Privacy Policy

Information you give us. When you email us, book a call, or use the contact form on this site, we receive your name, email address, phone number if you provide one, and whatever you choose to include in your message. Messages sent through our contact form are stored securely, used only to respond to you and manage our relationship with you, and retained for as long as we need them for those purposes. When your practice becomes a client, we collect account information for portal users: name, email, job title, phone (optional), profile photo (optional), and the content your team creates or approves in the portal.

Information collected automatically. This website uses privacy-respecting, cookieless analytics (aggregate page views, referrers, and device types — never tied to an identifiable person). The portal records standard security logs for signed-in users, such as sign-in times, IP address, approximate location derived from IP, and browser type, so account holders can review their own account activity.

What we do not collect. We are a marketing service, not a healthcare provider. We do not want, need, or knowingly collect patient health information. Please do not include any patient or medical information in messages to us.

We use the information we collect to:

• respond to inquiries and provide our services;
• operate, secure, and improve this website and the client portal;
• send service-related communications (e.g., portal notifications you've enabled);
• comply with legal obligations.

We do not sell personal information, and we do not use advertising trackers or sell data to ad networks.

We rely on a small set of vendors to run our services, each of which processes data only on our behalf: website and portal hosting (Vercel), database and authentication (Supabase), payments (Stripe — payment card details go directly to Stripe and never touch our servers), transactional email (Resend), optional Google sign-in (Google), and cookieless analytics (Plausible).

We keep client account data for as long as the account is active. Portal sign-in logs are automatically deleted after 90 days. If your practice ends its engagement, we delete or return client content on request, subject to legal retention requirements.

You can request access to, correction of, or deletion of your personal information by emailing us. Portal users can update their own profile and notification preferences in account settings, and can delete their account from within the portal. Depending on where you live, you may have additional rights under applicable law; we honor verified requests regardless of geography.

Portal data is encrypted in transit and at rest, access is role-based, and sign-in activity is visible to each account holder. No system is perfectly secure, but we design ours so that the sensitive surface stays small.

Our services are for businesses and are not directed to children under 13.

If we make material changes, we'll update the effective date above and, for clients, note the change in the portal.

Questions about this policy or your data: support@doctorbrand.ai. DoctorBrand, a DBA of AaHa Creative LLC, Lincoln, Nebraska, USA.