Privacy Policy

We collect the minimum needed to build and operate your web presence: your contact details, your NPI and the public registry data attached to it, your wizard answers, and payment records processed by Stripe. We never sell data, never run ad trackers, and never handle patient health information.

• Contact data: name, email, phone (if you provide it), and your messages to us.
• Provider data: your NPI and the public record retrieved from the federal NPPES registry (name, credential, specialty, practice address), plus the corrections and answers you provide in the wizard.
• Payment data: processed entirely by Stripe. We store subscription status and Stripe identifiers; we never store card numbers.
• Technical data: NPI lookups are logged with a hashed IP address (never the raw IP) for rate limiting and abuse prevention. Site analytics are aggregate and cookie-free.

To deliver the service you purchased: building your site, configuring your Google Business Profile, providing the review toolkit, billing, support, and transactional notifications. We do not use your data for third-party advertising, and in v1 we send no marketing email sequences; only transactional messages tied to your account.

Only service providers necessary to operate MedSpace360:

• Stripe: payments and billing
• Vercel: hosting and infrastructure
• Supabase: database
• Resend: transactional email delivery

Each processes data only to provide its service to us. We never sell or rent personal information, and we never share it with advertisers or data brokers.

• Sell or rent your data. Ever.
• Place advertising pixels or cross-site trackers on medspace360.com or client sites.
• Collect or process patient health information. Our service and the sites we build are designed to keep PHI out entirely.
• Use NPPES data to build marketing lists or contact providers who didn't contact us.

We use only essential cookies (if any) and cookie-free, aggregate analytics. That's why you don't see a cookie banner: there's nothing to consent to.

Active account data is kept while your subscription is active and as required for legal and accounting purposes. Leads that never convert are purged after 24 months. Lookup logs (hashed) are kept up to 12 months for abuse prevention.

You may request access to, correction of, or deletion of your personal information at any time by emailing contact@deocas.us. We honor these requests regardless of whether a specific privacy statute (such as CCPA/CPRA) technically applies to us, and we respond within 30 days.

The Service is for licensed adult professionals. We do not knowingly collect information from anyone under 18.

We'll post updates here and email active subscribers about material changes. Questions: contact@deocas.us · DEOCAs LLC, Tampa, Florida.