Privacy Policy

1. Introduction

Center Your Patient, LLC (“Center Your Patient,” “we,” “us,” or “our”) is a limited liability company established in Philadelphia, Pennsylvania. We operate Center Your Patient, a clinical reference tool for licensed healthcare providers, delivered as a Chrome extension and as a web version used in a browser.

This Privacy Policy describes how we collect, use, share, and protect your personal information when you use our website, Chrome extension, and related services (collectively, the “Service”). By using the Service, you agree to the practices described in this policy and to our Terms of Service.

2. Information We Collect

Account Information

When you create an account, we collect:

• Email address
• Full name
• Country of residence
• States in which you are licensed to practice
• Provider type (e.g., physician, nurse practitioner, etc.)

Usage and Technical Data

We collect information about how you interact with the Service, including your subscription status and feature-usage analytics (for example, which tools you open or copy), which is associated with your account so we can understand engagement and improve the product. Your preferences — such as favorites, hidden and minimized items, saved mental status exam options, and display settings — are saved to your account so they sync across your devices. None of this includes patient information or the clinical content you enter, which stays on your device and is copied only to your clipboard.

How you found us. If you sign up after following one of our own tagged links (for example, a link we posted in a professional forum), we save that link’s campaign labels with your account. We save only labels from links we created ourselves. We never save the website you were on or anything else about your visit, and we save nothing if website analytics is switched off in your browser (see Section 9). We use these labels only to count how many sign-ups and subscribers each link brings.

Feedback and support. If you send us feedback or a support request, or tell us why you are cancelling, we receive what you write, the options you choose, and your account email, so we can read and respond. Please do not include patient information.

Error reports. When something breaks in our web version or on our servers, we automatically record an anonymous error report: which page, what type of error, and where in our code it happened. Error reports are not linked to your account, do not include your IP address, and never include anything you typed.

Your agreement record. When you subscribe, we keep a record of your agreement to our Terms of Service — the version, the acknowledgments you confirmed, the date and time, and your IP address and browser type — as evidence of that agreement.

We also automatically collect limited technical data when you use the Service — such as your IP address, browser and device type, and approximate location (country, region and city) derived from your IP address — for security, fraud and abuse prevention, and aggregate analytics. When you sign in or sign up, our bot-protection provider processes technical signals to distinguish human users from automated traffic.

Payment Information

Payments are processed by Stripe, Inc. We do not store your credit card number, CVV, or full payment card details on our servers. Stripe may share with us limited information such as the last four digits of your card, card type, and billing address for record-keeping and support purposes. Please refer to Stripe's Privacy Policy for details on how they handle your payment data.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service
• Process subscription payments and manage billing
• Communicate with you about product updates, support inquiries, and account-related matters
• Analyze usage patterns to improve features and user experience
• Comply with legal obligations and enforce our Terms of Service

4. Information Sharing

We do not sell, rent, or trade your personal information to third parties. We do not share your data with advertisers.

We share limited information with the following service providers, solely to operate the Service:

• Stripe — payment processing and subscription management
• Supabase — authentication and database hosting
• Google — OAuth authentication (only if you choose to sign in with Google), plus email delivery and feedback handling (Gmail and Google Apps Script)
• Cloudflare — bot protection and abuse prevention (CAPTCHA) on sign-in and sign-up
• Railway — application and database hosting

We may also disclose information if required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of Center Your Patient, our users, or the public.

5. Chrome Web Store — Limited Use

Center Your Patient's collection and use of information through the Chrome extension comply with the Chrome Web Store User Data Policy, including its Limited Use requirements:

• Use — We use the data we collect only to provide and improve Center Your Patient's features (account authentication, subscription access, and product improvement).
• Transfer — We do not sell user data. We transfer it only to the service providers necessary to operate the product, to comply with applicable law, to protect against security threats and abuse, or in connection with a merger or acquisition.
• Advertising — We never use or transfer user data for personalized, retargeted, or interest-based advertising.
• Human access — We do not allow humans to read your data, except with your consent (for example, support you request), for security purposes, to comply with law, or in aggregated and anonymized form for internal operations.
• Web browsing activity — The extension reads the address of your current browser tab only locally on your device, to detect supported telehealth platforms and offer the floating video workspace. This information is never transmitted to us or any third party.

6. Data Security

We take the security of your information seriously. Measures we employ include:

• Encryption in transit using TLS (Transport Layer Security) for all data transmitted between your browser and our servers
• Encryption at rest for stored data
• Use of SOC 2 certified infrastructure providers (Supabase, Stripe)
• Access controls limiting employee and contractor access to personal data on a need-to-know basis

No method of transmission over the Internet or electronic storage is completely secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee absolute security.

7. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you the Service. Feature-usage analytics events are deleted after 13 months. Campaign labels saved at sign-up are kept with your account and deleted with it. Anonymous error reports are deleted after 90 days. Your agreement record is kept with your account. Feedback and support messages are kept for as long as needed to respond and to improve the Service. If you wish to delete your account and associated data, you may contact us at centeryourpatient@gmail.com, and we will process your request in accordance with applicable law, including the GDPR right to erasure.

We may retain certain information as required by law or for legitimate business purposes, such as fraud prevention or financial record-keeping.

8. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate or incomplete information
• Delete your personal information (right to erasure)
• Object to or restrict certain processing of your data
• Data portability — receive your data in a structured, machine-readable format

To exercise any of these rights, please contact us at centeryourpatient@gmail.com. We will respond within 30 days.

9. Cookies and Website Analytics

We use minimal, session-based cookies for authentication and security. These keep you signed in and maintain your session, and our bot-protection provider may set a necessary security cookie when you sign in or sign up. Our product analytics is first-party and does not rely on advertising cookies. We do not use advertising cookies, tracking pixels, or third-party advertising trackers.

Website analytics. To understand how people find and use our website, we use Umami, an analytics tool we host ourselves on servers in the United States. It does not use cookies and does not identify you. For each visit it records the pages viewed, the links and buttons clicked, the website that referred you, any campaign labels in the link you followed (for example “utm_source”), your browser, operating system, device type, screen size and language, and your approximate location (country, region and city). Your IP address is used only to group page views into a single visit and to estimate your location; it is not stored. Sign-in links and other one-time codes are removed from web addresses before anything is recorded, and we never record email addresses or anything you type. We do not record session replays or heatmaps. This is separate from the feature-usage analytics described in Section 2, which is associated with your account. The one exception is described in Section 2: if you sign up after following one of our tagged links, that link’s campaign labels (not your visit history) are saved with your account.

Your choices. Website analytics is switched off for any browser that sends a Do Not Track or Global Privacy Control signal. Our website has two parts, so you can also switch it off in your browser by visiting both of these addresses:

• https://centeryourpatient.com/?analytics=off
• https://app.centeryourpatient.com/login?analytics=off

To switch it back on, visit:

• https://centeryourpatient.com/?analytics=on
• https://app.centeryourpatient.com/login?analytics=on

The setting is stored only in your browser, so it applies to that browser and device, and clearing your browser data resets it.

Retention. Website analytics data is kept for 25 months and then deleted. Two years of history lets us compare the same months from one year to the next, so we can see how use of the website is changing over time, which pages and resources clinicians actually use, and whether our outreach reaches the people it is meant for; the extra month allows a full two-year comparison. Because this data does not identify you, we cannot locate or delete an individual visitor's records on request.

Server logs. Our hosting provider keeps technical logs of requests to our servers, including IP addresses, for 7 days, for security and troubleshooting.

10. Children's Privacy

Center Your Patient is intended for use by licensed healthcare providers and is not directed at individuals under the age of 18. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected information from a person under 18, we will promptly delete it.

11. International Users

Our Service is operated from and data is stored in the United States. If you access the Service from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your country.

For users in the European Union or European Economic Area, we process your data in compliance with the General Data Protection Regulation (GDPR). The legal bases for our processing include your consent, the performance of our contract with you, and our legitimate business interests.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. If we make material changes, we will notify you by email or by posting a prominent notice on our website prior to the change becoming effective. Your continued use of the Service after any changes constitutes acceptance of the updated policy.

13. Contact

If you have questions or concerns about this Privacy Policy or our data practices, please contact us: