Privacy Policy

Effective September 2, 2026. Practice MD (“we”).

Practice MD is a secure platform that healthcare practices use to send forms, messages, and appointment requests to the people they care for, and that patients use to find and book care. This policy explains what information we hold, what we can and cannot see, who else is involved, and the choices you have.

The short version

• The content you and your practice exchange through Practice MD is encrypted on your device before it reaches us. We store it, but we cannot read it.
• We know who you are (your email, name, and the devices you use) and when things happen. We do not know what your forms or messages say.
• We do not sell, rent, or share your information for advertising, and we do not run advertising or ad-network tracking on this site.
• We send email about your account and your requests, and occasionally about the service itself. You can turn off the second kind at any time.

Information you give us

When you create an account we ask for your email address, which we verify with a code, and your name. You may add a phone number. If you book care through Ava, our appointment assistant, you tell us what kind of care you are looking for, roughly where, when you are available, and, if you choose, your insurance. If you make a payment authorization for a practice, your card details go directly to the payment processor (Square or Stripe); we keep the authorization reference they return, not your card number.

Encrypted content

Forms, messages, appointment requests, and your Ava conversation are encrypted in your browser or app with keys that only your devices and the people you share with hold. Practice MD stores the encrypted result and the information needed to deliver it, and cannot decrypt it. If you lose every device and your paper recovery key, we cannot recover that content for you.

What we can see

Alongside encrypted content, we hold information needed to run the service:

• Your account details (email, name, phone if given) and whether your email is verified.
• The public keys of your devices, when each device was added, and when it was last active.
• Which practice sent you a form or request and when, and the state of each appointment request (for example pending, offered, booked).
• For an Ava search that finds no available provider, a de-identified statement of what you need: the kind of care, the area, insurance, and availability. Practices may see this so they can offer to help. It never includes your name or contact details, which reach a practice only if you choose to send them a request.
• Notifications we have shown you and whether you have seen them.
• An approximate location (country, region, city) derived from your network address when you start a search or submit a practice enquiry.
• Server logs: network address, browser type, pages requested, and timestamps.

Cookies and local storage

This site does not set cookies. Your browser stores your device keys and session state locally (in IndexedDB and local storage) so that you can decrypt your content and stay signed in on that device. Clearing your browser data removes them; you can sign in again with another device or your paper key.

Other services involved

• Amazon Web Services hosts Practice MD and delivers our email.
• Square and Stripe process payment authorizations. Their privacy policies govern the card details you enter with them.
• Google Fonts serves the typefaces on this site. Your browser requests them from Google’s servers, which see your network address.
• OpenStreetMap provides the map shown on a provider’s page. Your browser requests map images from their servers when you view one.

None of these receive your encrypted content.

Email from us

We send email you need to use the service: verification codes, sign-in links, and notices about your requests, appointments, and messages. We may also send occasional email about Practice MD itself, such as a new way to find care. Those messages carry an unsubscribe link; unsubscribing stops them but not the emails your account depends on. We do not share your email address with anyone for their marketing.

Your practice and HIPAA

When a practice uses Practice MD to communicate with you, the practice is responsible for your health information and Practice MD acts as its business associate under a written agreement. Questions about how a practice uses your information should go to that practice. Our encryption means we cannot read that information ourselves.

How long we keep things

Encrypted content stays until you or your practice delete it or close the account. A de-identified statement of need from an Ava search is removed after a period of time elapses from your last activity on that search. Server logs are kept for a limited period for security and troubleshooting.

Your choices

• See and remove the devices on your account from Settings.
• Stop non-essential email with the unsubscribe link in any such message.
• Close an Ava search at any time; practices lose access to the request.
• Ask us about your information at support@practice.md.

Changes

If this policy changes in a way that matters, we will note the new effective date here and, for significant changes, tell you by email.