Privacy Policy

Overview

This Privacy Policy explains how Provindex LLC (“Provindex,” “we,” “us,” or “our”) collects, uses, discloses, and protects information when you visit Provindex, create an account, or use our provider-search and Medicare-enrollment monitoring services (the “Service”).

Provindex is a business tool for healthcare organizations. We primarily process two kinds of information: (1) account and billing information about the people and organizations who use the Service, and (2) public provider data that we obtain from federal government sources (described in Public provider data). By using the Service, you agree to this Policy. If you do not agree, please do not use the Service.

Information we collect

Information you provide. When you sign up and use the Service, we collect:

• Account details — your name, email address, and (if you upload one) a profile photo.
• Organization and team data — your organization name, the team members you invite, their email addresses, and the roles you assign them.
• Service content — the providers and lists you create or monitor, your notification preferences, and any corrections or information you submit.
• Payment information — when you subscribe to a paid plan, our payment processor (Stripe) collects and processes your payment details. We do not store full payment card numbers; we receive limited billing information such as your plan, subscription status, and the last four digits and brand of your card.
• Communications — the contents of messages you send us (for example, through our contact form or support email).

Information collected automatically. When you use the Service, we and our service providers may automatically collect log and usage data such as your IP address, browser type, device information, pages viewed, searches run, and the dates and times of your activity. We use cookies and similar technologies to operate and secure the Service (see Cookies & tracking).

Information from third parties. If you log in using a third-party login provider (such as Google), we receive basic profile information from that provider — typically your name, email address, and account identifier — as permitted by your settings with that provider.

Public provider data

A core part of the Service is a searchable directory of healthcare providers built from publicly available federal data, including the National Plan and Provider Enumeration System (NPPES), the Medicare PECOS Ordering/Referring file, and the NUCC taxonomy code set. This information — such as a provider’s name, National Provider Identifier (NPI), practice address, taxonomy, and Medicare enrollment status — is published by the U.S. government and is not collected from you.

Provindex is not affiliated with, endorsed by, or sponsored by the Centers for Medicare & Medicaid Services (CMS), Medicare, the U.S. Department of Health and Human Services, or any government agency. If you are a provider and wish to have your profile suppressed from Provindex, contact us at privacy@provindex.com. Suppressing a profile on Provindex does not change the underlying government records, which remain public at their source.

How we use information

We use the information described above to:

• provide, operate, maintain, and improve the Service;
• create and manage your account, organization, team members, and roles;
• detect changes to the providers you monitor and send you the alerts and digest notifications you have enabled;
• process payments, manage subscriptions, and send billing notices;
• respond to your inquiries and provide customer support;
• monitor, secure, and troubleshoot the Service, and prevent fraud and abuse;
• send you administrative or transactional messages (such as login links, invitations, and account or policy updates); and
• comply with legal obligations and enforce our Terms of Service.

We send transactional and account-related messages because they are necessary to provide the Service. Where required by law, we will obtain your consent before sending marketing communications, and you can opt out of marketing at any time.

Cookies & tracking

We use cookies and similar technologies that are strictly necessary to run the Service — for example, to keep you signed in and to protect against fraud and abuse. We may also use limited analytics to understand how the Service is used so we can improve it. You can control cookies through your browser settings; disabling strictly necessary cookies may prevent parts of the Service from working. We do not use cookies to sell your personal information.

How we share information

We do not sell your personal information. We share information only as described below:

• Within your organization. If you join or are invited to an organization, administrators and members of that organization may see your name, email, role, and activity within the shared workspace.
• Service providers (subprocessors). We share information with vendors that perform services on our behalf, under contracts that require them to protect it — including Stripe (payment processing), our email provider (transactional email and digests), third-party login providers you choose to use, and our cloud hosting and database infrastructure providers.
• Legal and safety. We may disclose information if required by law, subpoena, or legal process, or if we believe in good faith that disclosure is necessary to protect our rights, your safety or the safety of others, investigate fraud, or respond to a government request.
• Business transfers. If we are involved in a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred as part of that transaction. We will notify you of any change in ownership or use of your personal information.
• Aggregated or de-identified data. We may share information that has been aggregated or de-identified so that it cannot reasonably be used to identify you.

Data retention

We retain personal information for as long as your account is active and as needed to provide the Service, comply with our legal obligations, resolve disputes, and enforce our agreements. When information is no longer needed, we delete or de-identify it. Public provider data is retained as part of the directory and refreshed from government sources.

Security

We use administrative, technical, and organizational measures designed to protect personal information — including encryption in transit, access controls, and secure infrastructure. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential.

Your rights & choices

You can review and update your account information in your settings, or ask us to access, correct, or delete your personal information. You may opt out of marketing communications at any time. To exercise these choices, contact us at privacy@provindex.com. We may need to verify your identity before acting on a request, and some information may be retained as permitted or required by law.

U.S. state privacy rights

Depending on where you live, you may have additional rights under state privacy laws (for example, in California, Virginia, Colorado, Connecticut, Texas, Oregon, and other states). These may include the right to know or access the personal information we hold about you, to request correction or deletion, to opt out of certain processing, and not to be discriminated against for exercising your rights. We do not sell personal information or share it for cross-context behavioral advertising. To exercise any of these rights, contact us at privacy@provindex.com.

International users

Provindex is operated in the United States and intended for users in the United States. If you access the Service from outside the United States, you understand that your information will be processed in the United States, where data-protection laws may differ from those in your country.

Children’s privacy

The Service is a business tool intended for users who are at least 18 years old. It is not directed to children, and we do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, contact us and we will delete it.

HIPAA & health data

Provindex processes public provider directory data and customer account information only. We are not a HIPAA “covered entity” or “business associate,” and the Service is not designed to receive, store, or process protected health information (PHI) or any patient-identifiable health data. You agree not to upload, enter, or transmit PHI or other patient health information through the Service. Provider information available through the Service comes from public government records, not from patient records.

Third-party links

The Service may contain links to third-party websites or services that we do not control. This Policy does not apply to those third parties, and we are not responsible for their privacy practices. We encourage you to review the privacy policies of any third-party services you use.

Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above and, where appropriate, provide additional notice. Your continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

Contact us

If you have questions about this Privacy Policy or our privacy practices, contact us at privacy@provindex.com or by mail at Provindex LLC, 123 Example St, Suite 100, Your City, ST 00000.