Privacy statement
Effective [EFFECTIVE DATE]
This statement explains how [LEGAL ENTITY NAME] ("we", "us") handles personal information in connection with the ProviderPlots website and service (the "Service"). It covers two groups of people: people who visit the site or hold an account, and people who are named in the data the Service publishes (for example individuals listed as owners or officers of healthcare organizations in public records). The Service is for business use and is not directed to children.
1. Information we collect about visitors and account holders
- Account details: your name, work email address, organization, and role. Passwords are handled by our authentication provider; we never see or store your password.
- Sign-in through Google or Microsoft: if you choose it, we receive your name, email address, whether the provider has verified that address, and an account identifier from that provider. We use them only to create your account and sign you in; we do not receive your contacts, files or mailbox, and we do not use this information for advertising or transfer it except as described in section 3. Our use of information received from Google follows the Google API Services User Data Policy, including its Limited Use requirements.
- Onboarding answers: the kind of work you do, what you plan to use the data for, the providers and markets you are interested in, your team size, and how you heard about us.
- Purchases: what you bought, when, the number of seats, amount, payment method type and invoice or payment reference. Card payments are processed by Stripe, which receives your card details and email address directly; we do not see or store full card numbers.
- Downloads: each time you download an export, the product, the time, your IP address and browser, and the marks placed in that copy (terms section 10), so a copy found elsewhere can be traced to the download it came from.
- Usage: while you are signed in, the pages you open and when, and your sign-in sessions, including IP address and browser type. We use this to support your account, protect the Service from scraping and misuse, and understand which features are used.
- Forms and messages: what you send through request, alert, correction or contact forms, with the page you sent it from, and emails you send to our support address.
- Bot checks and security: our bot-check provider (Cloudflare Turnstile) processes signals from your browser and device to tell people from automated traffic.
- Cookies and website measurement: see section 8. With your permission where the law requires it, Google Analytics and Google Ads collect information about your visit (pages viewed, the ad or link that brought you, device and browser, approximate location from your IP address) and whether you signed up, asked for a quote or bought.
2. How we use it
- To provide the Service, manage accounts, seats and licences, and process payments.
- To support customers. Each customer account is assigned to a member of our team who may review its purchases, onboarding answers and usage to help.
- To secure the Service: detecting and preventing scraping, account sharing, fraud and abuse, and enforcing our terms.
- To understand and improve the Service, including which data and pages are used.
- To measure our advertising: to learn which ads and searches bring visitors who sign up or buy, and, where you have allowed advertising cookies, to show our ads to people who have visited the site.
- To communicate with you about your account, purchases, changes to the Service and these policies, and, where allowed, about products we think may interest you (you can opt out of marketing at any time).
- To comply with law and to establish, exercise or defend legal claims.
3. When we share it
We do not sell personal information for money. We share it only:
- with service providers that run the Service for us under contract: hosting and database (Vercel, Supabase), authentication (Supabase Auth, and Google or Microsoft if you sign in with them), bot checks (Cloudflare), card payments (Stripe), email delivery (Resend) and our support mailbox (Microsoft 365);
- with Google, for website measurement and advertising (section 8): when advertising cookies are allowed, Google receives online identifiers and information about your visit. Under some state privacy laws (for example California's) this may be a 'sale' or 'sharing' of personal information for cross-context behavioral advertising. You can opt out at any time through 'Cookie settings' in the site footer or with a Global Privacy Control signal, which we honor as an opt-out;
- within your organization: if you use a seat on an organization's site licence, the licence owner can see your name and email address as a seat holder, and team downloads are recorded to the person who made them;
- when required by law, legal process or a government request, or to protect the rights, safety or property of our users, the public or us;
- with a buyer or successor if all or part of our business is sold or reorganized, subject to this statement;
- with your consent or at your direction.
4. People named in our data
The Service describes healthcare organizations and facilities. In doing so it may include the names and roles of individuals, such as owners, officers, managers or clinicians, as they appear in public records (for example federal Medicare ownership files and the national provider registry), company disclosures and published sources. We include this information to describe who owns and runs healthcare businesses, a matter of public and regulatory interest, and we cite where it came from.
We do not use this information to market to those individuals, and our terms forbid customers from using it for credit, insurance, employment, housing or similar decisions about a person. If you are named in the Service and believe information about you is wrong or out of date, or want to make a request about it, contact us at support@providerplots.com. We will check the source and correct or update the information where appropriate. Where the information comes from public government records, we may keep publishing it as it appears there.
5. How long we keep it
- Account and onboarding information: while the account is open and for [2] years after it closes.
- Purchase and invoice records: for [7] years, for tax and accounting.
- Usage and session records: for [24] months, then deleted or made anonymous.
- Download records, including the marks in each copy: for as long as the copy could be in use, and at least [7] years, so that copies can be traced.
- Google Analytics data: [14] months (the retention setting in Google Analytics).
- Security and abuse records: as long as needed to investigate and protect the Service.
- Form submissions: for [2] years after the last contact.
6. Security
We use technical and organizational measures designed to protect personal information, including encryption in transit, access limited to staff who need it, server-side sessions that can be revoked, hashed session tokens, and logging of staff access to customer accounts. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
7. Your choices and rights
You can see and update your name and onboarding answers on your account page, and opt out of marketing emails through the link in each one. Depending on where you live, you may have rights to know what personal information we hold about you, to get a copy, to correct it, to delete it, to opt out of its sale or sharing for targeted advertising, and to appeal our decision on a request. To opt out of advertising cookies, use "Cookie settings" in the site footer or turn on Global Privacy Control in your browser; to make any other request, email support@providerplots.com. We will verify your request and respond within the time the law requires. We will not discriminate against you for exercising your rights. [LAWYER: confirm which state laws apply at launch (the size thresholds of California's and other states' laws), whether a "Your privacy choices" link is required, and add any required state-specific sections.]
9. Where we process it
We are based in the United States, and personal information is processed and stored in the United States by us and our service providers.
10. Changes
We may update this statement. We will post the new version with its effective date and, for material changes, notify account holders by email or on the site before they take effect.
11. Contact
[LEGAL ENTITY NAME], [MAILING ADDRESS]. Privacy requests: support@providerplots.com.