Privacy Policy

1. Who We Are

Fulcrum Recovery Services LLC ("Fulcrum," "we," "us," or "our") operates the Fulcrum LMS platform (the "Platform"), an online learning management system providing recovery education courses. Our principal place of business is in the United States. Questions about this Privacy Policy may be directed to us at the contact information provided at the end of this document.

2. Information We Collect

We collect the following categories of information:

3. How We Use Your Information

We use the information we collect to:

• Create and manage your account and course enrollments
• Deliver course content, track your progress, and issue Certificates of Completion
• Process payments securely through Stripe
• Notify referring clinicians of your course completion (only if you were referred)
• Improve our courses and platform based on aggregated, anonymized feedback
• Communicate important account and service updates
• Comply with applicable laws and regulations
• Detect and prevent fraud, abuse, and security incidents

We do not use your information for targeted advertising, and we do not sell, rent, or trade your personal information to third parties.

4. How We Share Your Information

We share your information only in the following limited circumstances:

• Service Providers: We use Stripe for payment processing and cloud infrastructure providers for data storage. These providers are contractually obligated to protect your data and may not use it for their own purposes.
• Referring Clinicians: If you enrolled through a clinician referral link, your referring clinician will be notified of your course completion and certificate issuance. No other information is shared with clinicians without your consent.
• Legal Requirements: We may disclose information if required by law, court order, or governmental authority, or to protect the rights, property, or safety of Fulcrum, our users, or the public.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. You will be notified of any such change.

5. Data Security

We implement industry-standard technical and organizational security measures to protect your personal information, including: HTTPS/TLS encryption for all data in transit; bcrypt password hashing (no plaintext passwords are ever stored); HTTP security headers (HSTS, CSP, X-Frame-Options, etc.) via Helmet.js; rate limiting on authentication endpoints to prevent brute-force attacks; signed, httpOnly session cookies; and role-based access controls limiting data access to authorized personnel only.

While we take every reasonable precaution, no method of electronic transmission or storage is 100% secure. We encourage you to use a strong, unique password and to notify us immediately if you suspect unauthorized access to your account.

6. Cookies and Tracking

We use session cookies solely to maintain your authenticated login state. These cookies are httpOnly (inaccessible to JavaScript), secure (transmitted only over HTTPS), and expire when your session ends or you log out. We do not use third-party tracking cookies, advertising cookies, or analytics cookies that track you across other websites.

7. Data Retention

We retain your account and course data for as long as your account is active or as needed to provide services. Certificate records are retained indefinitely to support credential verification. If you request deletion of your account, we will delete or anonymize your personal information within 30 days, except where retention is required by law or for legitimate business purposes such as fraud prevention.

8. Your Rights and Choices

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate or incomplete information
• Delete your personal information (subject to legal retention requirements)
• Withdraw consent for testimonial sharing at any time
• Object to certain processing activities
• Data portability — receive a copy of your data in a machine-readable format

To exercise any of these rights, please contact us at the information provided below. We will respond to all requests within 30 days.

9. Children's Privacy

The Fulcrum LMS Platform is intended for adults aged 18 and older. We do not knowingly collect personal information from individuals under the age of 18. If we become aware that we have inadvertently collected information from a minor, we will promptly delete that information.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will notify registered users of material changes by email or by posting a prominent notice on the Platform. Your continued use of the Platform after the effective date of any update constitutes acceptance of the revised policy.

11. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at: