Privacy Policy
What healthcare.dev collects, why, who processes it, how long we keep it and your rights.
Last updated
Our principle is to collect only what we need to run the Services, and nothing about patients, ever. We never sell personal information. This policy covers the healthcare.dev website, API, MCP server, dashboard, documentation, SDKs, CLI and free tools (the "Services"). Words like "we" and "you" mean what they mean in our Terms of Service.
We don't want patient information
The Services serve public reference data and are not designed to receive information about patients. Our Terms forbid sending protected health information or anything else that identifies a patient or health plan member. If any reaches us anyway, we delete it when we find it. We are not a HIPAA covered entity or business associate.
What we collect and why
Account information
When you create an account we collect your name, email address and, if you give it, your company. Sign-in is handled by our authentication provider (Clerk), which may also receive your profile from Google or GitHub if you sign in with them. We use this to run your account, send you service email (keys, usage alerts, billing, security and policy notices) and answer you when you write to us.
Billing information
Paid plans are billed through Stripe. Card details go directly to Stripe and never touch our servers. We keep a record of your plan, invoices and billing address for accounting, tax and fraud prevention.
API keys and usage
We store a salted hash of each API key and its short public prefix, never the full key. For every API and MCP request we count usage by key, hour and endpoint group to enforce rate limits and quotas and to bill you. Our application and infrastructure logs record operational details (time, endpoint, status, latency, IP address and errors) for security and debugging and are kept for up to 30 days.
The values you query (codes, NDCs, NPIs, search text) are public identifiers. We may keep them in logs within the same 30-day window and use them in aggregate, de-identified form to improve search and data quality.
Free tools and anonymous access
The free tools on healthcare.dev send your query to our API from our servers. We use your IP address to apply per-visitor rate limits and don't keep it after that. We don't store free-tool queries in a form tied to you. NPI lookups in the free tool are also sent to the public CMS NPPES registry.
Website
The marketing site and docs don't use advertising or third-party tracking cookies. Our hosting provider (Vercel) keeps standard request logs. If we add privacy-friendly analytics, we will list them here first.
Email to us
When you email us, we keep the conversation so we can help you and refer back to it later.
Who processes data for us
We use these subprocessors to provide the Services. Each only gets what it needs.
| Subprocessor | Purpose | Location |
|---|---|---|
| Amazon Web Services | API hosting, databases, logs, backups | US |
| Vercel | Website, docs and dashboard hosting | US, edge |
| Clerk | Dashboard sign-in and user management | US |
| Stripe | Payments, invoices and tax | US |
| Google Workspace | Email with customers | US |
| Resend | Sending service email | US |
We will update this list before adding a subprocessor that handles personal information.
When we disclose information
- To provide the Services, to the subprocessors above.
- At your direction, for example when you connect an MCP client or another tool with your key.
- To prevent abuse or investigate violations of our Terms, when necessary and proportionate.
- When the law requires it. We only disclose customer data in response to valid legal process, and we notify affected customers unless we're legally prohibited from doing so.
- In a merger or acquisition, in which case we'll tell you before your information becomes subject to a different privacy policy.
Your rights
Wherever you live, you can ask us to tell you what personal information we hold about you, give you a copy, correct it, or delete it, and you can object to how we use it. Deleting your account deletes your personal information, subject to what we must keep for legal, tax and accounting reasons. Email hello@healthcare.dev and we'll respond within 30 days. If you are in the EU or UK, you can also complain to your data protection authority. California residents have the rights described in the CCPA; we do not sell or share personal information as those terms are defined there.
Security
Data is encrypted in transit (TLS) and at rest. Access to production systems is limited to the people who run them. See our security page for details and how to report a vulnerability.
Retention
| Data | Kept for |
|---|---|
| Account information | While your account is open; deleted within 30 days of closing |
| Hourly usage counts and billing record | As long as needed for billing, tax and accounting (up to 7 years) |
| Application and infrastructure logs | Up to 30 days |
| Database backups | Up to 35 days |
| Free-tool IP rate-limit state | Up to a minute, in memory |
Where data is stored
We operate from the United States, and our infrastructure is in the US. If you use the Services from outside the US, your information is transferred to and processed in the US.
Children
The Services are not directed at children and you must be 18 or older to create an account.
Changes and questions
We'll post changes on this page with a new date, track them in our public repository and email account owners about material changes. Questions: hello@healthcare.dev.
Structure adapted from the 37signals (Basecamp) open-source policies, licensed under CC BY 4.0.