Privacy Policy

1. Summary

MedicaidRate holds account and usage data needed to run your subscription. We do not collect patient data, we do not sell personal data, and the site runs no advertising or third-party tracking scripts.

2. What we collect

• Account data: your name, work email, organization name and a hashed password (we never store your password itself).
• Sign-in sessions: a random session identifier in a secure, HTTP-only cookie, and a hash of it on our servers so we can sign you out everywhere.
• Usage and security logs: requests to the dashboard and API (time, endpoint, IP address, API key prefix) for security, rate limiting, billing and support.
• Preferences in your browser: your chosen states, industries, rate-card codes and layout are saved in your browser's local storage. They stay on your device.
• Billing: handled by our payment processor; we keep the plan, invoices and the last four digits of the card, not the card number.

3. No patient data

The Service is a reference database of published reimbursement rates. Do not upload protected health information or any patient data. We do not accept it and we do not sign business associate agreements for it.

4. How we use it

To provide and secure the Service, authenticate you, send service email (verification, password reset, receipts, and rate-change alerts you turn on), enforce plan limits, provide support and improve the product. We do not use your data for advertising.

5. Cookies

One essential cookie keeps you signed in. We use no advertising or analytics cookies, so there is no cookie banner to accept.

6. Who we share it with

Only the providers that run the Service for us (hosting, database, email delivery, payment processing), under contracts that limit their use to providing that service. We disclose data if the law requires it.

7. Retention and deletion

Account data is kept while your account is open and deleted within 30 days after you close it, except billing records we must keep by law. Security logs are kept for up to 12 months. You can ask for a copy of your data, a correction or deletion at any time.

8. Security

Passwords are hashed with Argon2. Data is encrypted in transit (TLS) and at rest by our hosting providers. Session and API keys can be revoked from your workspace.

9. Changes and contact

We will post changes here and notify account owners of material changes. Questions: use the contact details on your order form or reach us from your workspace. See also the Terms of Service.