Privacy Policy

This policy explains what information the SANC Risk Assessment Tool collects, how it is used and shared, and the choices you have. We have written it to be read, not skimmed past, so it is specific to this tool rather than a general website policy.

1. Who we are

The SANC Risk Assessment Tool (this website) is operated by the Horticultural Research Institute (HRI), The AmericanHort Foundation, a nonprofit organization based in Columbus, Ohio. HRI runs the tool in support of the Systems Approach to Nursery Certification (SANC), a program developed with the National Plant Board and USDA. In this policy, “HRI,” “we,” “us” and “our” mean the Horticultural Research Institute.

This policy covers this website and the tool only. Other HRI and AmericanHort websites, including the access-request form on the AmericanHort membership site, have their own privacy policies.

2. Information we collect

Account information

Accounts are created by HRI staff for nurseries and greenhouses that request access; there is no public sign-up. For each user we hold a name, email address, username, an encrypted password, the organization (nursery or greenhouse) the account belongs to, and the user’s role within that organization (viewer, author or manager).

Assessment content you enter

When you use the tool you may enter information about your operation, including:

• organization and location names, addresses and descriptions of your growing sites;
• risk assessments, the hazards and best practices you select or write, and the protocols, responsibilities, training, records and verification notes you add;
• files you upload, such as written procedures, training records, maps or photos.

Please do not upload information that is not needed for your assessment, such as employees’ personal identification or health information.

Update and notification sign-ups

If you sign up on our tool update page to hear when the tool reopens, we collect your name, email address, and, if you choose to give them, your nursery or organization, which best describes you (for example, current tool user) and any message you add.

Messages you send us

If you contact us, we receive your contact details, your message and anything you attach.

Technical and security information

Like most websites, our servers record basic technical information when you visit, such as your IP address, browser type, the pages requested and the date and time. When you are signed in, we also keep an activity log of account actions (for example sign-ins and changes to records) with the IP address used, so we can secure the tool and investigate problems.

We do not use analytics, advertising or social-media tracking on this website.

3. How we use information

• to provide the tool: create and manage your account, save your assessments and files, and produce your reports;
• to administer the SANC program, including helping participating growers and answering questions;
• to send service messages, such as password-reset and account emails, and to let people who signed up know when the tool reopens and how to sign in (we do not send marketing email from this tool);
• to keep the tool secure, prevent misuse and fix problems;
• to improve the tool and its assessment content, using information in a form that does not identify your operation;
• to comply with the law and protect the rights and safety of our users, HRI and others.

4. Who can see your information

• People in your organization. Users linked to your organization can see its locations and assessments according to their role. Your organization’s managers control who has access.
• HRI staff. A small number of HRI staff who administer the tool and the SANC program can view accounts and assessments to support users and run the program.
• People you choose to share with. You can print or download your reports and share them, for example with a state plant regulatory official as part of SANC. We do not send your assessments to regulators or anyone else on your behalf.
• Service providers. Companies that host and maintain the website and deliver its email process information for us under contract and only to provide those services. The website is hosted on Elementor’s managed WordPress hosting.
• Legal reasons. We may disclose information if required by law, or where needed to protect the rights, property or safety of our users, HRI or others.
• Organizational change. If the tool is transferred to another organization to continue the SANC program, information would transfer with it and remain protected by this policy.

We do not sell personal information, and we do not share it for targeted (cross-context behavioral) advertising. Because of this, there is nothing to opt out of, but we honor browser privacy signals such as Global Privacy Control as an opt-out request in any case.

5. Cookies and local storage

This website uses only the cookies needed to make it work:

• Sign-in cookies (names beginning wordpress_logged_in_, wordpress_sec_ and wordpress_test_cookie) keep you signed in securely. They last for the session, or up to 14 days if you tick “Remember Me.”
• Preference storage. If you change settings in the on-page accessibility tools, those choices may be saved in your browser so they apply on your next visit. They are not sent to us.

We do not use advertising or analytics cookies. You can block or delete cookies in your browser settings, but you will not be able to sign in without the sign-in cookies.

6. How long we keep information

• Account information and assessment records are kept while your organization participates in the tool, because growers rely on these records over several years for SANC. When an organization leaves or asks us to delete its account, we delete or de-identify its records within 90 days, unless we must keep something longer by law.
• Update sign-ups are kept until the new tool has opened and we have contacted everyone who signed up, then deleted within 12 months. If you also have or request a tool account, your details are kept with that account as described above.
• Activity logs and server logs are kept for a limited period for security and troubleshooting, then deleted.
• Website backups are overwritten on a rolling schedule, so deleted information may remain in backups for a short time before it is removed.

7. How we protect information

The tool is served only over encrypted connections (HTTPS). Passwords are stored in hashed form, access is limited by role so users see only their own organization’s records, and uploaded files are stored privately and released only to signed-in users with permission to view them. No system is perfectly secure, so please use a strong password, keep it private and sign out on shared computers. If we learn of a security incident affecting your information, we will notify you as required by law.

8. Your choices and rights

Whichever state you live in, you can ask us to:

• confirm whether we hold personal information about you and give you a copy;
• correct information that is inaccurate (you can also edit most of it yourself in the tool);
• delete your personal information, or your organization’s account;
• provide your assessment records in a portable format.

To make a request, send us a message through our contact form using the email address on your account, or write to us at the address below. We may need to confirm your identity before acting, and we will respond within 45 days. You may use an authorized agent; we will ask for proof that the agent may act for you. We will not treat you differently for exercising your rights.

If we decline your request, we will explain why. You can appeal by contacting us again with “Appeal” at the start of your message; we will respond to appeals within 60 days and, if we deny an appeal, tell you how to contact your state attorney general.

A request to delete the account of an organization that other users belong to must come from that organization’s manager.

9. Children

This tool is for nursery and greenhouse businesses and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us information, contact us and we will delete it.

10. Where information is processed

HRI is based in the United States, and we and our service providers process information in the United States and may process it in other countries where those providers operate. Wherever it is processed, we protect it as described in this policy.

11. Links to other websites

This website links to other sites, such as hriresearch.org and the AmericanHort membership site where you can request access. Those sites are governed by their own privacy policies.

12. Changes to this policy

We will update this policy if the tool or our practices change. The effective date at the top shows when it last changed. If we make a significant change, we will notify signed-in users in the tool or by email before it takes effect.

13. Contact us

Questions or requests about privacy:

Horticultural Research Institute
Attn: SANC Risk Assessment Tool
2130 Stella Court
Columbus, OH 43215
Phone: 614-487-1117
Online: contact form