keep its status, its billing interval, when the current period ends, whether it is set to cancel, and the identifiers Stripe uses for the customer and the subscription. What we send to Stripe is the facility’s name and the account owner’s email address, and nothing further.
Subscription payments for the Safety Intelligence Platform run through Stripe, our payment processor. You can pay by card or by bank debit.
Card and bank details are entered on Stripe’s own pages, never on ours. Paying or updating a payment method sends you to Stripe’s hosted checkout or its billing portal, so the details go to Stripe directly. NRAC systems never receive a card number, a bank account number, a security code, or the card’s expiry or last four digits. We hold no payment instrument of any kind, which is a property of how the integration is built rather than a policy we apply to data we could otherwise see.
What we keep is the shape of the subscription: its status, its interval, the period end date, whether it is cancelling, and Stripe’s identifiers for the customer and subscription. That is what tells the Platform which facility is entitled to what.
Membership invoices for recall management are billed separately and are not paid online today.
We do not sell personal information. We share it only with providers who process it on our instructions to run the service, and where the law compels disclosure. These are the providers:
| Provider | What it handles |
|---|---|
| Stripe | Subscription payments for the Platform. Card and bank details are entered on Stripe’s pages, not ours |
| Supplies the typefaces this website loads | |
| Resend | Sends the email the Platform generates — password resets, invitations and support replies. It receives the recipient address and the message |
| Anthropic | Runs the Claude model behind the Platform’s help assistant. It receives the question you type there |
| OpenAI | Generates the numerical representations used to search recall and drug-safety literature. It receives that source material, not your personal information |
| Microsoft Azure | Hosts our recalls database |
| PostHog | Measures how people use this website, the beta application page and adversealerts.nraclabs.org. It receives the pages you open, what you click and type, and a video recording of your visit |
We name every provider that handles this information here. If we add one, we will update this list before it begins processing.
If NRAC is ever party to a merger, acquisition or transfer of operations, personal information may transfer with the operations it belongs to, and this policy travels with it until it is replaced.
The Platform has a help assistant. What you type into it is sent to Anthropic’s Claude model, through a proxy NRAC runs, so that it can answer you. We keep the question and the answer, which is how we find out where the product confuses people. Please do not put patient information into that box: it is a product help channel, not a clinical one.
We also use OpenAI to build the search index over recall notices and drug-safety literature. That is published source material rather than anything about you.
We do not use your personal information or your facility’s records to train anyone’s artificial intelligence models, and we do not permit our providers to.
The measures in place are these:
No system is secure against every attack, and we do not claim otherwise. NRAC also carries Errors and Omissions insurance as a further protection for member facilities.
PostHog, our analytics provider, sets a cookie on this website that recognizes your browser when you come back, so a second visit is not counted as a second person. The Safety Intelligence Platform sets a session cookie when you sign in, which keeps you signed in as you move between pages. We set no advertising cookies, and we run no advertising.
We use PostHog to see how people move through our pages. It records the pages you open, the links and buttons you click, and what you type into forms. It also records your visit as video we can watch back, showing the pointer moving, the scrolling and the typing. Password fields stay hidden from the recording. Nothing else does.
This runs on the pages of this website, on the beta application page at alerts.nraclabs.org/beta, and throughout adversealerts.nraclabs.org. It does not run on the rest of the Safety Intelligence Platform, so we do not record the case files a signed-in clinical user reads there.
Two consequences are worth stating plainly. A recording of the beta application page includes the name, facility and email address you type into the form. A recording from adversealerts.nraclabs.org includes the drug and adverse-reaction information on your screen while you work.
PostHog holds this for us and processes it on our instructions. We use it to improve the site and the software. We do not sell it. Write to us at the address below and we will delete your recordings.
We keep website request logs for a short period and use them only to run the site. We keep correspondence as long as it takes to deal with the matter it concerns, and member facility records for the life of the membership, and afterwards where a regulatory or contractual obligation requires it. Analytics events and session recordings expire on PostHog's schedule for our account, and we delete any recording sooner if you ask.
You may ask us what personal information we hold about you, ask us to correct it if it is wrong, ask for a copy in a portable form, or ask us to delete it. Write to the address below and we will respond.
We will post any change on this page and move the date at the top. Where a change materially affects how we handle information already collected, we will say so here rather than relying on the date alone.
On 1 September 2026 we added PostHog and began recording visits. Until that date this website set no cookies and we ran no analytics of any kind. If you would rather we did not hold a recording of your visits, write to us and we will delete them.
Questions about this policy, or a request about your information?
Email privacy@recallalert.org or call
1-800-NRAC-NOW.
National Recall Alert Center, 123 E. Main Street #609, Marlton, NJ 08053
