Privacy Policy

1. Who we are

DPC Pro ("DPC Pro," "we," "us") makes practice-management software for Direct Primary Care (DPC) clinics. It covers memberships, billing, scheduling, clinical records, messaging, and an AI assistant.

This policy covers:

• our website, www.dpcpro.com (the "Website"); and
• the DPC Pro platform at app.dpcpro.com and related services (the "Platform").

Our customers are DPC practices ("Practices"). Practices use the Platform to serve their own patients.

2. What we collect

On the Website

• Contact and early-access forms. When you fill out a form, we collect what you enter. This can include your name, email address, phone number, practice name, and your message. We also record the page and the campaign link that brought you to the form.
• Analytics. We use Google Analytics to learn how people use the Website. It collects data such as pages viewed, time on page, referring site, device and browser type, and approximate location derived from your IP address.
• Cookies. Google Analytics sets cookies. See Cookies and analytics.

On the Platform

• Practice account data. Information about the Practice and its staff users: names, email addresses, phone numbers, roles, login and security data, practice settings, and the records of how users use the Platform.
• Practice billing data. Billing contact details and the payment method a Practice uses to pay for DPC Pro. Card and bank details are collected by Stripe, not by us. See Payment security.
• Patient data entered by Practices. Practices and their patients enter patient information into the Platform. This can include demographics, contact details, membership and billing records, appointments, messages, and clinical notes. Much of this is protected health information (PHI). See Health information and HIPAA.
• Patient payment data. When a patient pays a Practice through the Platform, the payment is processed by Stripe. We receive payment details such as the amount, status, card brand, the last four digits of the card or bank account, the card expiry date, and the bank name. We do not receive full card or bank account numbers.
• Technical data. IP address, browser and device information, and logs that we use to run, secure, and fix the Platform.

3. How we use information

• To provide, operate, and support the Website and the Platform.
• To answer your questions and requests, and to manage early-access sign-ups.
• To process subscription payments from Practices and patient payments to Practices.
• To send service messages, such as account notices, billing receipts, appointment reminders, and security alerts.
• To provide the AI assistant and other features that Practices turn on.
• To secure the Platform, prevent fraud, and fix errors.
• To understand how the Website is used and to improve it.
• To meet our legal obligations and enforce our agreements.

We use patient data only to provide the Platform to the Practice, as allowed by our Business Associate Agreement with that Practice and by law.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising.

4. Who we share it with

We share information with service providers that help us run DPC Pro. They may use it only to provide services to us.

• Payments: Stripe.
• Hosting and infrastructure: Amazon Web Services and Cloudflare.
• Email: Microsoft 365 and Resend.
• Text messages (SMS): Twilio.
• AI features: Anthropic, OpenAI, and OpenRouter. When a practice user uses an AI feature, the content needed to answer the request is sent to one of these providers. We do not send patient data to AI providers.
• Website analytics: Google Analytics.

We may also share information:

• with the Practice that owns the account, including its authorized users;
• when the law requires it, or to protect the rights, safety, or property of DPC Pro, our users, or others;
• with a buyer or successor if we are involved in a merger, acquisition, or sale of assets, under the same protections described here; and
• with your consent.

5. Health information and HIPAA

Practices that use DPC Pro are HIPAA covered entities, or they handle health information under similar rules. DPC Pro acts as their business associate. We sign a Business Associate Agreement (BAA) with each Practice. The BAA controls how we may use and disclose protected health information.

6. Payment security

Payments on DPC Pro are processed by Stripe, a PCI DSS Level 1 certified payment processor. Card and bank details go directly to Stripe over an encrypted (HTTPS/TLS) connection. DPC Pro does not store full card numbers or bank account numbers on its servers.

We keep only limited payment details that Stripe gives back to us, such as the card brand, the last four digits, the expiry date, and the bank name. We use these details to show you which payment method is on file.

7. Cookies and analytics

• Website. Google Analytics sets cookies to count visits and understand use. You can block cookies in your browser settings, or install the Google Analytics opt-out add-on.
• Platform. The Platform uses cookies that are necessary to sign you in, keep your session secure, and remember your settings. The Platform does not work without them.

8. Security

We use administrative, technical, and physical safeguards to protect information. These include encryption in transit (HTTPS/TLS), encryption of sensitive fields at rest, access controls, and audit logs. No system is perfectly secure. If we learn of a breach that affects your information, we will notify you and the affected Practice as the law and our BAAs require.

9. Retention

• Website form data: we keep it as long as we need it to respond to you and manage our relationship, then delete it.
• Practice and patient data: we keep it while the Practice's account is active. When a Practice cancels, it can export its data. After that, we delete or return the data as our agreement and BAA with that Practice require, unless the law requires us to keep it longer.
• Payment and billing records: we keep them as long as tax, accounting, and payment-network rules require.

10. Your rights and requests

You can ask us to:

• access the personal information we have about you;
• correct information that is wrong; and
• delete your personal information.

Some U.S. states give residents more rights. Depending on where you live, these can include the right to get a copy of your data in a portable format, to opt out of the sale or sharing of personal data or of targeted advertising, and to appeal our decision on your request. We do not sell your data or use it for targeted advertising. We will not treat you differently because you used a privacy right.

To make a request, email [email protected] or use our contact page. We will verify your identity before we act on a request. An authorized agent can make a request for you with your written permission.

Patients: if your request is about health information a Practice keeps in DPC Pro, please contact that Practice. We process patient data on the Practice's behalf, and we will help the Practice respond.

11. Children

The Website and the Platform's practice-facing services are not directed at children under 13. We do not knowingly collect personal information from children under 13 through the Website. Practices may enter information about patients who are minors. That information is handled on the Practice's behalf under its BAA, and the Practice is responsible for any required parental consent.

12. Changes to this policy

We may update this policy. When we do, we change the "Last updated" date at the top. If a change is material, we will tell Practices by email or in the Platform before it takes effect.

13. Contact us

Questions about this policy? Email [email protected] or use our contact page.

DPC Pro