PRIVACY POLICY

This Privacy Policy explains how WeGotDocs LLC collects, uses, discloses, and protects personal information through wegotdocs.com and our applications. By using the Platform you agree to this Policy. Capitalized terms have the meanings in the Terms and Conditions.

1. INFORMATION WE COLLECT

1.1 Information You Provide

• Patients: name, email, phone number, ZIP code, requested appointment details, reason for visit (optional), insurance carrier (optional), reviews and ratings you submit, and communications with us.
• Providers: name, professional credentials, license and NPI numbers, practice information, photographs, payment information, and communications with us.
• Account data: login credentials and account settings for all users.

1.2 Information Collected Automatically

Device and usage data including IP address, browser type, operating system, pages viewed, search queries on the Platform, referring URLs, and approximate location derived from IP address, collected via cookies and similar technologies described in our Cookie Policy (Document 8).

1.3 Information from Third Parties

Licensing-board and registry data used for provider screening (state license databases, NPPES, OIG LEIE); payment processors' transaction confirmations; and analytics providers.

2. HEALTH INFORMATION AND HIPAA

Information you submit to request an appointment (your name, contact details, the provider you selected, appointment time, and any reason for visit you volunteer) may constitute Protected Health Information. When we handle PHI on behalf of a healthcare provider, we do so as a HIPAA business associate under a Business Associate Agreement, and HIPAA governs that information in addition to this Policy. We do not sell PHI, do not use PHI for advertising, and do not disclose PHI except as permitted by HIPAA and our BAAs. WE DO NOT USE THIRD-PARTY ADVERTISING PIXELS OR TRACKING TECHNOLOGIES ON PAGES WHERE YOU ENTER APPOINTMENT OR HEALTH INFORMATION.

3. HOW WE USE INFORMATION

• To operate the Platform: matching searches to providers, transmitting booking requests, displaying profiles and reviews, and account administration.
• To screen provider credentials as described in the MSA.
• To communicate service messages, confirmations, and support responses.
• To send marketing communications where permitted, with opt-out honored in every message (we do not send marketing based on health information).
• To secure the Platform, prevent fraud and fake reviews, and enforce our policies.
• To comply with law and legal process.
• To create aggregated, de-identified data (de-identified per applicable standards, including 45 C.F.R. § 164.514 where HIPAA applies) for analytics and product improvement.

4. HOW WE DISCLOSE INFORMATION

• To the provider you select, to fulfill your booking request.
• To service providers (hosting, email delivery, payment processing, analytics, customer support) bound by contracts limiting their use of your information, including BAAs where PHI is involved.
• In connection with a merger, acquisition, financing, or sale of assets, subject to this Policy and, for PHI, HIPAA.
• To comply with law, enforce our agreements, or protect rights, safety, and security.
• With your direction or consent.

WE DO NOT SELL YOUR PERSONAL INFORMATION FOR MONEY. We do not "share" personal information for cross-context behavioral advertising as defined by the CCPA, and we do not use or disclose sensitive personal information for purposes requiring a right to limit under the CCPA.

5. YOUR CHOICES AND RIGHTS

• Access, correction, deletion: you may access and update account information in settings or request access, correction, or deletion at privacy@wegotdocs.com.
• Marketing opt-out: use the unsubscribe link in any marketing email.
• Cookies: manage preferences as described in the Cookie Policy, including Global Privacy Control signals, which we honor where required.
• Reviews: you may request deletion of a review you authored; note providers may retain lawful copies of prior responses.

6. STATE PRIVACY RIGHTS — CCPA/CPRA NOTICE (CALIFORNIA) AND OTHER STATES

This section applies to residents of California and, as applicable, other states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and others). Categories of personal information we collect are described in Section 1; categories of recipients in Section 4; we retain information as described in Section 8. We do not sell personal information and have not done so in the preceding 12 months; we do not share personal information for cross-context behavioral advertising; and we do not knowingly collect information of consumers under 16 for sale or sharing.

You have the right to: (a) know/access the personal information we hold about you, including categories, sources, purposes, and recipients; (b) delete personal information, subject to legal exceptions (note: information held as PHI under HIPAA is exempt from CCPA but subject to your HIPAA rights through your provider); (c) correct inaccurate personal information; (d) data portability; (e) opt out of sale/sharing (not applicable, as we do not sell or share); (f) limit use of sensitive personal information (not applicable, as we use it only for permitted purposes); and (g) non-discrimination for exercising rights.

To exercise rights, email privacy@wegotdocs.com. We will verify your identity using account information and respond within 45 days (extendable once by 45 days with notice). You may designate an authorized agent with written permission. We do not offer financial incentives in exchange for personal information.

Washington and Nevada residents: to the extent we process "consumer health data" not covered by HIPAA, you have rights to access, delete, and withdraw consent under the My Health My Data Act and similar laws; our Consumer Health Data Privacy Notice is available at wegotdocs.com/health-data-privacy or by request.

7. SECURITY

We maintain administrative, technical, and physical safeguards appropriate to the sensitivity of the information, including encryption in transit and at rest, access controls, audit logging, and an incident response plan. No system is perfectly secure; please use a strong unique password and notify security@wegotdocs.com of suspected compromise. If a breach affecting your information occurs, we will notify you and regulators as required by law.

8. RETENTION

We retain personal information for as long as needed for the purposes described, to comply with legal obligations (including HIPAA retention obligations applicable to business associates), to resolve disputes, and to enforce agreements, after which it is deleted or de-identified. Booking records are retained for a minimum of six (6) years where required under HIPAA.

9. CHILDREN

The Platform is not directed to children under 13 and we do not knowingly collect their personal information. Parents/guardians may submit booking requests on behalf of minors; such information is handled as PHI where applicable.

10. INTERNATIONAL USERS

The Platform is operated from the United States and intended for U.S. users. If you access it from elsewhere, your information will be transferred to and processed in the U.S.

11. CHANGES; CONTACT

We will post changes to this Policy with an updated date and, for material changes, provide additional notice. Questions or requests: privacy@wegotdocs.com