Privacy Policy

Effective date: June 1, 2026

1. What We Collect

When you create an account or use the API, we collect:

• Email address — used to deliver your API key and communicate account-related information.
• API usage data — each API request is logged with a timestamp and endpoint path, associated with your key. This is used for rate limiting, quota enforcement, and usage reporting in your account dashboard.
• Billing information — paid plans are processed by Stripe. We do not store credit card numbers; Stripe handles all payment data under their own privacy policy.

2. What We Do Not Collect

• We do not collect IP addresses beyond what your hosting provider logs at the network level.
• We do not use tracking cookies or analytics scripts on this website.
• We do not collect any information about the NPI numbers or provider data you query.

3. How We Use Your Information

• Deliver and manage your API key and account.
• Enforce plan quotas and rate limits.
• Send transactional emails (key delivery, billing receipts). We do not send marketing emails without your consent.
• Diagnose service issues and improve reliability.

4. Data We Distribute

The NPI provider data available through this service is a public record published by the U.S. Centers for Medicare & Medicaid Services (CMS). It includes names, addresses, taxonomy codes, and other information that healthcare providers have submitted to the federal government. This information is not private — it is publicly available at npiregistry.cms.hhs.gov and through the CMS bulk data download.

5. Data Sharing

We do not sell, rent, or share your personal information (email address, usage data) with third parties, except:

• Stripe — for payment processing on paid plans.
• Legal compliance — if required by law or valid legal process.

6. Data Retention

Account and usage data is retained for as long as your account is active and for a reasonable period afterward for billing and audit purposes. You may request deletion of your account data by emailing us.

7. Security

API keys are stored as SHA-256 hashes — we cannot recover your key if lost. Connections to this service use TLS. We take reasonable precautions to protect stored data, but no internet service is 100% secure.

8. Your Rights

You may request access to, correction of, or deletion of your personal data at any time by contacting us at support@providerdownload.com.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes via email.

10. Contact

Questions about this policy? Email support@providerdownload.com.