Legal
Privacy Policy
Last updated: June 1, 2026 · Effective immediately
This policy explains what information Dr.Hipaa collects, how we use it, and the choices you have. We keep it in plain language because privacy you can't understand isn't really privacy.
On this page
1. Introduction
Dr.Hipaa, Inc. ("Dr.Hipaa", "we", "us") provides a HIPAA compliance platform for healthcare organizations. This Privacy Policy describes how we handle information when you visit our website or use our services.
When we process protected health information (PHI) on behalf of a customer, we act as a Business Associate under HIPAA, and that processing is governed by the Business Associate Agreement (BAA) we sign with each customer, in addition to this policy.
2. Information we collect
We collect information you provide directly, information generated as you use the service, and a limited amount of technical information from your device.
Account information — name, work email, organization, and role you provide when you sign up.
Compliance content — policies, training records, assessments, vendor details, and evidence you create in the platform.
Usage data — log events, feature usage, and diagnostic data used to operate and improve the service.
Device data — IP address, browser type, and similar technical details collected automatically.
3. How we use information
We use information to provide and secure the service, to support you, to communicate about your account, and to improve our product. We do not sell your personal information, and we never use PHI for advertising.
5. Data security
We protect information with encryption in transit and at rest, granular access controls, continuous monitoring, and an internal audit log. Our practices are described in detail on our Security page. No method of transmission is perfectly secure, but we work hard to protect your data and to notify you promptly in the unlikely event of an incident.
6. Your choices & rights
Depending on your location, you may have rights to access, correct, export, or delete your personal information. You can manage most account data directly in the product, or contact us to exercise any right. We will respond within the timeframes required by applicable law.
7. Data retention
We retain account and compliance data for as long as your account is active and as needed to provide the service. After termination, we retain or delete data according to your BAA and applicable legal obligations, then securely dispose of it.
8. International data
Dr.Hipaa is operated from the United States and our infrastructure is US-based. If you access the service from outside the US, you understand your information will be processed in the US under this policy.
9. Children’s privacy
Our service is intended for healthcare organizations and is not directed to children. We do not knowingly collect personal information directly from children through the website.
10. Changes to this policy
We may update this policy from time to time. When we make material changes, we will update the "Last updated" date and, where appropriate, notify you in the product or by email.
Questions about your privacy?
Email our Data Protection Officer at privacy@drhipaa.com or reach us through our contact page.
The all-in-one HIPAA compliance platform for modern healthcare teams.
Industries
Compare
Resources