Privacy policy.

This Privacy Policy explains how shrinkMD Publishing LLC, a Florida limited liability company (“Company,” “we,” “us,” or “our”), collects, uses, discloses, and protects personal information in connection with HandshakeMD, located at handshakemd.com, and related websites, directories, tools, features, and services that we operate collectively as the “Platform.”

This Privacy Policy applies to visitors, healthcare professionals, practice representatives, account holders, and other users of the Platform. It does not describe the privacy practices of independently listed healthcare professionals or practices.

As of the date of this policy there are no accounts on the Platform and nobody has a password here. A clinician confirms availability through a single use link sent to the address on the listing, which is why no login exists to protect. The account provisions in this policy are written so that they already apply on the day accounts are introduced, rather than being added afterwards, and the Cookie and Tracking Notice and the State Privacy Rights notice both describe the current position.

1The Platform is not a healthcare provider

The Platform is a professional directory, referral discovery, informational, and technology service.

The Company is not a healthcare provider, health plan, healthcare clearinghouse, or medical practice through operation of the Platform.

The Platform is designed so that ordinary directory and referral discovery functions do not require users to provide patient medical records or protected health information.

Do not send patient identifiable health information to us unless we expressly provide a feature designed and authorized for that purpose.

2Information we collect

The information we collect depends on how you use the Platform.

A. Information you provide directly. We may collect information that you voluntarily provide, including:

• name;
• email address;
• telephone number;
• login or account information;
• professional credentials;
• professional license information;
• National Provider Identifier information;
• specialty and subspecialty;
• practice name;
• professional biography;
• office address;
• website;
• professional photograph;
• practice logo;
• insurance participation;
• cash pay or fee information;
• telehealth availability;
• geographic service areas;
• populations served;
• referral criteria;
• availability or accepting referral status;
• professional affiliations;
• information submitted during verification;
• communications you send to us;
• support requests;
• reports of inaccurate listings;
• content submitted to professional or referral board features; and
• other information you choose to provide.

B. Account and verification information. If you create, claim, or manage a professional or practice listing, we may collect information used to confirm identity, professional status, affiliation, or authority. This may include:

• professional email address;
• practice domain email address;
• NPI;
• license number;
• state of licensure;
• professional taxonomy;
• practice affiliation;
• verification records;
• date and time of verification;
• records showing acceptance of Platform agreements; and
• information reasonably necessary to resolve listing ownership or authorization disputes.

We may compare submitted information with public or third party sources.

C. Information from public sources. We may collect professional information from lawful public sources, including:

• National Provider Identifier records;
• state licensing databases;
• licensing board websites;
• professional and practice websites;
• public business records;
• public professional profiles;
• publicly available directories; and
• other lawful public sources.

This information may be used to create, supplement, verify, or update professional listings.

D. Information collected automatically. When you access the Platform, we or our service providers may automatically receive certain technical information, such as:

• Internet Protocol address;
• browser type;
• device type;
• operating system;
• referring page;
• pages viewed;
• date and time of access;
• approximate location derived from IP address;
• security and fraud prevention information; and
• technical logs relating to Platform performance.

We aim to limit this collection to information reasonably necessary for operation, analytics, security, and improvement of the Platform.

As of the date of this policy, the Platform sets no cookies of any kind and stores nothing in your browser. Automatically collected information is limited to the standard request logs kept by our hosting provider. See section 11.

3Search activity

Users may search the Platform by specialty, condition, geographic area, insurance, availability, telehealth status, or other criteria.

Some searches could reveal or suggest information about health interests. For example, a search for a psychiatrist who treats obsessive compulsive disorder could potentially reflect an interest in that condition.

Our preferred architecture is to avoid linking raw health related search terms to persistent user profiles unless necessary to provide a feature expressly requested by the user.

Where reasonably possible, search analytics should be aggregated or deidentified.

We do not intend to create consumer medical profiles based on directory search activity.

As of the date of this policy, search on the Platform runs entirely inside your browser against a file your browser has already downloaded. Your search terms are not sent to us, are not logged by us, and cannot be received by us, because no request leaves your device when you search. This is a property of how the Platform is built rather than a policy we administer.

The sentence above is about searching, and there is one case it does not cover. If somebody arrives through an older link that carries search terms in a query string, the request that loaded the page already carried them before any of our code ran, and dropping them afterwards does not unsend them. We drop them immediately so they travel no further. Our Cookie and tracking notice explains the mechanism.

4Information we do not want users to submit

Unless we expressly provide a feature designed and authorized for such information, do not provide us with:

• patient names;
• dates of birth;
• medical record numbers;
• insurance member identifiers;
• identifiable diagnoses;
• identifiable treatment histories;
• prescriptions tied to identifiable patients;
• clinical records;
• photographs of patients;
• Social Security numbers;
• financial account credentials; or
• other patient identifiable medical information.

Professional users are responsible for ensuring that information they submit through directory, profile, referral board, or communication features does not improperly identify a patient.

5Locally processed tools

The Platform may provide tools that operate entirely or primarily within a user's browser or device.

For example, a Good Faith Estimate generator may allow a healthcare professional to enter patient related information for creation of a document without transmitting that information to the Company.

When a tool is specifically identified as locally processed:

• information entered into the tool is intended to remain on the user's device;
• the Company does not intend to receive, store, or retain the information entered;
• local processing does not mean the user's device, browser, extensions, network, or operating system is secure; and
• the user remains responsible for using an appropriate environment.

We will describe materially different data practices at the point of collection if a particular tool operates differently.

6How we use information

We may use personal information to:

• provide and operate the Platform;
• create and display professional listings;
• allow professionals and practices to claim or manage listings;
• verify professional identity or practice affiliation;
• maintain account security;
• communicate about listings;
• confirm professional availability;
• respond to support requests;
• correct or investigate listing information;
• prevent fraud, impersonation, spam, abuse, and security incidents;
• improve search and directory functionality;
• understand aggregated Platform usage;
• develop and improve features;
• maintain records of consent and agreement acceptance;
• enforce our Terms and other policies;
• protect legal rights;
• comply with law; and
• perform other purposes disclosed when information is collected.

7Professional information is intended to be public

Professional listings are generally intended for public display.

Information that may be publicly displayed can include:

• professional name;
• credentials;
• specialty;
• practice;
• professional biography;
• professional photograph;
• office location;
• contact information;
• professional website;
• NPI related information;
• license jurisdiction;
• referral criteria;
• availability;
• telehealth states;
• insurance information;
• fees;
• languages;
• population served; and
• other professional information.

Public professional information may be indexed by search engines and may remain temporarily available through third party caches even after it is changed or removed from the Platform.

One field is deliberately excluded. The email address we use to send a clinician their confirmation reminders is never displayed, never included in the search index, and never placed in the structured data on a listing page. Our build process fails rather than publishing a page containing it.

8How we disclose information

We may disclose information in the circumstances described below.

A. Public directory display. Professional listing information may be displayed publicly as part of the Platform.

B. Service providers. We may disclose information to vendors that help us operate the Platform, such as providers of:

• website hosting;
• cloud infrastructure;
• email delivery;
• security;
• analytics;
• fraud prevention;
• technical support;
• customer support;
• database services; and
• other operational functions.

Service providers are authorized to use information only as permitted by their agreements and applicable law.

As of the date of this policy the Platform uses three service providers: Cloudflare for hosting, edge computing, and the database that holds listing and confirmation records; Resend for sending email; and the public National Provider Identifier registry operated by the Centers for Medicare and Medicaid Services, which we query to check a submitted NPI. We have no analytics vendor and no advertising vendor.

C. Legal and safety reasons. We may disclose information if reasonably necessary to:

• comply with law, subpoena, court order, or lawful process;
• respond to governmental or regulatory requests;
• protect the rights, safety, or property of the Company, users, professionals, or others;
• investigate fraud or unlawful conduct;
• enforce our agreements;
• respond to intellectual property claims; or
• establish, exercise, or defend legal claims.

D. Business transactions. If the Company or Platform is involved in a merger, acquisition, financing, restructuring, bankruptcy, sale of assets, or similar transaction, information may be disclosed or transferred as part of that transaction subject to applicable law.

E. With your direction or consent. We may disclose information when you direct us to do so or otherwise consent.

9We do not sell patient referrals

The Company does not sell patient referrals or accept payment in exchange for directing a specific patient to a particular healthcare professional.

This is separate from privacy law definitions of “sale” or “sharing,” which can sometimes include certain transfers of personal information for advertising or other purposes.

Our privacy practices regarding advertising technologies are described below.

10Advertising and cross context behavioral advertising

The Platform carries no third party behavioral advertising technology. There is no advertising pixel, no remarketing tag, and no advertising or analytics vendor of any kind on any page. This is enforced by an automated check that loads every page, records every network request, and fails if anything leaves our own domain.

We do not disclose health related search activity to advertising platforms for cross context behavioral advertising. As described in section 3, we could not, because search terms never reach us.

If our advertising or tracking practices materially change, we will update this Privacy Policy and provide any notices, consent mechanisms, or opt out rights required by law.

This is especially important because regulators have taken action where health related websites or apps disclosed identifiable health information to advertising platforms without appropriate authorization or notice.

11Cookies and similar technologies

The Platform sets no cookies. It does not use localStorage, sessionStorage, or any other browser storage. There is no cookie banner because there is nothing to consent to.

If we later introduce cookies or similar technologies, it would be for purposes such as:

• maintaining sessions;
• account authentication;
• security;
• fraud prevention;
• remembering user preferences;
• measuring Platform performance; and
• aggregated analytics.

We will avoid unnecessary advertising or cross site tracking cookies, particularly on pages where search activity could imply health interests.

Where required by law, users would be provided with cookie choices or consent controls before any such technology was deployed.

The full detail is in our Cookie and tracking notice, which lists every technology found by an actual scan of the deployed site rather than a table written from memory, explains why there is no consent banner, and shows you how to check any of it in your own browser.

12Analytics

The Platform currently has no analytics tool installed. We do not measure individual visits, and we do not have a dashboard of user behavior.

If we add analytics, we will use privacy conscious tools configured to minimize collection of identifiable information and to avoid transmitting raw health related search queries to third parties, and we will update this policy before doing so.

Aggregated or deidentified analytics may be used for any lawful purpose.

13Fonts and other embedded resources

The Platform loads no fonts, scripts, stylesheets, maps, videos, or other resources from third parties. Typefaces are served from our own domain rather than from a font service, so loading a page sends no additional request and no IP address to Google Fonts or any other external font provider. That is narrower than it sounds and it is the accurate version: our hosting provider necessarily receives the request and your IP address in order to serve you the page at all, which section 11 describes. What self hosting removes is every request beyond that one. The same automated check described in section 10 enforces it.

If a third party resource were introduced, that third party could receive technical information such as an IP address when your browser connects to their service. The specific vendors used by the Platform may change over time, and this policy would be updated to say so.

14Legal bases where applicable

Where laws require a legal basis for processing, we may process personal information based on:

• performance of a contract;
• legitimate interests;
• legal obligations;
• consent; or
• another lawful basis recognized by applicable law.

15Data retention

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including:

• operating listings and accounts;
• maintaining verification records;
• maintaining records of agreement acceptance;
• responding to disputes;
• preventing fraud;
• complying with legal obligations;
• enforcing agreements; and
• establishing or defending legal claims.

Retention periods may vary depending on the type of information.

Public professional information obtained independently from lawful public sources may be retained differently from account information provided directly by a user.

16Data security

We use administrative, technical, and organizational safeguards that we believe are appropriate to the nature of the information processed.

However, no website, network, database, transmission, or storage system can be guaranteed completely secure.

Users are responsible for maintaining security over their own:

• account credentials;
• devices;
• browsers;
• networks;
• email accounts; and
• local files.

17Data breaches

If we experience a security incident involving personal information, we will evaluate and respond to the incident in accordance with applicable law.

Non HIPAA businesses that qualify as vendors of personal health records or related entities may be subject to the Federal Trade Commission Health Breach Notification Rule when unsecured identifiable health information is breached. The Commission's 2024 amendments expressly clarified that the Rule can apply to many health apps and similar technologies outside HIPAA.

The Platform is being designed to minimize the likelihood that we maintain consumer health records that would place ordinary directory operations within that framework.

18HIPAA

The Health Insurance Portability and Accountability Act (“HIPAA”) applies to covered entities and certain business associates.

Operation of a healthcare professional directory does not by itself make the Company a HIPAA covered entity or business associate.

Unless we expressly agree otherwise in writing for a specific service, users should not assume that the Platform is intended to function as a HIPAA covered clinical communication system or electronic health record.

Healthcare professionals remain responsible for determining whether their own use of any technology complies with HIPAA and other applicable privacy laws.

19Consumer health data

Certain state laws regulate health related information outside HIPAA.

For example, Washington's My Health My Data Act regulates certain consumer health data and requires covered businesses to maintain a separate Consumer Health Data Privacy Policy that is prominently linked on the homepage.

We aim to minimize collection of identifiable consumer health data. As described in section 3, search terms are processed in your browser and never reach us, and as described in section 11 we set no cookies and store nothing in your browser, so we hold no record linking any person to a health related search.

If the Platform's actual practices bring it within a state consumer health data law, we will provide the notices, consents, rights mechanisms, and separate policies required by applicable law.

We publish that separate policy rather than waiting to decide whether a particular state law reaches us. Our Consumer Health Data Privacy Policy is maintained separately from this general Privacy Policy, is linked from the homepage and from the footer of every page, and both policies apply.

20Your privacy rights

Depending on where you live and which laws apply to the Company, you may have rights regarding your personal information.

These may include rights to:

• know or access personal information;
• request correction;
• request deletion;
• obtain a copy of personal information;
• opt out of certain uses or disclosures;
• restrict certain processing;
• withdraw consent; or
• appeal a privacy rights decision.

Not every right applies in every jurisdiction or circumstance.

To submit a privacy request, email privacy@handshakemd.com. We may need to verify your identity before completing a request.

21California privacy rights

If the California Consumer Privacy Act, as amended, applies to the Company, California residents may have rights including:

• the right to know categories and specific pieces of personal information collected;
• the right to know sources and purposes of collection;
• the right to know categories of third parties receiving information;
• the right to request deletion;
• the right to request correction;
• the right to opt out of sale or sharing where applicable; and
• the right not to receive discriminatory treatment for exercising privacy rights.

California privacy notices must describe categories collected, sources, purposes, disclosures, and applicable rights, and generally must be updated at least annually when the Act applies.

If the Act does not apply to the Company because statutory thresholds are not met, we may nevertheless honor reasonable privacy requests voluntarily where practical.

22Nevada and other state privacy rights

Residents of other states may have rights under applicable state privacy laws.

Because state privacy laws and applicability thresholds change over time, we may update this section as the Platform grows or enters additional jurisdictions.

23Children

The Platform is intended for adults and healthcare professionals.

We do not knowingly collect personal information directly from children under 13 through account or professional listing features.

If you believe a child has provided personal information to us improperly, contact us so we can evaluate and address the issue.

24Professional information and privacy requests

Some professional information may already be public through government or other lawful public sources.

A request to delete an account does not necessarily require us to remove factual professional information that we are legally permitted to obtain and display independently from public sources.

We will evaluate requests in accordance with applicable law and Platform policy.

25Deidentified and aggregated information

We may create aggregated or deidentified information that does not reasonably identify an individual.

We may use or disclose such information for lawful purposes, including:

• analytics;
• product development;
• research;
• service improvement;
• operational planning; and
• reporting.

We will not intentionally attempt to reidentify information that we maintain as deidentified except as permitted by law.

26International users

The Platform is currently intended primarily for users in the United States.

If you access the Platform from outside the United States, information may be processed in the United States or other jurisdictions where our service providers operate.

Users outside the United States are responsible for determining whether their use of the Platform is lawful under local requirements.

27Third party websites

Professional listings may link to external websites, practices, scheduling systems, insurers, maps, or other services.

Those third parties have their own privacy practices.

We are not responsible for their privacy, security, or data handling practices.

Review the privacy policies of third party services before providing them with personal information.

28Changes to this Privacy Policy

We may update this Privacy Policy periodically.

The revised policy will display a new “Last Updated” date.

If changes materially affect how we use personal information, we may provide additional notice where appropriate or required by law.

29Contact us

Questions, privacy requests, or concerns may be directed to:

Privacy and privacy rights requests: privacy@handshakemd.com
General legal: legal@handshakemd.com

shrinkMD Publishing LLC, a Florida limited liability company
Operator of HandshakeMD
General correspondence: by email. We do not publish a general mailing address, because the address below is our registered agent rather than an office, and post sent to it for anything other than formal legal notice may not reach us.
Registered agent for service of process in Florida: Northwest Registered Agent LLC, 7901 4th St N Ste 300, St. Petersburg, FL 33702
Every contact route in one place: Legal notices and contact information