Care starts with your information.

Information used in this sandbox

We store business contact details, business website, platform, order-volume range, and purchase pattern to set up merchant accounts and review applications. The authenticated workspace stores synthetic order data, delivery issue categories, agreement records, and operational audit events.

Synthetic conversations and attachments

Test claim messages, outcome records, reward ledger entries, and delivery events are stored with the company workspace. Customer-visible messages and files can be viewed by that company’s owner and the Cross Coverage care team. Internal notes, draft decisions, and staff-only files are restricted to the care team.

Synthetic PNG, JPEG, and PDF attachments are stored in private, encrypted, versioned AWS storage. Original filenames are not retained by the application. File access ends seven days after upload initiation; storage lifecycle cleanup can occur later. Attachment metadata and audit events remain during the sandbox review period. File-format checks and a test-data confirmation do not detect all sensitive information or malicious content.

Business bank setup

Stripe has been selected for future payment collection, with Stripe Connect planned for company reimbursements. Cross Coverage’s Stripe account is not connected in this release. The manual bank setup below is separate and does not send those details to Stripe.

If you save ACH details, we store the bank name, account type, intended use, and last four account digits. Account-holder name, routing number, and full account number are encrypted before storage. Company owners control their bank details; administrators see masked client summaries. Cross Coverage can separately share its receiving instructions with reviewed company owners. Full-detail views and bank changes are logged. Saved details do not verify ownership or authorize a debit.

Why it is used

This information supports account access, merchant review, sandbox integration testing, agreement assignment and acceptance, troubleshooting, and security. We do not request clinical information and do not support patient-data uploads.

Where it is processed

The sandbox is hosted on Amazon Web Services in the United States, primarily in US East (Northern Virginia). Static website content is delivered through AWS hosting infrastructure. Business records are stored in DynamoDB and account credentials are managed by Cognito.

Browser storage and analytics

Essential sign-in state and session tokens are kept in the current browser tab’s session storage. There are no advertising pixels or third-party marketing analytics in this release. The dashboard demo uses fictional records and resets when reloaded. Full bank details are not saved in browser storage. Revealed details hide after two minutes or when the browser tab is hidden.

Retention and requests

Application and API metadata logs are retained for 30 days. Business, agreement, and audit records are retained during the sandbox review period; automated deletion of those records is not yet enabled. Removing saved bank details removes the active account record; historical encrypted backups may remain within backup retention. Contact your Cross Coverage account representative for access, correction, or removal requests. A formal retention policy and privacy contact must be finalized before public onboarding at scale.

Keep clinical information with your provider

Do not provide real patient information, medication details, prescription identifiers, or other protected health information in this sandbox. For an actual medical or dispensing question, contact your licensed healthcare provider.