Effective: 2026-09-21 · Version: 1.1 · Applies to: trilatic.com, the Arbitrator Workbench, and the Trilatic Reviewer mobile app for Android (package `com.trilatic.reviewer`).
Trilatic is the trade name of Ripplarity Inc, a Delaware corporation. This notice says what information this site, the Workbench and the Trilatic Reviewer app collect, why, and what we do with it. It is written to be checked, not skimmed.
The Trilatic Reviewer app (Android, package `com.trilatic.reviewer`) is a working tool for the credentialed panel reviewers we have engaged. It is not a consumer app and has nothing in it for the general public: there is no sign-up, and every screen past the first requires a reviewer key we issue by hand. Without one the app shows a login prompt and nothing else. It displays the same review queue and the same draft determinations as the desktop Workbench and adds no second decision path.
What the app sends us. The reviewer key we issued, on every request, as the credential that authorises it. The reviewer's personnel identifier, which is not a secret. At enrolment, the public half of a signing key pair generated on the device, and, on Android, the platform's key-attestation certificate chain for that key together with the single-use challenge we issued for it — we keep the chain's hash and the leaf certificate, not the whole chain. A short platform label (`android`, `ios` or `web`) and an optional device label the reviewer types. At sign-off, the acknowledgements the reviewer checked off, the timestamp they signed at, and the signature itself. Case material the reviewer reads or writes in the app is Workbench case material and is covered by the Workbench and "Health information" sections above.
What the app keeps on the device. The reviewer key, encrypted, unlocked by the reviewer's own re-entry of it or by the device's biometric or screen-lock check. The device identifier we derived from the public key. The private half of the signing key, generated inside the Android Keystore (hardware-backed, StrongBox where the device has it) and marked non-extractable: it can sign, it cannot be exported, and it never leaves the device in any form. We never see, store or could reconstruct it.
What the app does not do. No advertising and no advertising identifiers. It never asks the device for your location, your contacts, your calendar, your photos, your microphone or your files, and it has no code that would read any of them. No profiling, and no collection while the app is in the background — it talks to trilatic.com only while a reviewer is using it. The biometric check is a local gate on the device: nothing biometric is registered with us, and no biometric data or assertion is ever sent to us.
The permissions the app declares. The current release build (version 1.0.1) declares five: network access, network state, the two the biometric app lock needs, and one Android generates for the app's own internal message delivery. Nothing else. An earlier build, version 1.0.0, was built on a shell this company also uses for other apps and inherited camera, notification, vibration, boot-completed, wake-lock and foreground-service entries from bundled components it never used; those components have been removed from this app's build rather than merely left unused. If you installed version 1.0.0 from Google Play internal testing, that is the build you have until it is replaced, and its extra declared permissions were never exercised: a permission Android would prompt for is never prompted for, because nothing in this app asks.
Third-party components. The current release build (version 1.0.1) contains none, and the app shares nothing with anyone except the infrastructure providers named under "Who we share with". Version 1.0.0 bundled an over-the-air update component which, in its default configuration, reported app launches and previous-exit reasons to its vendor's servers, carrying a per-install identifier, the app and bundle version and the platform. It carried no case material and no reviewer or patient information. That component has been removed from the build entirely, not merely switched off in configuration, and its absence is verifiable in the shipped package. If you installed version 1.0.0, it will keep behaving that way until you update.
Retention, access and revocation. Device enrolments, device revocations and device signatures are append-only records: a signature is part of the sealed determination it belongs to and is kept for the period the governing dispute program requires (six years for the Federal IDR process), and a revocation is a new record saying the device is no longer trusted rather than a deletion of the old one. A reviewer can revoke any device they enrolled from the app or the API, and a revoked device's signature is refused outright on the next attempt. Because the reviewer key is a bearer credential with no expiry, rotating that key — ask us, or use the Workbench — is what actually withdraws access from a key that has escaped a device; the app's own lock is a device-loss control, not a way to revoke a key. Uninstalling the app destroys what is on the device, including the private signing key, which cannot be recovered. Email privacy@trilatic.com to see or delete the enrolment records we hold for you, subject to the retention rule above.
The Workbench is designed for regulated dispute review and may hold individually identifiable health information. We hold it under the safeguards described in our security practices: encryption at rest and in transit, access limited to your workspace, an append-only audit chain, and a breach-notification process. We are not a HIPAA covered entity; where a customer requires a business associate agreement, one is executed before any such material is processed.
Email privacy@trilatic.com to see, correct, export, or delete the information we hold about you. We answer within 30 days. Deleting a Workbench account removes account information; case material you have issued or sealed is retained for the period the governing program requires (six years for the Federal IDR process) because it is part of a legal record.
Server logs: 30 days. Account information: for the life of the account plus 12 months. Case material: as the governing dispute program requires, then deleted. Invoices: seven years. Reviewer device enrolments, revocations and device signatures: as the governing dispute program requires, because they are part of the sealed record.
Each version of this notice carries a date and version number. Changes apply from the effective date shown; material changes are announced on this page 30 days in advance.
privacy@trilatic.com · security concerns: security@trilatic.com (see /.well-known/security.txt).