Privacy Policy

Effective Date: 5/14/2026
Last Updated: 9/29/2026

What changed on September 29, 2026: We added Section 5.6, which explains what we share when you refer colleagues to the Playbook or buy it through a colleague’s link or code.

A note before we get into it

We tried to write this in plain English. Privacy policies usually read like they’re trying to confuse you. This one is trying to be clear. If anything here is unclear, email us at privacy@mydeprescriber.com and we’ll fix it.

Here’s the short version:

• We list psychiatric providers, drawing on the public NPPES file the federal government publishes about every U.S. healthcare provider, plus other providers who add themselves using their NPI.
• You don’t need an account to browse. Search and read the directory freely.
• Providers can claim their listings to edit them. That requires us to collect their professional information and verify their identity.
• We send you marketing only if you opt in. Providers and certified members may receive product updates; you can unsubscribe anytime.
• We never sell your personal information for money, and patient pages have no ad tracking. (A provider’s booking calendar is run by their scheduling company, which may use its own; see §12.) Ad cookies from Meta and Google are used only on our pages for providers, and only after you tap “Allow” (see §6).
• Providers can ask to be removed from the directory at any time. We honor those requests.

The rest of this document is the long version.

1. Who we are

mydeprescriber.com (the “Site”) is operated by MyDeprescriber.com, LLC, an Arizona limited liability company (“MyDeprescriber,” “we,” “us,” “our”).

For privacy questions, data requests, or to exercise any right described in this policy, contact us:

• Email: privacy@mydeprescriber.com
• Mail: 4815 E Carefree Hwy. Ste 108-130, Cave Creek, AZ 85331

This Site is intended for users in the United States. By using the Site you acknowledge that your information will be processed in the United States and subject to U.S. law.

2. What we are not

We need to be precise about what this Site is — and isn’t — because the distinction matters under several laws.

• We are not a healthcare provider. We do not provide medical advice, diagnosis, or treatment. We help you find a licensed clinician who does.
• We are not a HIPAA-covered entity or business associate. We do not receive, store, or transmit your protected health information (“PHI”) on behalf of any healthcare provider. If you submit health information to us voluntarily (e.g., describing your situation in a contact-provider form), that information may not be protected by HIPAA. Use discretion.
• We are not affiliated with the U.S. government, CMS, NPPES, the DEA, or any state medical or nursing board, despite displaying data those entities publish.

3. Information we collect

We collect three kinds of information: information you give us, information collected automatically when you use the Site, and information we receive from third parties (notably, the public NPPES file).

3.1 Information you give us

If you are a patient or visitor who contacts a provider through the Site:

• Your name and email address
• Your message to the provider (which may include health-related details you choose to share)
• Any other information you voluntarily submit through a form

We use this only to deliver your inquiry to the provider you selected. Once delivered, the provider becomes responsible for how they handle that information under their own privacy practices.

If you are a provider who claims a listing or signs up for an account:

• Name (first, last, professional credentials)
• National Provider Identifier (NPI)
• Email address
• Phone number (optional)
• Practice address (typically already public via NPPES)
• Authentication credentials (a password or an OAuth identity from a provider like Google, depending on the sign-in method)
• Any biographical, specialty, insurance, or treatment-approach content you choose to add to your listing
• Optionally, your DEA registration number (encrypted at rest; only the verification status is displayed publicly)
• Photographs of professional ID or licensure if you submit them for verification

If you purchase the Playbook or a certification:

• Billing name, billing address, payment method details (handled by Stripe; see §4.4 below — we do not store full card numbers)
• A record of your purchase and any progress you’ve made through the course

If you communicate with us directly:

• Your email address and the contents of your message

3.2 Information collected automatically

Like nearly every website, we collect technical information about your visits:

• Device & browser data: IP address, user-agent string, device type, operating system, language preferences
• Usage data: Pages visited, time spent on pages, referring URL, search terms used inside the Site, links clicked
• Cookies and similar technologies: See §6 for details. These let us remember you between visits, keep you logged in, and measure how the Site is performing.

We may use:

• First-party cookies that we set ourselves for sign-in, preferences and your ad-cookie choice.
• Server-side logs retained for security and abuse-prevention purposes.
• Analytics tools (e.g., Google Analytics or similar) configured with IP anonymization where supported.
• Advertising tools from Meta and Google, on our pages for providers only (see §6).

3.3 Information from third parties

National Provider Identifier (NPPES) data. The U.S. Centers for Medicare & Medicaid Services (“CMS”) publishes a monthly file of every healthcare provider with a National Provider Identifier. That file is public-domain and contains professional information including: provider name, credentials, practice taxonomy, license numbers (when reported), practice address, and practice phone. We ingest a filtered subset (psychiatric providers), plus other providers who add themselves using their NPI. We display it and let providers claim and update their own records.

State licensing boards. Where state nursing or medical boards publish roster data (e.g., Texas Board of Nursing, Florida Department of Health), we may use that data to enrich providers’ license status, expiration date, or disciplinary record.

Verification partners. If we use a third-party identity-verification service to confirm a provider’s identity when they claim a listing, we will receive verification status (e.g., “verified” / “not verified”) from that partner. We do not retain the underlying ID documents.

4. How we use information

We use the information we collect for the following purposes:

4.1 Run the Site

• Display the provider directory and individual provider profiles
• Process provider claims and verify provider identity
• Deliver patient inquiries to the providers they select
• Process payments for the Playbook and certifications

4.2 Communicate with you

• Send transactional messages (claim verification, password resets, receipts, inquiry confirmations)
• Send opt-in marketing about new features, certifications, or content (you can unsubscribe from any marketing email; transactional messages will still come through)
• Respond to your support requests

4.3 Improve the Site

• Analyze how the Site is used so we can fix bugs and make it better
• Test new features
• Monitor performance and uptime

4.4 Process payments

• Stripe, Inc. processes all payments on our behalf. When you enter a payment card, your card data goes directly to Stripe under their privacy practices. We receive only a token and your billing address — not your full card number or CVV.

4.5 Comply with the law and protect rights

• Respond to lawful requests from government authorities
• Enforce our Terms of Service
• Investigate fraud, abuse, or security incidents
• Defend ourselves in legal proceedings

We do not use your information for automated decision-making that produces legal or similarly significant effects on you.

5. How we share information

We share your information only as described below. We do not sell your personal information for money. However, the Meta and Google ad tools on our pages for providers (see §6) may count as “selling” or “sharing” personal information for cross-context behavioral advertising under California law, so we treat them that way, ask before turning them on (see §6) and honor opt-outs (see §8). We never use those tools on patient pages.

5.1 Service providers we rely on

We use the following third parties to operate the Site. Each of them is contractually limited to using your data only as needed to provide their service to us:

• Hosting & infrastructure: SiteGround (web hosting), Supabase (authentication and database), Railway (application servers), Vercel (front-end hosting)
• Email delivery: Kit.com
• Payments: Stripe, Inc.
• Analytics: Google Analytics
• Advertising measurement: Meta Platforms (Meta Pixel and Conversions API) and Google Ads conversion tracking, on our pages for providers only (see §6). Meta and Google also use the data they receive under their own privacy policies.

5.2 Public display of provider information

Provider listings on the Site are intentionally public. By creating or claiming a listing as a provider, you agree that the information you add to your profile (bio, contact info you choose to show, insurance accepted, specialties, etc.) will be displayed publicly on the Site and may be indexed by search engines.

The base directory data (name, credentials, NPI, practice address from NPPES) is already publicly available via the federal NPPES file. Providers who do not wish to be listed may request removal at any time (see §7.2).

5.3 Legal, safety, and rights-protection

We may disclose your information if we believe in good faith that doing so is necessary to: comply with a law, regulation, subpoena, court order, or other legal process; respond to a lawful government request; protect the rights, property, or safety of ourselves, our users, or the public; investigate or prevent fraud, abuse, or security incidents; or enforce our Terms of Service.

5.4 Business transfers

If we are involved in a merger, acquisition, financing, reorganization, sale of assets, or bankruptcy, your information may be transferred to the successor or acquirer as part of that transaction, subject to the protections of this policy.

5.5 With your consent

We may share information for any other purpose disclosed to you at the time you provide the information, or with your explicit consent.

5.6 Refer a Colleague Program

Providers can invite colleagues to the Playbook with a personal link or code, under our Refer a Colleague Program Terms.

• If you buy through a provider’s link or code, that provider sees your first name and last initial, the date you enrolled, whether you paid in full or chose the 3-payment plan, how many payments you’ve made, and where the reward your purchase earned them stands (for example, waiting to clear, ready to use, or taken back after a refund). If your purchase earns them nothing, they may see why, for example that you already had the Playbook. They never see your email address, your payment details or anything else about you.
• When you open a provider’s invite link, we save their code in a cookie on your device for 30 days so it applies when you check out.
• If you refer colleagues, your invite page shows your name, credentials and certification status from your public listing, never your email address. We keep a record of each referral (your colleague’s name and email, their payments and your rewards) to pay rewards correctly, prevent fraud and meet our tax and accounting duties.
• Cash rewards are paid through Stripe Connect. Stripe collects your identity, tax and bank details directly, under Stripe’s privacy policy, and may use them to prepare tax forms such as a 1099 where the law requires. Stripe shares with us only what we need to pay you, such as whether your account can receive payouts and the payouts we send.
• You share your link yourself, from your own email or phone. We don’t collect the contact details of the colleagues you invite.

6. Cookies and similar technologies

A cookie is a small text file stored on your device. We use cookies and similar technologies (local storage, pixels) for these purposes:

• Strictly necessary: Keep you signed in, remember session state, protect against fraud and abuse. These cannot be disabled while still using the Site’s authenticated features.
• Preferences: Remember settings like language or display preferences.
• Analytics: Help us understand how the Site is used so we can improve it. You can opt out of Google Analytics with Google’s opt-out browser add-on.
• Advertising measurement (provider pages only): When we run ads for our provider training, we use the Meta Pixel (Facebook and Instagram) and Google Ads conversion tracking to see which ads led someone to sign up for the free lesson or make a purchase. These tools run only on pages built for healthcare providers, such as the free lesson, the Playbook, checkout, claim your listing and our membership pages. They never run on patient pages, such as provider listings, provider search, patient guides, the blog or our home page. We ask first. On those pages, a bar at the bottom of the screen asks whether we may use these ad cookies, and the tools load only after you tap “Allow”. If you tap “No thanks” or don’t answer, they stay off and we don’t send your free-lesson signup to Meta. We remember your answer for 12 months in a cookie of our own, and you can change it any time with the “Privacy choices” link at the bottom of those pages. If your browser sends a Global Privacy Control or “Do Not Track” signal, we don’t ask, and the tools stay off. Once allowed, the tools set third-party cookies, and when you sign up for the free lesson or buy, Meta may also receive a hashed (scrambled) version of your email address so it can count the signup or purchase. If you haven’t tapped “Allow”, we don’t report your signup or your purchase to Meta. You can also opt out at Meta ad settings and Google ad settings.

A provider’s booking calendar is different: it’s the scheduling company’s own page, with its own cookies, which aren’t ours. Nothing from it loads until you tap “See open times,” and for companies that use advertising or session-recording tools, we tell you first (see §12).

You can also block or delete cookies through your browser settings, but doing so may break certain Site features (notably the provider portal sign-in).

7. Your rights and choices

7.1 Account information

If you have a provider account, you can review and update most of your profile information by signing in to the provider portal at (https://portal.mydeprescriber.com) (or by emailing us if the portal isn’t available). To close your account, email privacy@mydeprescriber.com; we will close the account and remove your authentication credentials within a reasonable time.

7.2 Listing removal (for providers)

If you are a healthcare provider listed on the Site and you’d like to be removed, email privacy@mydeprescriber.com with the request and proof that you are the provider (a state medical/nursing license number plus the NPI matching the listing is usually sufficient). We will trash the listing within seven (7) business days of verification. Because the underlying NPPES data remains public, removal from our Site does not remove you from NPPES itself.

7.3 Marketing communications

To stop receiving marketing emails, click the “Unsubscribe” link in any marketing message we send, or email us. We will continue to send essential service messages (e.g., security alerts, transaction receipts) even after you unsubscribe from marketing.

7.4 Data subject requests

You may request:

• Access to the personal information we hold about you
• Correction of inaccurate or incomplete information
• Deletion of your personal information, subject to legal retention exceptions
• Portability — a copy of the information you provided to us in a structured, commonly used format

To make a request, email privacy@mydeprescriber.com from the email address associated with your account, or include enough information for us to verify your identity. We will respond within 45 days, with the possibility of a one-time 45-day extension if the request is complex.

8. California residents — your CCPA / CPRA rights

If you are a California resident, the California Consumer Privacy Act (as amended by the California Privacy Rights Act, together “CCPA”) gives you additional rights regarding your personal information.

Categories of personal information we collect

In the past 12 months, we have collected the following categories of personal information (as defined by the CCPA):

Rights you have

• Right to know what personal information we collect, the sources, the purposes, and the categories of recipients.
• Right to delete personal information we have collected from you, subject to legal exceptions.
• Right to correct inaccurate personal information.
• Right to opt out of “sale” and “sharing.” We don’t sell personal information for money, but the Meta and Google ad tools on our pages for providers (see §6) may count as selling or sharing under California law. Those tools stay off unless you tap “Allow” on the bar shown on those pages. To switch them off again, use the “Privacy choices” link at the bottom of those pages and tap “No thanks”. You can also turn on Global Privacy Control in your browser (we treat it as a valid opt-out request and never load those tools), or email privacy@mydeprescriber.com. Patient pages never use these tools.
• Right to limit use of sensitive personal information. We collect a limited category of sensitive personal information (account passwords; DEA numbers when voluntarily submitted by providers). We use sensitive information only for the purposes for which it was collected.
• Right against retaliation. We will not deny you service, charge you different prices, or provide you a different level of quality because you exercised your CCPA rights.

To exercise any of these rights, email privacy@mydeprescriber.com. We will verify your identity (typically by matching to an account email or by two-factor confirmation) and respond within 45 days.

You may also designate an authorized agent to make a request on your behalf; the agent must provide written authorization signed by you.

9. Children’s privacy

The Site is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. If you believe we have collected information from a child under 13, please contact us at privacy@mydeprescriber.com and we will delete it.

10. Security

We take reasonable administrative, technical, and physical safeguards designed to protect personal information against loss, theft, misuse, unauthorized access, disclosure, alteration, and destruction. Examples include encryption of authentication credentials, encryption of sensitive fields (such as DEA numbers) at rest, access controls on our administrative tools, and TLS for all data transmitted between your browser and our servers.

No security system is perfect. We cannot guarantee absolute security and will not be liable for unauthorized access that occurs despite our reasonable safeguards.

11. Data retention

We retain personal information only as long as needed for the purposes described in this policy or as required by law. In general:

• Provider account information: kept while your account is active, then for up to 18 months after closure to comply with potential legal and regulatory record-keeping requirements
• Inquiry messages from patients: delivered to the provider and retained by us only for the time necessary to confirm delivery (typically 30 days)
• Payment records: kept for the period required by tax law (typically 7 years for U.S. tax records)
• Server logs and analytics: typically kept for 12 months in identifiable form, then aggregated or deleted
• Public NPPES-sourced directory data: refreshed monthly from the public CMS file; out-of-date entries are not retained beyond the next refresh

12. Third-party links

The Site may contain links to third-party websites or services we do not control (e.g., a provider’s own practice website). Once you leave our Site, the third party’s privacy policy and terms govern your relationship with them. We are not responsible for the privacy practices of any third-party site.

Booking calendars. Some Featured providers let you pick an appointment time right on their profile or search card. That calendar is the provider’s own booking page from a scheduling company (for example, Calendly or Acuity Scheduling), run by that company, not by MyDeprescriber.com. Nothing from it loads until you tap “See open times.” It then opens in a sealed-off frame that can’t read this Site. Anything you enter there, such as your name, contact details or reason for the visit, goes to the provider and their scheduling company under their privacy policy. We don’t receive it. The scheduling company’s page can set its own cookies. Some of these companies also use advertising cookies, or tools that record how visitors use their page. For those companies, we tell you before the calendar opens, so you can choose whether to open it. We only count that the button was tapped, the same way we count other contact clicks, so providers can see how their listing is doing.

13. International users

The Site is operated from the United States and intended for use by individuals located in the United States. If you access the Site from outside the United States, you acknowledge that your information will be processed in the United States, where data-protection laws may differ from those of your jurisdiction.

14. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last Updated” date at the top and, for material changes, provide additional notice (such as a notice on the Site or an email to registered users). Your continued use of the Site after we post changes constitutes your acceptance of the revised policy.

15. Contact us

Questions, comments, or requests under this Privacy Policy can be directed to:

MyDeprescriber.com, LLC
Attention: Privacy
4815 E Carefree Hwy
Ste 108-130
Cave Creek, AZ 85331

Email: privacy@mydeprescriber.com

16. Bot protection

To prevent automated abuse of the forms on this site (for example, the “invite a provider” tool on directory listings), we use Google reCAPTCHA v3. reCAPTCHA runs quietly in the background, analyzes browser-level signals like mouse movement and timing, and returns a risk score that tells us whether the submission looks human or robotic. You won’t see a checkbox or a “pick the traffic lights” challenge — it’s invisible.

Google receives information about your visit that’s necessary for the risk score (such as your IP address, browser fingerprint, and reCAPTCHA cookies set by google.com). We never see the underlying data Google uses — only the resulting score for your specific form submission.

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

17. Location detection

When you land on the Find a Provider page without already telling us where you are, your browser sends a quick lookup request to ipapi.co, a third-party service that maps IP addresses to approximate locations (typically city-level — not GPS-precise). Your browser sends the request directly; our server never sees the IP for this lookup, and we never log it.

If a 5-digit ZIP comes back, we use it to pre-fill a search for providers within 10 miles of that ZIP, expanding to 15, 20, 50, and finally 100 miles only if nothing closer matches. You can override the detected location at any time — the “Change” link on the results page lets you type any ZIP, city, or state. Detection only runs once per browser session and never on any page outside /find-a-provider/.

If the lookup fails (you’re on a VPN, your network blocks the request, or ipapi.co returns no usable result), we show a “couldn’t detect your location” prompt asking you to enter a ZIP manually. No alerts, no errors, no further attempts.

We do not store your detected location in our database. It lives only in your browser’s session storage for the duration of your visit, so you don’t get re-prompted on every page reload.