Privacy statement

This statement explains how [LEGAL ENTITY NAME] ("we", "us") handles personal information in connection with the ProviderPlots website and service (the "Service"). It covers two groups of people: people who visit the site or hold an account, and people who are named in the data the Service publishes (for example individuals listed as owners or officers of healthcare organizations in public records). The Service is for business use and is not directed to children.

1. Information we collect about visitors and account holders

• Account details: your name, work email address, organization, and role. Passwords are handled by our authentication provider; we never see or store your password.
• Onboarding answers: the kind of work you do, what you plan to use the data for, the providers and markets you are interested in, your team size, and how you heard about us.
• Purchases: what you bought, when, the number of seats, amount, payment method type and invoice or payment reference. Card details are handled by our payment processor; we do not store full card numbers.
• Usage: while you are signed in, the pages you open and when, and your sign-in sessions, including IP address and browser type. We use this to support your account, protect the Service from scraping and misuse, and understand which features are used.
• Forms and messages: what you send through request, alert, correction or contact forms, with the page you sent it from.
• Bot checks and security: our bot-check provider (Cloudflare Turnstile) processes signals from your browser and device to tell people from automated traffic.
• Cookies: a session cookie that keeps you signed in, and a cookie that tells the site you are signed in. We do not use advertising cookies. [UPDATE if analytics are added (B8).]

2. How we use it

• To provide the Service, manage accounts, seats and licences, and process payments.
• To support customers. Each customer account is assigned to a member of our team who may review its purchases, onboarding answers and usage to help.
• To secure the Service: detecting and preventing scraping, account sharing, fraud and abuse, and enforcing our terms.
• To understand and improve the Service, including which data and pages are used.
• To communicate with you about your account, purchases, changes to the Service and these policies, and, where allowed, about products we think may interest you (you can opt out of marketing at any time).
• To comply with law and to establish, exercise or defend legal claims.

3. When we share it

We do not sell personal information, and we do not share it for targeted advertising. We share it only:

• with service providers that run the Service for us under contract, such as hosting and database (Vercel, Supabase), authentication (Supabase Auth), bot checks (Cloudflare), payments [PAYMENT PROCESSOR] and email [EMAIL PROVIDER];
• within your organization: if you use a seat on an organization's site licence, the licence owner can see your name and email address as a seat holder;
• when required by law, legal process or a government request, or to protect the rights, safety or property of our users, the public or us;
• with a buyer or successor if all or part of our business is sold or reorganized, subject to this statement;
• with your consent or at your direction.

4. People named in our data

The Service describes healthcare organizations and facilities. In doing so it may include the names and roles of individuals, such as owners, officers, managers or clinicians, as they appear in public records (for example federal Medicare ownership files and the national provider registry), company disclosures and published sources. We include this information to describe who owns and runs healthcare businesses, a matter of public and regulatory interest, and we cite where it came from.

We do not use this information to market to those individuals, and our terms forbid customers from using it for credit, insurance, employment, housing or similar decisions about a person. If you are named in the Service and believe information about you is wrong or out of date, or want to make a request about it, contact us at [privacy@YOUR-DOMAIN]. We will check the source and correct or update the information where appropriate. Where the information comes from public government records, we may keep publishing it as it appears there.

5. How long we keep it

• Account and onboarding information: while the account is open and for [2] years after it closes.
• Purchase and invoice records: for [7] years, for tax and accounting.
• Usage and session records: for [24] months, then deleted or made anonymous.
• Security and abuse records: as long as needed to investigate and protect the Service.
• Form submissions: for [2] years after the last contact.

6. Security

We use technical and organizational measures designed to protect personal information, including encryption in transit, access limited to staff who need it, server-side sessions that can be revoked, hashed session tokens, and logging of staff access to customer accounts. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

7. Your choices and rights

You can see and update your name and onboarding answers on your account page, and opt out of marketing emails through the link in each one. Depending on where you live, you may have rights to know what personal information we hold about you, to get a copy, to correct it, to delete it, and to appeal our decision on a request. To make a request, email [privacy@YOUR-DOMAIN]. We will verify your request and respond within the time the law requires. We will not discriminate against you for exercising your rights. Because we do not sell or share personal information for targeted advertising, there is nothing to opt out of in that respect; we honor Global Privacy Control signals as such an opt-out where the law requires. [LAWYER: confirm which state laws apply at launch and add any required state-specific sections.]

8. Where we process it

We are based in the United States, and personal information is processed and stored in the United States by us and our service providers.

9. Changes

We may update this statement. We will post the new version with its effective date and, for material changes, notify account holders by email or on the site before they take effect.

10. Contact

[LEGAL ENTITY NAME], [MAILING ADDRESS]. Privacy requests: [privacy@YOUR-DOMAIN].