This Privacy & Cookies Policy (“Policy”) explains how Collaborating Docs, LLC d/b/a Collaborating Docs and CollabDocs, together with its subsidiaries, affiliates, and brands (“CollabDocs,” “we,” “us,” or “our”), collects, uses, discloses, and safeguards personal information, and describes the rights available to individuals with respect to that information. This Policy supplements, and should be read together with, our Terms of Use. In the event of a direct conflict between this Policy and the Terms of Use regarding the handling of personal information, this Policy governs.

We provide notice of our data practices at or before the point where personal information is collected, consistent with applicable law. This Policy, together with the point-of-collection notices displayed on specific forms and pages of our Sites, together constitute our “Notice at Collection.”

This Policy applies to personal information collected through collaboratingdocs.com, our related web and mobile properties, client and provider portals, and any other digital or offline channel that links to this Policy (collectively, the “Sites”), as well as personal information collected in the course of providing our collaborative-practice matching, administrative, and advisory services (the “Services”).

This Policy does not apply to information we process solely on behalf of a client as a service provider under a separate written agreement (for example, credentialing documentation processed for a client organization), which is instead governed by that agreement.

3.1 Information You Provide to Us

• Contact and account information: name, email address, phone number, mailing address, username, and password.
• Professional and business information: employer, professional title, state(s) of licensure, license or certification numbers, National Provider Identifier (NPI), and related credentialing details submitted for matching or onboarding purposes.
• Payment information: processed through our third-party payment processor; see Section 12.
• Communications: information you provide via forms, email, telephone, our web, SAAS, mobile, desktop applications, or video calls, including intake forms and customer support inquiries.
• Job applicant information: information submitted in connection with an employment application.

3.2 Information Collected Automatically

When you visit our Sites, we and our service providers automatically collect certain technical information using cookies, web beacons, pixels, and similar technologies, including: device and browser type, operating system, IP address and approximate location derived from it, referring/exit pages, and information about how you interact with our Sites (pages viewed, links clicked, time on page). Section 8 describes these technologies, the categories we use, and how you can control them.

3.3 Information From Other Sources

We may receive information about you from third parties, such as a collaborating physician, employer, or staffing organization that refers you to our Services; from publicly available professional licensing databases; from federal program-integrity databases such as the HHS Office of Inspector General’s List of Excluded Individuals/Entities (LEIE), which we check directly against OIG’s public database to verify eligibility to participate in federal health care programs; or from marketing and identity-resolution vendors engaged to help us reach prospective clients who have visited our Sites.

3.4 Sensitive Personal Information

In the course of providing collaborative-practice matching services, we may collect government-issued license or identification numbers used to verify professional credentials. We do not collect this information from casual website visitors, and we use it only as necessary to verify eligibility and provide the Services — not for advertising or to infer characteristics about you. Section 11 describes your right to limit this use.

• To provide, maintain, and administer the Services, including matching, credentialing support, and account management.
• To process payments and manage billing.
• To communicate with you, including responding to inquiries and sending service-related notices.
• To send marketing communications, where you have not opted out and, where required, where you have consented (see Section 8 and Section 11).
• To improve, secure, and analyze the performance of our Sites and Services.
• To detect, investigate, and prevent fraud, security incidents, and other malicious or illegal activity.
• To comply with legal, regulatory, and audit obligations, and to respond to lawful requests from courts or government authorities.
• In connection with a merger, acquisition, financing, or sale of some or all of our business or assets, subject to applicable law.

We do not use or disclose sensitive personal information, or personal information about individuals we know to be under 18, for cross-context behavioral advertising.

We disclose personal information to the following categories of recipients:

• Service providers and contractors who process personal information on our behalf and under contract for purposes such as hosting, payment processing, customer support, and email delivery, and who are contractually restricted from using that information for their own independent purposes.
• Marketing and advertising partners, including analytics and identity-resolution vendors, who may receive information such as a hashed email address or cookie identifier. This category of disclosure is described further, and is separately controllable, in Sections 8 and 11.
• Professional partners, such as collaborating physicians or organizations directly involved in delivering the Services you have requested.
• Legal and safety recipients, including regulators, law enforcement, or courts, where required by law or necessary to protect the rights, property, or safety of CollabDocs, our users, or the public.
• Successors, in connection with a corporate transaction as described in Section 4.

We do not sell or share personal information relating to sensitive credentialing or licensure data, and we do not sell personal information for monetary consideration. Where this Policy uses the term “share,” it refers to the CCPA/CPRA definition of that term, which includes disclosures for cross-context behavioral advertising even where no money changes hands.

We do not apply a single retention period to all personal information. How long we keep a given category depends on the purpose for which it was collected and any independent legal, contractual, or accounting obligation that applies to that category:

• Contact and identifying information, professional and business information, and sensitive personal information (license or credential-verification data): retained for as long as you remain an active customer, part of our provider network, an active prospect, or a subscriber to our communications, and deleted upon a verified deletion request.
• Payment, billing, and financial records: retained per our payment processors’ schedules for card data, and for our own accounting and tax recordkeeping purposes for billing records.
• General communications and support inquiries: retained for the duration of your relationship with us, plus a reasonable additional period to allow us to respond to a dispute within the applicable statute of limitations.
• Cookies, analytics, and advertising data, including geolocation derived from IP address: retained for up to 3 years, reflecting the longest retention period among the analytics and advertising tools we currently use, which may change over time as our tools and vendors change.
• Data subject to an active legal hold, audit, or regulatory inquiry: retained until that hold or inquiry is resolved, regardless of the period that would otherwise apply.

Specific retention periods and the criteria used to determine them are set out in the Notice at Collection table in Section 7 below.

We do not apply a single retention period to all personal information. How long we keep a given category depends on the purpose for which it was collected and any independent legal, contractual, or accounting obligation that applies to that category:

• Basic account and contact information, where there is no open matter, dispute, or legal hold: retained for [60–90] business days after your relationship with us ends.
• Credentialing and licensure verification records: retained for the duration of your relationship with us, plus [an additional period, to be confirmed against applicable state licensing and credentialing recordkeeping requirements], because state regulators or licensing boards may require us to produce these records after the relationship ends.
• Payment, billing, and financial records: retained for [3–7 years], consistent with standard accounting and tax recordkeeping practice.
• General communications and support inquiries: retained for the duration of your relationship with us, plus a reasonable additional period to allow us to respond to a dispute within the applicable statute of limitations.
• Cookie and analytics data: cookies are retained for no longer than 13 months; analytics data is addressed in Section 7.
• Data subject to an active legal hold, audit, or regulatory inquiry: retained until that hold or inquiry is resolved, regardless of the period that would otherwise apply to that data.

Specific retention periods and the criteria used to determine them are set out in the Notice at Collection table in Section 7 below.

We use the following categories of cookies and similar technologies. Except for Necessary cookies, we do not activate a category until you make an affirmative choice through our cookie consent banner, which is presented at or before your first interaction with our Sites.

• Necessary: required for core site functionality, such as security and form submission. These do not require consent and cannot be disabled.
• Analytics: help us understand aggregate site usage so we can improve our Sites, and may include demographic estimates (such as age range, gender, and approximate location) received through Google Signals if you are signed into a Google account in your browser. Activated only if you consent; declining Analytics cookies through our consent banner also disables Google Signals for your session.
• Marketing: may match your browsing activity to an email address (including through hashed-email or identity-resolution technology) so that we or our vendors can send you marketing communications. Activated only if you consent, and separately opt-outable at any time through the mechanisms described in Section 11.

Global Privacy Control (GPC) and other opt-out preference signals: We honor GPC and equivalent opt-out preference signals recognized under California law as a valid request to opt out of the sale or sharing of personal information for the browser or device sending the signal. When we detect such a signal, we do not activate Analytics or Marketing cookies for that visit, regardless of any previously saved preference on that device.

You can change your cookie choices at any time using the “Manage cookie preferences” control available in the footer of our Sites.

We maintain reasonable administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, or destruction, appropriate to the volume and sensitivity of the information we handle. We use PCI-DSS compliant third-party processors to handle payment card data on our behalf. We do not store full payment card numbers on our own systems. While no method of transmission or storage can be guaranteed to be 100% secure, we work to maintain safeguards appropriate to the sensitivity of the information we handle and to respond promptly if an issue is identified.

10.1 California Residents

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, “CCPA”), gives you the following rights with respect to your personal information, subject to certain exceptions:

• Right to know the categories and specific pieces of personal information we have collected about you, and the categories of sources, purposes, and third parties/recipients involved.
• Right to delete personal information we have collected from you. This right is subject to exceptions recognized under the CCPA, which may apply depending on the specific information and your relationship with us — for example: completing the credentialing, matching, or other service you requested while that engagement is active; complying with state licensing or credentialing recordkeeping obligations that require us to retain verification records after our relationship ends; retaining financial and billing records as required by tax and accounting law; detecting, investigating, or responding to security incidents or fraud; debugging to maintain the functionality of our Sites; and other internal uses that are reasonably aligned with the context in which you provided the information. Where an exception applies, we will delete the remainder of your information and let you know which exception applies to what we’ve retained.
• Right to correct inaccurate personal information.
• Right to opt out of the sale or sharing of your personal information.
• Right to limit the use and disclosure of sensitive personal information to purposes necessary to provide the Services.
• Right to non-discrimination for exercising any of these rights.
• Right to designate an authorized agent to submit requests on your behalf.
• Right to appeal a denial of a request, as described below.

To exercise your right to know, delete, or correct, submit a verifiable consumer request by emailing legal@collaboratingdocs.com or by mail to the address in Section 17. We will verify your identity using information you have already provided us and, if we cannot verify your request, we may ask for additional information solely for that purpose. We will respond within the time required by law, and if we deny your request in whole or in part, you may appeal that decision by replying to our response with the word “APPEAL” and a brief explanation; we will respond to appeals within the time required by law.

To exercise your right to opt out of sale or sharing, or to limit use of sensitive personal information, see Section 11 below.

We do not offer financial incentives in exchange for the retention, sale, or sharing of personal information.

Right to Know Under Cal. Civ. Code § 1798.83 (“Shine the Light”): California residents may request information once per year about our disclosure, if any, of personal information to third parties for their own direct marketing purposes, by contacting us as described in Section 17.

10.2 Residents of Other U.S. States

If you reside in a state that has enacted a comprehensive consumer privacy law, you may have similar rights to know, access, correct, delete, or obtain a portable copy of your personal information, and to opt out of targeted advertising, the sale of personal information, or certain profiling. The number of states with such laws continues to grow each year; rather than list them here (and risk this Policy becoming outdated as new laws take effect), we honor these rights for residents of any state whose law entitles them to them. To exercise these rights, contact us using the details in Section 17. We will verify your request and respond within the time required by the law of your state of residence.

10.3 Nevada Residents

Nevada residents may submit a request under Nevada Revised Statutes Chapter 603A to opt out of the sale of certain covered information by emailing legal@collaboratingdocs.com with your name and the email address to which your request applies.

We will process opt-out requests within 15 business days and will not require you to create an account to submit one. You can confirm that your opt-out request has been honored at any time by emailing legal@collaboratingdocs.com and referencing our original request.  If you submitted your request via a Global Privacy Control or other opt-out preference signal, your browser or device will continue to reflect an opted-out status for that browser/device until you change your settings.

Payment card information you submit to us is transmitted to and processed by a PCI-DSS compliant third-party payment processor. We do not store full card numbers, CVV codes, or magnetic-stripe/chip data on our own systems. We retain only the billing information necessary for our own transaction and accounting records.

Our Sites and Services are directed to adults and are not intended for use by anyone under the age of 18. Consistent with our Terms of Use, by using our Sites you represent that you are at least 18 years old. We do not knowingly collect personal information from anyone under 18, and if we learn that we have done so, we will delete that information. If you believe a minor has provided us with personal information, please contact us using the details in Section 17.

Our Sites and Services are directed to users in the United States and are not intended or directed to individuals in the European Economic Area, the United Kingdom, or Switzerland. If you access our Sites from outside the United States, your information will be transferred to, stored, and processed in the United States, where privacy laws may differ from those of your home jurisdiction. By using our Sites, you consent to this transfer and processing. If you believe GDPR or another non-U.S. data protection law applies to your use of our Sites, please contact us before submitting personal information.

Our Sites may contain links to, or embed content from, third-party websites and services. This Policy does not apply to those third parties, and we are not responsible for their privacy practices. We encourage you to review the privacy policy of any third-party site or service before providing it with personal information.

We may update this Policy from time to time. If we make material changes, we will update the “Last Updated” date above and, where required by law, provide additional notice (such as a banner on our Sites or an email notification). Your continued use of our Sites after an updated Policy takes effect constitutes your acknowledgment of the updated Policy.

If you have questions about this Policy or wish to exercise any of the rights described above, please contact us at:

Collab Docs Attn: Legal Department

2025 Riverside Drive, STE 35843

Columbus, OH 43221

Email: legal@collaboratingdocs.com 

Effective Date: 2026.8.6 |  Last Updated: 2026.8.6