State privacy rights, and do not sell or share.

This State Privacy Rights and Do Not Sell or Share Notice supplements the Privacy Policy for HandshakeMD, operated by shrinkMD Publishing LLC, a Florida limited liability company.

Several United States state privacy laws give residents specific rights over their personal information. This Notice explains those rights, gives plain answers on selling and sharing, and says how to exercise anything you want to exercise.

It is written on the assumption that the rights apply, which is a choice rather than a legal conclusion. Section 3 explains why, and section 4 explains the one area where the usual size thresholds do not help anybody.

1Scope

Several states have comprehensive consumer privacy laws, and this Notice may apply to residents of any of them, including:

• California;
• Colorado;
• Connecticut;
• Delaware;
• Indiana;
• Iowa;
• Montana;
• Nebraska;
• New Hampshire;
• New Jersey;
• Oregon;
• Tennessee;
• Texas;
• Utah;
• Virginia; and
• other states with applicable privacy laws, including states whose laws take effect after the date of this Notice.

That list is not a promise of completeness. States keep passing these laws and we are not going to maintain a perfectly current roster inside a legal page, so the operative rule is in section 28: tell us the state you live in, and we will work out what applies rather than asking you to.

Which rights you actually have depends on:

• the state you reside in;
• whether that state's statute applies to this Company at all;
• the kind of information involved;
• statutory exemptions; and
• what we are actually doing with the information.

Not every right exists in every state, and not every state law reaches every business. Section 3 is about that second point specifically, because it is the one most likely to matter here.

2The short version

We do not sell personal information. We do not share it for cross context behavioural advertising. We do not use it for targeted advertising or for profiling that decides anything about you. There is no advertising on this Platform at all.

Those are current facts rather than intentions, and three of them are enforced by checks that fail the build rather than by anybody remembering. The Cookie and tracking notice describes the checks and shows you how to verify the results in your own browser.

So the practical position is unusual: most of the opt out rights this Notice describes have nothing to switch off. That is not a reason to leave them undescribed, because your rights do not depend on our current architecture, and the architecture could change. Sections 12 to 15 give the plain answers, and section 38 says what would have to happen before any of them moved.

3Whether these laws apply to us at all

Being straightforward about something most privacy pages leave vague. Most comprehensive state privacy laws only reach a business once it passes a threshold, usually expressed as a number of residents whose data it processes in a year, or a level of revenue, or a share of revenue from selling data. A company at this Platform's current size is probably below all of those thresholds.

We are not relying on that, and this Notice is written as though the rights apply. Two reasons. Thresholds get crossed, usually without anybody noticing on the day it happens. And a directory that told you it was too small to bother with your privacy rights would be telling you something about itself rather than about the law.

There is also a category where the threshold argument does not work at all, and it is the category this Platform sits closest to. Section 4.

4The health data laws are different, and they have no threshold

Washington's My Health My Data Act does not have a size threshold. It reaches any regulated entity that conducts business in Washington, or targets Washington consumers, and collects consumer health data. Nevada has taken a similar approach. A national clinician directory does business everywhere by definition, and searching for a clinician who treats a particular condition is the kind of activity those statutes were written about.

So the more realistic exposure for this Platform is not the comprehensive privacy laws with their thresholds. It is the health data laws, which apply on day one at any size. That is why the Consumer Health Data Privacy Policy is a separate document with its own commitments and its own enforced technical rules, rather than a paragraph inside the privacy policy.

If you are exercising a right about anything health related, that document is the one that governs, and it is more protective than this one. Where the two overlap, the more protective treatment applies.

5What sale can mean

Under several state laws, a sale is wider than the ordinary meaning of the word.

Depending on the statute, a sale can include a transfer of personal information in exchange for:

• money;
• other valuable consideration; or
• another commercial benefit.

Which means a business can be making a legally defined sale without ever selling a list for cash. Handing data to an advertising platform in return for cheaper advertising is the standard example, and a lot of businesses that would sincerely tell you they do not sell data are doing exactly that.

This Notice uses the wider statutory meaning throughout rather than the narrow everyday one, because that is the reading that favours you and it is the one that would be applied to us.

6What share can mean

California law separates sharing from selling. Sharing covers disclosing personal information for cross context behavioural advertising, which is the practice of using what you did on one site to target you on another. No payment needs to change hands for it to count.

We do not do it, with anybody, and specifically not with health related search activity. There is no advertising technology on this Platform, which is checked on every build.

7Targeted advertising

Several state laws give you a right to opt out of targeted advertising. We do not engage in targeted advertising, so there is nothing here for that right to switch off.

If targeted advertising were ever introduced, the required disclosures and opt out mechanisms would go in before it was deployed, not after. That commitment is in section 38 with the rest of them.

8Profiling

Several state laws give you rights about profiling used to make decisions with legal or similarly significant effects. We do not make automated decisions about:

• employment;
• housing;
• insurance eligibility;
• credit;
• healthcare treatment;
• access to essential services; or
• anything else of similar consequence.

Worth being specific about what the Platform does do, since a directory does rank results. Search results are ordered by criteria a user chose plus how recently a clinician confirmed availability. There is no scoring of clinicians by quality, no model predicting anything about a user, and no paid placement. Nobody's access to anything is decided here, and the Verification standards page describes what the badges do and do not mean.

9Categories of personal information we collect

This is the section where most privacy notices list every category the law names and call it a disclosure. The list below is what this Platform actually collects, and the categories it does not collect are named too, because a reader cannot tell the difference between a cautious list and a real one unless somebody says which it is.

What we collect, from clinicians and practice representatives:

• identifiers, meaning name, professional credentials, and National Provider Identifier;
• contact information, including a practice address, phone number, and email;
• professional information, including specialty, licence details, insurance accepted, and availability;
• verification information, meaning what we checked, against which source, and on what date;
• records of agreement acceptance, meaning which document version was accepted and when; and
• communications you send us.

What we collect from people searching the directory:

• nothing that identifies you, and no account, because there is no account to make;
• no search terms, because search runs inside your browser and the terms are never transmitted; and
• the standard technical information in any web request, which our hosting provider receives in order to serve the page: an IP address, a timestamp, the page requested, and browser headers.

Categories a notice like this often claims and this Platform does not collect:

• precise geolocation;
• biometric information;
• government identification numbers;
• financial account information;
• account credentials, since there are no accounts;
• cookie or device identifiers, since there are none;
• browsing activity across other websites; and
• any inferred profile of you, health related or otherwise.

The Privacy Policy has the full detail. If a category above is ever added, that policy and this Notice change before the collection starts.

10Sources

Personal information reaches us from:

• you, when you submit or claim a listing or write to us;
• your use of the Platform, limited to the technical information in section 9;
• National Provider Identifier records;
• state licensing databases and boards;
• practice and professional websites;
• public business records;
• authorised practice representatives; and
• our service providers, for hosting, security, and email delivery.

Public professional information is a real category here rather than a formality, and section 35 explains what that means for a deletion request.

11Why we process it

To:

• operate the Platform;
• create, display, and maintain listings;
• verify professionals and practices;
• provide search;
• send listing confirmations and reminders;
• communicate with clinicians about their own listings;
• prevent fraudulent or abusive listings;
• respond to support, correction, and privacy requests;
• keep records of which agreement version somebody accepted;
• comply with law; and
• enforce our agreements and protect legal rights.

Not on that list, and not something we do: advertising, of any kind, targeted or otherwise. Also not on it: analytics, because there is none installed.

12Categories disclosed, and to whom

Personal information goes to:

• our hosting and content delivery provider, which receives the technical information in any web request;
• our transactional email provider, which receives the address a listing confirmation is sent to;
• professional advisers, where we need advice;
• governmental authorities, where the law requires it; and
• a party to a business transaction, if the Company were ever sold or merged.

Each of those is a service provider or processor acting on our instructions rather than a party free to use the information for its own purposes, and none of it is a sale or a share. Listing information is displayed publicly, because a directory that nobody can read is not a directory, and the Clinician listing agreement is where a clinician agrees to that.

One deliberate exception. The email address we use to send a clinician their confirmation reminders is not published, and the build refuses to publish it, which is a check rather than a habit.

13Do we sell personal information?

No.

Not for money, and not in the wider statutory sense described in section 5. We do not trade personal information for services, for cheaper advertising, or for any other commercial benefit, and there is no arrangement of that kind with anybody.

If that ever changed, this Notice would be updated and a real opt out mechanism would exist before the practice started.

14Do we share personal information for cross context behavioural advertising?

No.

No advertising technology is present on this Platform, and specifically no health related search activity is disclosed to an advertising network, because search activity never leaves your browser in the first place. There is nothing to disclose.

15Do not sell or share my personal information

Because we do not sell or share personal information, there is no active practice for this request to stop. Under California law a business that sells or shares has to publish a conspicuous link with this heading. We do neither, so there is no such link on this site, and we would rather explain that than build a switch that turns off something that is not happening.

You can still send the request, and some people reasonably want it on the record. Email privacy@handshakemd.com with Do Not Sell or Share My Personal Information in the subject line. We will confirm the position in writing and treat it as standing, so if the practice ever changed you would be outside it from the start rather than needing to ask again.

16Global Privacy Control and other opt out signals

Global Privacy Control is a signal your browser or an extension can send saying you do not want your personal information sold or shared. Several state laws require a business to treat a recognised signal as a valid opt out, and Colorado maintains a list of approved universal opt out mechanisms.

We do not sell or share, so there is nothing for the signal to switch off, and receiving it needs no action from us beyond continuing not to do the thing. We have deliberately not written that we have built support for it, because we have not, and claiming a feature that has not been implemented and tested is the kind of statement that comes back.

If sale or sharing ever began, honouring recognised opt out preference signals would be built and tested first.

17Right to know

Where it applies, you can ask us for:

• the categories of personal information we have collected about you;
• where it came from;
• why we collected or used it;
• the categories of recipients it went to;
• the categories sold or shared, which is none; and
• the specific pieces we hold about you.

Sections 9 to 12 answer most of that for everybody at once, which is deliberate. A rights page that makes you file a request to learn what a company collects is using process as an answer.

18Right to access

You can ask for a copy of the personal information we hold about you. We may need to verify who you are first, and section 31 says how we go about that.

19Right to correction

You can ask us to correct anything inaccurate. For a professional listing there is a faster route than a formal privacy request: email listings@handshakemd.com and we will fix it, usually the same day, without any of the verification ceremony a privacy request involves.

A correction request is not treated as a complaint. A directory with wrong information in it is our problem before it is yours.

20Right to deletion

You can ask us to delete personal information. Deletion is subject to exceptions, and the honest ones are:

• information reasonably necessary to provide something you asked for;
• security and fraud prevention;
• compliance with a legal obligation;
• exercising or defending legal claims;
• records showing which version of an agreement somebody accepted, which we keep because deleting them would destroy the evidence of what a clinician agreed to; and
• factual professional information we obtained independently from lawful public sources, which section 35 explains.

For a clinician, deletion in the ordinary sense means the listing comes down. That we will do on request, promptly, with no argument and no retention period we have invented for our own convenience.

21Right to data portability

Where it applies, you can have the information we hold about you in a portable, machine readable format. For a listing that is straightforward, because a listing already is a structured record, and we will send it as JSON or CSV, whichever you prefer.

22Right to opt out of targeted advertising

Where it applies, you can tell us to stop processing your personal information for targeted advertising. We do not do it, so the request is granted the moment it arrives, and section 7 has the detail.

23Right to opt out of profiling

Where it applies, you can opt out of profiling used to make decisions with legal or similarly significant effects. We do not do that either, and section 8 says what the Platform does instead, including how search results are actually ordered.

24Sensitive personal information

Several state laws give extra protection to sensitive personal information. Depending on the statute, that can include:

• precise geolocation;
• account credentials;
• government identifiers;
• racial or ethnic origin;
• religious beliefs;
• sexual orientation;
• immigration status;
• health information; and
• biometric information.

We collect none of those from people using the directory. The one category anywhere near this Platform is health information, and it arrives, if at all, as an inference somebody could draw from a search. That is exactly why search was built to run in your browser: there is no inference to protect, because there is no search record.

Consumer health data is governed by the Consumer Health Data Privacy Policy, which is more protective than this Notice and applies whether or not a comprehensive privacy law reaches us.

25Nebraska residents

If the Nebraska Data Privacy Act applies to the Company, Nebraska residents have the rights set out in sections 16 to 22. In practice we do not make you establish that it applies. A resident of Nebraska gets the same set as everybody else:

• confirmation of whether we hold personal information about you;
• access to it, and a copy in a portable format;
• correction of anything inaccurate;
• deletion, subject to the exceptions in section 19;
• opt out of sale, which is not a practice we engage in;
• opt out of targeted advertising, which is not a practice we engage in;
• opt out of profiling for decisions with legal or similarly significant effects, which is not a practice we engage in; and
• no retaliation for asking for any of it.

The one thing worth setting expectations about is the answer. Because this Platform holds so little, the honest response to most requests will be that we hold nothing about you, and section 30 explains what we do in that case rather than sending you a form letter.

26Texas residents

If the Texas Data Privacy and Security Act applies to the Company, Texas residents have the rights set out in sections 16 to 22. In practice we do not make you establish that it applies. A resident of Texas gets the same set as everybody else:

• confirmation of whether we hold personal information about you;
• access to it, and a copy in a portable format;
• correction of anything inaccurate;
• deletion, subject to the exceptions in section 19;
• opt out of sale, which is not a practice we engage in;
• opt out of targeted advertising, which is not a practice we engage in;
• opt out of profiling for decisions with legal or similarly significant effects, which is not a practice we engage in; and
• no retaliation for asking for any of it.

The one thing worth setting expectations about is the answer. Because this Platform holds so little, the honest response to most requests will be that we hold nothing about you, and section 30 explains what we do in that case rather than sending you a form letter.

27Virginia residents

If the Virginia Consumer Data Protection Act applies to the Company, Virginia residents have the rights set out in sections 16 to 22. In practice we do not make you establish that it applies. A resident of Virginia gets the same set as everybody else:

• confirmation of whether we hold personal information about you;
• access to it, and a copy in a portable format;
• correction of anything inaccurate;
• deletion, subject to the exceptions in section 19;
• opt out of sale, which is not a practice we engage in;
• opt out of targeted advertising, which is not a practice we engage in;
• opt out of profiling for decisions with legal or similarly significant effects, which is not a practice we engage in; and
• no retaliation for asking for any of it.

The one thing worth setting expectations about is the answer. Because this Platform holds so little, the honest response to most requests will be that we hold nothing about you, and section 30 explains what we do in that case rather than sending you a form letter.

28Colorado residents

If the Colorado Privacy Act applies to the Company, Colorado residents have the rights set out in sections 16 to 22. In practice we do not make you establish that it applies. A resident of Colorado gets the same set as everybody else:

• confirmation of whether we hold personal information about you;
• access to it, and a copy in a portable format;
• correction of anything inaccurate;
• deletion, subject to the exceptions in section 19;
• opt out of sale, which is not a practice we engage in;
• opt out of targeted advertising, which is not a practice we engage in;
• opt out of profiling for decisions with legal or similarly significant effects, which is not a practice we engage in; and
• no retaliation for asking for any of it.

The one thing worth setting expectations about is the answer. Because this Platform holds so little, the honest response to most requests will be that we hold nothing about you, and section 30 explains what we do in that case rather than sending you a form letter.

29Connecticut, California, and every other state

Residents of Connecticut, California, and any other state with a comprehensive privacy law have the same set of rights described in sections 17 to 23, and California residents additionally have the rights the California Consumer Privacy Act as amended provides, including the right to limit certain uses of sensitive personal information and the right not to be treated differently for exercising a privacy right.

We are not going to make you identify the statute. Tell us the state you live in and what you want, and we will work out which law applies and what it requires. Getting that wrong is our job to avoid, not yours, and a page that makes a consumer research their own state's privacy act before they can ask a question is using complexity as a filter.

30When the answer is that we hold nothing

This is the likely outcome for anybody who has only ever searched the directory, and it deserves a section rather than a footnote.

If you have not submitted or claimed a listing and have not written to us, we almost certainly hold no personal information about you at all. No account, no cookie, no identifier, no search history, nothing to look up. When that is the answer, we will say it specifically, in those words, rather than sending a response that implies we searched a profile and found it empty.

We will also not use the request as a reason to start holding something. Asking us what we have about you does not create a record of you beyond what handling the request itself requires, and we do not keep a list of people who have exercised privacy rights for any purpose other than showing we handled them.

31How to submit a request

Email privacy@handshakemd.com. There is no form, deliberately: a form would collect more about you than an email does, and a privacy request should not be the thing that makes us start a file.

Put one of these in the subject line so it reaches the right hands quickly:

• Access my information
• Correct my information
• Delete my information
• Do not sell or share
• Opt out of targeted advertising
• Data portability
• Consumer health data request
• Privacy appeal
• or Other privacy request

Tell us the state you live in, because that determines what applies. You do not need to name a statute, cite a section, or use any particular form of words. Plain language is fine and always has been.

32Identity verification

For some requests we need to be reasonably sure you are who you say you are, because handing somebody else's information to the wrong person is also a privacy failure. How much verification depends on what is being asked: confirming whether we hold anything needs less than deleting a listing.

We will not ask for more information than the verification reasonably needs, and we will not use anything you send for verification for any other purpose. In particular we will not ask for a government identification document, because we do not hold one to compare it against and collecting one to verify a privacy request would leave you worse off than before you asked.

For a clinician listing, verification is usually as simple as replying from the email address on the listing.

33Authorized agents

Where the law lets an authorised agent act for you, we will deal with your agent. We may ask for documentation showing they are authorised, and we may confirm directly with you where the law permits it, which is the ordinary protection against somebody claiming to act for a person who has not asked them to.

34Response times

We respond within the time the applicable law requires, which is commonly 45 days from receipt. Where a law permits an extension and we genuinely need one, we will take it and tell you why rather than going quiet.

In practice most requests here should be answerable in days rather than weeks, because there is so little to look through. If a response is slow, something has gone wrong, and writing again is the right move.

35Appeals

If we refuse a request and the applicable law gives you a right to appeal, send it to privacy@handshakemd.com with Privacy appeal in the subject line. Identify the earlier request and say why you think the decision was wrong.

An appeal is reviewed by a person who will actually reconsider it rather than restating the first answer, and if we still say no we will tell you why and, where the law requires, how to contact your state's attorney general or other authority.

Being realistic about the size of this operation: there is not a separate appeals department. The same small number of people handle both, which means an appeal gets a genuine second look and it also means we should be honest that it is not an independent review.

36No retaliation

Exercising a privacy right will not get you treated differently. We will not:

• remove or downgrade a listing;
• change where a listing appears in results;
• charge anything, since the Platform is free to clinicians and to the public;
• provide a worse service; or
• penalise anybody in any other way.

There is no pricing here to differentiate and no premium tier to withhold, which removes the usual mechanism for this kind of retaliation. The commitment stands anyway.

37Public professional information

Some information about a clinician is public and stays public regardless of what any one directory does. It comes from:

• National Provider Identifier records;
• state licensing boards;
• public business records;
• practice websites; and
• other lawful public sources.

A privacy request does not necessarily require us to delete factual professional information we obtained independently from a lawful public source. Whether a licence exists, and whether it is current, is a public fact about a regulated professional, and a directory of clinicians cannot function if a factual record has to disappear on request.

What we will always do is take the listing down, stop displaying it, and stop sending anything to the clinician. What we will not do is claim to have erased a fact from the world that a licensing board publishes. The Copyright and DMCA policy draws the same line from the other direction: factual licence and practice information is different from a headshot or a biography, and the second kind never appears on a listing nobody claimed.

38Consumer health data

Health related search and browsing information is regulated separately from general personal information, and more strictly. For anything about:

• health related searches;
• clinician discovery activity;
• health interest information;
• consumer health data rights;
• health data consent;
• health data deletion; or
• health data sharing,

the Consumer Health Data Privacy Policy is the document that governs, and section 4 explains why it matters more here than this Notice does.

39Children and teenagers

This Platform is not directed to children. Nobody under 18 can list a practice, there are no accounts for anybody to create, and no part of the site asks a user to submit personal information about themselves at all, including their age.

We do not knowingly collect personal information from a child, and we do not sell or share anybody's personal information, which disposes of the specific protections several state laws give minors against sale, sharing, and targeted advertising: none of those practices happens here to anybody.

A young person may well use a directory of clinicians, and that is a good thing rather than a risk to be designed out. Because search runs in the browser and no account exists, they can do it without leaving a record with us, which is the outcome those protections are aiming at.

40What would have to change before any answer here moved

Every no in this Notice depends on the Platform staying as it is. The specific changes that would move one:

• adding advertising of any kind, which would put sections 7, 14, and 16 in play;
• adding analytics that identifies a person or persists an identifier, which would change sections 9 and 24;
• adding user accounts, which would create sessions, credentials, and a real deletion surface;
• adding a third party embed or vendor script that receives page data, which could be a share;
• storing search activity server side, which would create the health data record this Platform is built not to have; or
• a corporate transaction transferring the Company or its data.

For each of those, the commitment is the same and it is the one worth holding us to: the disclosure and any required consent or opt out mechanism go in before the change ships, not after. Every one of them is also on a list in this project's own repository, so the change is visible to whoever is building it rather than only to whoever wrote this page.

41Changes to this Notice

This Notice gets updated when:

• state privacy laws change or new ones take effect;
• the Platform's data practices change;
• an applicability threshold is crossed;
• advertising or analytics practices change; or
• new rights become available to you.

The last updated date at the top identifies the current version. Where a change reduces your rights or expands what we collect, we will not rely on a quietly changed date.

42Contact

Privacy requests, questions, and appeals all go to privacy@handshakemd.com.

shrinkMD Publishing LLC, a Florida limited liability company
Operator of HandshakeMD
General correspondence: by email. We do not publish a general mailing address, because the address below is our registered agent rather than an office, and post sent to it for anything other than formal legal notice may not reach us.
Registered agent for service of process in Florida: Northwest Registered Agent LLC, 7901 4th St N Ste 300, St. Petersburg, FL 33702
Every contact route in one place: Legal notices and contact information

This is not a HIPAA compliant channel and nobody monitors it around the clock, so please do not send clinical information about a patient. If you or somebody else is in immediate danger, call 911. If you are in crisis, call or text 988 to reach the Suicide and Crisis Lifeline.