Your privacy comes first

For searches that found nothing, we count roughly which area — the first three digits of a ZIP code, which covers a region of hundreds of thousands of people — and which month. Not the condition, not the full ZIP, no time of day, no device, nothing about you. We count a search only when you make it on the page, not when a link is opened or previewed.

When we answer a question in a patient forum, the link we share carries the forum's name: one name per forum, never one per person. We count how many people opened the list through each forum's link and how many searched from that page, per day. Not what you searched, not the time of day, not your device or internet address, and nothing that ties one count to another. A link preview drawn by an app is not counted. So that one connection can't inflate a forum's count, we count these from each connection for an hour, under a scrambled code that can't be turned back into your internet address. Then that count is deleted.

The area you searched appears in the web address, as a ZIP code. We don't store it. If you share the link, you share the area. A condition or specialty filter is added to the address only if you choose one — choosing one sends nothing to us, but if you reload or share the link, it goes along.

There are no analytics, ads or tracking scripts on these pages.

To stop automated programs from copying the whole list, we count searches from each connection for one minute, under a scrambled code that can't be turned back into your internet address. Then the count is deleted.

Our hosting provider, Vercel, keeps standard request logs, which include the page address. We don't read or export them. Page addresses use short codes rather than condition names.

The list holds each provider's name, specialty and place, and the day you saved them. Nothing you write is kept with it.

Anyone who uses this browser can see it. Remove all on the Saved page deletes it, and so does clearing this site's data in your browser.

Your list doesn't follow you to another phone or computer. It's never counted toward a listing or shown to anyone.

You don't need an account. Signed out, we keep which clinician, that someone told us, the date, any conditions you picked, and your note if you wrote one. We don't keep your name, your address or what you were looking for.

So that one person counts once, we also keep a scrambled code made from your internet address and the clinician, for two years. It can't be turned back into your address or into which clinician it was. If the same connection tells us about the same clinician again, or sends a lot at once, one of our moderators looks at it before it counts.

The note is optional. Only our moderators read it, to help them make sense of what people tell us. It's never shown on the site and never sent to the clinician, so please leave out your name and anything else that could identify you. We delete it when you take back what you told us, when you delete your account, or when a moderator removes what you told us, and in any case two years after you wrote it.

If you endorse someone while suggesting them and they aren't listed yet, your endorsement waits with the suggestion and counts once they're listed. Until then we keep a scrambled code made from your internet address (not the address itself) with it, so that one person counts once; it's deleted when your endorsement is counted, or with the suggestion.

Signed in, we also keep that it was your account, so that you can take it back later. That means we hold a list of the clinicians you've told us about, linked to the name you picked. That list is never shown to anyone else, and your account's name is not shown anywhere on the site unless you switch on your public page (below), which never shows them.

If you suggest a clinician, we keep what you send for 180 days to check it, then delete it the next time we review suggestions. We don't ask for your name or a way to reach you.

If you also endorse them and they aren't listed yet, we keep a scrambled code made from your internet address (not the address itself) with your suggestion, so that one person counts once when they're listed. It's deleted when your endorsement is counted, or with the suggestion.

If you paste the post that told you about them, or its link, we keep it as you sent it, with your suggestion: only our team reads it, it's never shown on the site or sent to the clinician, and it's deleted with the suggestion. It's usually someone else's words, so please send only what's about the clinician.

Your Ref # shows only what happened to your suggestion, on the status page: never the name you sent or anything about you. We keep it only in a scrambled form, so we can't look it up for you or show it again.

If you add a care provider while signed in

We keep that your account added them, when, and what our team decided, so your account page can show you. When our team has approved enough of the care providers you added, over enough time, a patient group's mention you pass on can be listed before a person on our team looks; we still check every one afterwards. If a listing you added turns out to be wrong, that stops.

Your public page is off unless you switch it on. If you do, anyone who knows your account's name can see the care providers you added that our team approved and that are listed now, with the month — never the ones you told us helped you, never your notes. All of this is deleted with your account.

We keep the message and the month you sent it. If you give an email address, we use it only to reply, and we delete the message and the address once we have.

Please leave out health details you'd rather we didn't keep, and other people's names.

To stop automated programs, we count messages and surveys from each connection for an hour, under a scrambled code that can't be turned back into your internet address. Then the count is deleted.

We keep your email address, the date you gave it, and which version of the wording on the form you saw. Nothing else is kept with it: not your name, not your conditions, not what you searched for, not your IP address or device. We set no cookie for it.

If you add the optional note about what you are looking for, we keep its text, the month, and which page you wrote it on. It is saved separately from your email address, with nothing that links the two, so we can't tell who wrote a note. We read the notes to decide what to build, and only the site's administrators can see them. Please don't put health details in it.

We use the address for one email, with your early access link. We don't share or sell it, and we don't add it to anything else. Only the site's administrators can see the list.

To stop automated sign-ups, we count sign-ups from each connection for an hour, under a one-way code that can't be turned back into your IP address, and then the count is deleted.

You can remove your address any time with the link on the confirmation page, or by emailing us from that address. Removing it deletes it. Because a note isn't linked to your address, removing the address doesn't remove a note; email us what you wrote and we'll delete it. There is no set date yet for deleting the whole list or the notes after the early access email goes out; until then it stays unless you remove it.

Request early access to Personalized insights

Request early access to Appointment prep

A name (we pick a random one if you make the account with a passkey; you can change it) and a way to sign in: a passkey, a passphrase, or both. We don't ask for an email address, a real name, or anything else. We set one cookie so the site knows it's you: it lasts 30 days from when you sign in, or until the browser closes if you tell us it's a shared computer. We keep the date of your last visit. We mean to use that date to remove accounts nobody uses any more, but we don't do that yet: for now an account stays until you delete it — including one whose passphrase or passkey has been lost.

If you use a passkey, what we keep is its public key: a number your device uses to prove it's you, which is useless to anyone without your device. Your fingerprint, face and screen lock never leave your device and never reach us. Beside the key we keep the passkey's id, a counter your device sends, how your browser said it can reach it (such as “on this device” or “from your phone”), whether it's synced, the day you added it, the day you last used it, and the name you give it if you give it one. We don't ask your device what make or model it is, and we don't keep a record of each sign-in.

Because we hold no way to reach you, there is no password reset and no way to recover a lost passkey, and we cannot act on a request to delete an account from someone who can't sign in — we would have no way to tell whether it was yours. While you're signed in you can withdraw anything you've told us, and you can delete the account outright, which deletes its passkeys too. Withdrawing removes it completely. If you delete your account, what you told us stays counted but stops being linked to you; withdraw first if you want it gone.

Everything you send us (reports, suggestions, endorsements and their notes, and accounts) is stored in our database, which Upstash, a database provider, runs for us.

To check a report or a suggested name, our team copies it to our own computer, where we look the clinician up. That copy never includes your name, your contact details or your account.