Docshape Privacy Policy

From doctors and staff (Subscribers): name, email, phone, login credentials, practice and site details, plan and billing records, domain orders, support messages, and similar account data.

From patients and visitors on a clinic site hosted by Docshape: what the practice's forms collect - typically name, phone, optional email, visit type, preferred time, reason for visit, and consent. Charts may later include history, problems, allergies, files, prescriptions, referrals, and OT notes entered by that clinic. Docshape stores this so that clinic's software works. Docshape does not use it for ads.

Automatically: technical logs needed to run Docshape (for example approximate time, IP, browser type, pages on the Docshape product). Docshape does not send patient names, diagnoses, chart fields, or booking query strings to product analytics or error tools.

Docshape does not run advertising networks on clinic dashboards. Docshape does not sell patient lists.

When you register for Docshape, subscribe, edit a site, book on a clinic site hosted by Docshape, pay a Docshape invoice, contact support, or otherwise use Docshape.

• Provide the Docshape account, website, booking, and record features you subscribed to
• Authenticate users and keep Docshape secure
• Send transactional mail (signup, password reset, booking notices to the treating doctor and the patient, billing)
• Improve the product using non-health operational data (for example doctor or site id, appointment type counts)
• Meet legal obligations and protect rights and safety

Docshape does not use patient charts or booking reasons for marketing.

Access to Docshape production systems is limited to people who need it for operations. Clinic and patient records stay in Docshape's database. Card details for Docshape subscriptions are handled by the payment provider; Docshape does not store full card numbers on Docshape servers.

No method of transmission is perfectly secure. You must also protect your Docshape login and the screens you use.

Docshape may use:

• Essential cookies for Docshape login and session
• Error monitoring with user id only - not names, emails, phones, notes, diagnoses, files, or session replay of clinic dashboards
• Product analytics limited to counts and doctor or site identifiers - not patient identifiers or chart fields
• Maps or similar widgets only if a Docshape page actually loads them

Docshape does not currently show third-party ads on the product. If that changes, Docshape will update this Policy.

Cookies are small files stored by your browser. Essential cookies are needed to stay signed in to Docshape and to use the dashboard. You can block cookies in the browser; Docshape login and some features may then fail. Booking on a public clinic site hosted by Docshape may still work depending on the form.

Docshape sends mail through its email processor (transactional: OTP, signup, password reset, booking, billing). Docshape does not buy or sell email lists. You can ask to stop marketing mail at info@docshape.org. Transactional mail required to run the Docshape account or a booking may still be sent.

Docshape operator (internal) alerts use clinic or site identifiers and visit type only - not patient names.

Docshape does not sell personal information. Docshape shares it only:

• With processors who run Docshape under contract: hosting and database, email, subscription payments, domain registration where you buy a domain through Docshape, and infrastructure as needed
• When a clinic connects Google Meet for video visits: Docshape creates a calendar meeting on that clinic's account with a generic title (no patient name, phone, email, or reason). The join link is stored for that appointment and sent to the patient by email
• With the clinic whose Docshape site the patient used (booking and chart data belongs to that care relationship)
• When required by law, or to protect rights, safety, or the security of Docshape
• In a business transfer, subject to this Policy's protections as far as practicable

Video consultations on Basic use the clinic's connected Google Meet account when available. Docshape does not send the patient's name, phone, email, or reason for visit into the meeting title, and Docshape does not record video visits. Each doctor's sign-in, website, and patient chart stay separate.

Payment providers are used for Docshape plan and domain billing, not for patient charts or booking reasons.

Docshape is for licensed practices and adult account holders. Docshape does not market the product to children under 13. A parent or guardian may submit a child's details to a clinic on that clinic's Docshape booking form; that clinic must handle those records lawfully. Docshape does not use children's health data for advertising.

Docshape's software, branding, and the Docshape marketing site are protected. Copying Docshape or the Docshape marketing site without permission is not allowed. Clinic content remains the clinic's; others may not scrape or republish it unlawfully.

Clinic and platform data in Docshape is collected to operate the product. Taking, copying, or publishing that data without authority may be a crime and a breach of the Terms of Use. Docshape may investigate and involve law enforcement where appropriate.

Docshape does not claim ownership of a patient's clinical record as a medical file; the practice remains responsible for that record. Docshape claims the right to protect the product and to process data as described here.

Subscribers can update account details in the Docshape dashboard and cancel a Docshape plan as described in the Cancellation Policy. Patients should contact the clinic to correct booking or chart information. Docshape privacy questions: info@docshape.org.

Docshape. Email: info@docshape.org.