Privacy Policy

What we collect

Account and contact: your email address and mobile number, used for sign-in codes and renewal reminders.

Identity and license: your legal name, profession, state, license number, license expiration and your NPI number. We collect these to verify you against official sources. We never ask for your Social Security number or any government ID number.

Verification records: what state licensing boards and the federal NPPES registry return about your license and NPI, with the source and time of every check. You can see every check run on you.

Profile: what you choose to add — work history, education, certifications, languages, patient populations, job preferences, a photo, a resume. Some fields are private by design (desired pay, references, your current employer and current caseload details): they are never shown to employers and are used only as described below.

CEU records: courses you log, their hours and topics, and certificate files you upload.

Payments: handled by Stripe. We receive your subscription status and plan; your card number never touches our servers.

Technical basics: the logs any web service keeps (time, pages requested, errors) to run and secure the service.

Where it comes from

From you, when you sign up, build your profile, or upload a document.

From official sources, when we verify you: your state licensing board's public records and the federal NPPES registry.

From Stripe, when you subscribe: confirmation of what you paid for, never your card details.

How we use it

To verify your license and NPI and show your verification status and badges.

To track your CEU hours against your state's renewal rules and remind you before deadlines (we send renewal reminders automatically; verification messages are sent only when a human reviewer decides your case).

To match you with job listings using the preferences you set — desired pay is used only for matching and is never shown to an employer.

To read documents you upload, if you choose: when you upload a resume or a CEU certificate, its content is read by our AI provider (Anthropic) to pre-fill forms for your review. Anthropic does not use this data to train its models. Nothing is added to your profile until you approve it.

To run the service: sign-in, support, preventing abuse, and payments.

What employers see

Today: nothing. Employer accounts do not exist yet.

When employer features launch: only what you consent to. Your name stays hidden until you say yes to a specific employer; private fields are never shown; and an organization matched to your current employer can never see your profile, even after it joins and is verified.

Who we share with

Service providers that run the platform under contract: Supabase (database and file storage), Vercel (hosting), Resend (email delivery), Stripe (payments) and Anthropic (document reading, only when you upload a document). Each receives only what its job requires.

Official sources, in the course of verifying you (we look you up; we don't send them your profile).

Authorities, if the law requires it.

We do not sell your personal information, and we do not share it for targeted advertising.

How it's protected

Every profile is readable and editable only by its owner, enforced in the database itself (row-level security), not just in the screens.

Photos, resumes and certificates live in private storage; access is through short-lived links issued only to you.

Verification evidence is written only by our servers, so it can't be tampered with from a browser.

Retention and deletion

We keep your data while your account is active. Verification records are kept as an audit trail of checks we ran.

You can delete your account and data yourself in the app (Profile → Account & privacy → Delete my account), or email gabriel@hlthhv.com and we'll do it for you. Deletion removes your profile, documents, verification history and sign-in, and cancels any subscription. Records we must keep (for example payment records Stripe holds for tax purposes) are kept only as long as the law requires.

Your rights

You can see and correct your information in the app, download it all from Account & privacy, and delete your account there too. New Jersey residents have rights under the New Jersey Data Privacy Act, including access, correction, deletion and portability; residents of other states may have similar rights.

To exercise any right, email gabriel@hlthhv.com. We will not treat you differently for doing so.

Who this service is for

Project Spotlight is for licensed clinicians and clinicians-in-training who are 18 or older. It is not directed to children, and we do not knowingly collect children's data.

Changes and contact

If this policy changes in a way that matters, we'll tell you in the app or by email before the change takes effect. Questions: gabriel@hlthhv.com.