TRUST & ACCOUNTABILITY
Privacy Policy
Draft for licensed counsel review
This is an attorney-review draft, not a representation that legal review or legal compliance has been completed. The operating entity, effective date, contact channels and jurisdiction-specific provisions must be confirmed before private beta launch. Read the Trust Center for the product's identity and anonymity model. Counsel review is required before these policies are adopted.
Information collected and why
We process access-request names, email, career stage, specialty, institution and optional referral for administrator review; invitation hashes, intended email, expiry and redemption metadata for secure onboarding; login email and authentication information to operate accounts; legal name, NPI, a limited NPPES registry-name/status/taxonomy comparison, institutional email or credential evidence to assess physician eligibility; career stage, specialty and training or practice experience to provide professional context; pseudonyms, posts, comments, votes, saves, poll choices, blocks, reports and notifications to run the community; and voluntary compensation information to provide aggregate comparisons. Security and service providers may process technical request information such as IP addresses and device or connection metadata. Avoid entering patient information or unrelated sensitive information.
Community identity and private identity
Identity and credential evidence are stored separately from the member-visible community representation. Member author displays do not return your legal name, NPI, login email, institutional verification email, credential evidence, private institution, NPPES registry-name comparison or reviewer notes. A pseudonymous contribution displays your pseudonym and credential snapshot and can appear on a member-only pseudonymous contribution page. An anonymous contribution displays Anonymous and credential context, with no member-visible author account identifier or profile link. The operator retains internal account links. The service does not publish a real-name member directory. Your content and narrow professional details may still identify you through inference.
Private beta discussion and account information
Posts, comments, threads, feeds, search results, communities, profiles and polls are restricted to invited, currently verified and separately approved beta members in good standing. Members may copy, archive or redistribute content, and deleting content from the service cannot recall those copies. Anonymous mode conceals the member-visible account association, not the contribution itself. Verification identity and evidence, settings, notifications, reports and administrative workspaces remain protected by their respective access controls. Compensation tools and aggregate results remain restricted to approved beta members.
People who may access information
Normal moderators receive content, reports and internal moderation account references, rather than routine access to legal identity or credential evidence. Verification administrators review verification identity and evidence and do not automatically receive broad moderation access. Restricted super administrators and infrastructure administrators can have broader technical capability; sensitive application access is logged. Access control reduces exposure but cannot make data inaccessible to the operator or its infrastructure providers. Service providers may process data to supply authentication, hosting, storage, database and transactional email services under the operator's configuration and agreements.
Analytics, cookies and advertising
The MVP uses necessary authentication and security cookies and small internal product events for aggregate product health. Public page views record a normalized surface and timestamp with no visitor identifier. Member views record a normalized surface, optional community slug, timestamp and internal account association, limited to one per surface/community per UTC day; account associations support unique-member and return counts. New surface tracking excludes link prefetch requests. Existing daily discussion visits can include prefetched server loads rather than precise browser sessions. Contribution and onboarding events use existing internal account associations. Only unrestricted super administrators can view the aggregate dashboard; it provides no individual browsing history or hidden author links. Internal events do not store raw URLs, search text, legal names, NPI, institutional verification email, credential files, full contribution text, raw compensation notes, IP addresses or browser fingerprints. The app does not install third-party advertising or behavioral analytics. Hosting and authentication providers may keep their own technical logs, including public requests; the owner must disclose their deployed practices and retention. The MVP provides no advertiser, employer or recruiter accounts or privileged access to private member data; member discussions require approved beta membership.
Compensation information
Compensation reporting is optional. Individual submissions are internally linked to the submitter for editing, deletion, deduplication and abuse prevention, but are not displayed with a community identity. Member-facing results contain aggregate statistics only when configured privacy thresholds are met; the proposed minimum is five distinct qualifying contributors, and narrow cohorts may require more. Raw free-text notes are not included in aggregate responses. Thresholds reduce some identification risk and are not a guarantee against inference or collusion.
Retention and deletion
Credential documents are scheduled for deletion 30 days after a recorded approval or rejection by default, subject to configured retention and a documented legal or security hold. The deletion job must be deployed and monitored. Minimal verification metadata can remain to document eligibility and reverification. Other account data is retained for service operation, security, moderation and applicable legal requirements. Account deletion requests enter a staff queue and immediately restrict verified participation and compensation access; they do not automatically erase records. Staff must review holds and coordinate operational records, evidence and authentication-provider deletion as described in Data Requests. Security records, lawful preservation material, provider records and backups may remain for approved limited periods. Retention periods outside the credential document default must be finalized and enforced before launch.
Disclosure and legal requests
We may disclose information where reasonably necessary to operate and protect the service, investigate abuse, respond to valid legal process or comply with applicable law. We review requests for authority, scope and available information and seek to limit disclosure to what is required. User notice may be delayed or prohibited by law or safety concerns. We cannot promise never to identify an account or disclose retained information. Confidentiality, anonymity and legal privilege are different concepts; participation does not create legal privilege.
Your choices and requests
You can choose participation mode, edit professional details, manage notification preferences, hide the optional Founding Physician badge and edit or delete your compensation submissions. Account settings provide deletion and data-request controls. Additional access, correction, deletion, portability, appeal or opt-out rights may apply depending on location and the operator's legal obligations. We verify the requester and do not disclose others' identity, votes, reports or private information through an export. Final contact details, request deadlines and jurisdiction-specific notices require counsel approval.
Adults, geography and future changes
This initial service is intended for US physicians age 18 or older. Do not use it if you are under 18. The operator must confirm where providers store and process data, any cross-border transfer terms and the complete provider list before launch. Future biometric verification, health-record integrations, advertising, research reuse or new identity vendors require a separate privacy and legal review before introduction. This policy makes no HIPAA compliance determination.