Privacy Policy

Effective [EFFECTIVE DATE]

This Privacy Policy explains how [LEGAL ENTITY NAME] ("we", "us", "our") collects, uses, and protects information when you use ProviderPulse, our physician compensation modeling service (the "Service"), available at getproviderpulse.com and its subdomains.

When a hospital or practice (a "Customer") uses ProviderPulse, the Customer controls the data it puts into the Service, and we process that data on the Customer's behalf. If you are a provider or staff member of a Customer, please direct privacy questions to your organization first.

1. Information we collect

Account and identity information. When you sign in, you authenticate through Microsoft (Azure / Entra) using Supabase as our authentication provider. We receive and store your email address, your name, and a unique account identifier. We do not receive or store your Microsoft password.

Information your organization provides ("Customer Content"). Administrators and managers enter and upload data to model compensation, including:

• organization names
• the provider roster, including provider names, email addresses, and the name variations used to match a provider in billing files
• compensation profiles, pay rules, revisions, and assignments
• full-time-equivalent (FTE) schedules and manual adjustments
• uploaded charge and encounter files and the rows parsed from them
• provider contract documents (PDFs)

Technical information. To keep you signed in within a browser tab, the Service stores a small cache of your account profile in your browser's session storage, which is cleared when the tab closes or you log out. This is not a cookie and is not used for tracking. Our servers and hosting infrastructure keep standard operational logs, such as request and error logs.

We do not use analytics, advertising, tracking cookies, or third-party marketing tools.

2. A note about protected health information (PHI)

ProviderPulse is designed to model physician compensation from provider-level productivity and pay data. It is not intended or authorized to receive protected health information (PHI) or other patient-identifying data. You must remove patient identifiers before uploading any file. Uploaded files are stored as you provide them, so you are responsible for ensuring they contain no PHI. See our HIPAA & Business Associate Statement for details.

3. How we use information

We use the information above only to operate, secure, and support the Service: to authenticate you, to run the compensation calculations you request, to display and export comp sheets, to maintain your account and organization, and to respond to support requests. We do not sell personal information, and we do not use it for advertising.

4. Service providers and subprocessors

We share information with a small number of providers that help us run the Service:

• Supabase — authentication and identity management. Receives your sign-in identity (email and name).
• Microsoft (Azure / Entra) — the identity provider behind your sign-in.
• jsDelivr (CDN) — serves static user-interface assets to your browser. As with any web request, your browser's IP address and standard request data are visible to the CDN when assets load.
• [HOSTING PROVIDER] — hosts the servers and storage where the Service and its data reside.

We require these providers to handle information consistent with this Policy. We do not otherwise share personal information except as required by law or to protect our rights.

5. Where data is stored and how we protect it

Service data is hosted on dedicated infrastructure operated for ProviderPulse. Traffic between your browser and the Service is encrypted in transit using TLS. Within the Service, access is controlled per organization and per role, so administrators, managers, and providers each see only what their role permits, and requests to our servers are authenticated on every call. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

6. Data retention and deletion

We keep Customer Content for as long as the organization's account is active or as needed to provide the Service. Administrators can delete uploaded charge files, encounter files, and contract documents from within the Service. On written request from an authorized administrator, we will delete or return an organization's data, subject to a reasonable period for backups to expire and to any legal retention obligations.

7. Your choices and rights

Because most data in ProviderPulse belongs to a Customer organization, requests to access, correct, or delete it should usually go through that organization. If you have a direct request about your own account identity, contact us using the details below. Depending on where you live, you may have rights under applicable privacy laws, and we will honor those rights as required.

8. Children's privacy

The Service is intended for use by businesses and is not directed to children under 13. We do not knowingly collect personal information from children.

9. Changes to this Policy

We may update this Policy from time to time. When we do, we will revise the effective date above and, for significant changes, provide a more prominent notice.

10. Contact us

[LEGAL ENTITY NAME]
[MAILING ADDRESS]
[CONTACT EMAIL]