Privacy Policy

1. Who this policy covers

This policy applies to people who visit sharedrates.com, submit a free rate check, purchase a Rate Report, sign up for an interest list, or otherwise interact with the Service. It does not apply to the separate websites and services of third parties we link to or rely on (see Section 5).

2. Information we collect

We try to collect only what we need. The categories of personal information we handle are:

• Information you give us directly. Your email address, your National Provider Identifier (NPI) if you submit one, your credential type and ZIP code if you run a new-provider search, the insurer and billing code you select, your answers to any optional questions about your practice (for example, the practice software you use, how many clinicians are in your practice, whether you are credentialed through a platform, or if you have ever asked an insurer for a raise), and any message content you send us or submit through interest-capture forms.
• Public-registry information we match to your details. When you submit an NPI (or search for it by name and ZIP code), we match the details you give us against our own copy of the publicly available CMS NPPES provider registry to identify your provider record, which includes information such as your name, credential, taxonomy, and practice address. This information is already public, but we are combining it with your email and selections.
• Purchase and transaction information. When you buy a Rate Report, our payment processor (Stripe) collects your payment card number, billing address, and other information it needs to process the charge. We do not receive or store your full card number: we receive only a transaction identifier, the last four digits, card brand, approximate amount, and billing country/postal code.
• Report access tokens. When we generate your Rate Report, we create a long random token that is emailed to you and linked to your report record. Your report link stays active for a year from purchase; anyone with that token can view the report until then.
• Usage and device data. When you use the Service, our infrastructure and our cookieless first-party analytics record information such as IP address, browser type and version, device type, operating system, referrer URL, pages viewed, timestamps, actions taken (for example, which CTA you clicked), and approximate geographic location derived from IP. Our analytics does not set cookies or build a persistent cross-site profile of you.
• Cookies. We use a small number of essential first-party cookies to keep the steps of your visit together and to remember how you first arrived at the site. We do not use advertising or third-party tracking cookies. See Section 7 below.
• Rate-letter inputs and outputs. If we generate a draft rate-review letter for you, the benchmark summary that feeds the model and the resulting draft are processed by our AI provider to produce the text. We do not send your raw payment data or email body to the AI provider.
• Support correspondence. Emails and messages you send us, including any attachments.

We do not knowingly collect special categories of sensitive personal information (such as health conditions, precise geolocation, or government identifiers other than your NPI, which is a public professional identifier). Please do not submit such information to us.

3. How we use information

We use personal information to:

• provide the free rate check, generate and deliver Rate Reports, and send the report access link;
• match the details you give us against our own copy of the publicly available NPPES registry so we don’t have to ask you for information that is already public;
• process your payment, handle refunds and chargebacks, and keep basic tax and accounting records;
• send transactional emails about your purchase and your report access link;
• send up to four quarterly update emails over the year following your purchase, letting you know how the rates in your report have moved since it was built; these are light informational updates, not a new or refreshed report, and you can opt out of them at any time without affecting your report access;
• with your consent (or as otherwise permitted by law), send marketing emails about new features, new data releases, blog posts, and launches, and a short follow-up about a free preview you ran, if you ticked the box on the preview form (ticking that box is how you give this consent); you can unsubscribe from these at any time using the link in the email;
• operate, monitor, debug, secure, and improve the Service, including preventing fraud, abuse, and unauthorized access;
• generate and publish de-identified and aggregated statistics (for example, “median 90837 rate for LCSWs in Charlotte, NC”) that do not identify any individual; we do not attempt to re-identify them;
• comply with our legal obligations, respond to lawful requests, and enforce our Terms of Use.

Under PIPEDA, our legal bases for processing are your consent (which we rely on for most collection and for marketing email), our performance of a contract with you (delivering the Rate Report you paid for), and our legitimate business interests in running a secure, reliable service. Where required by applicable U.S. state law, we rely on comparable legal grounds.

4. We do not sell your personal information

SharedRates does not sell your personal information for money, and we do not “sell” or “share” it for cross-context behavioral advertising as those terms are defined under the CCPA/CPRA. If this ever changes, we will update this policy and give you a clear opportunity to opt out before the change takes effect.

5. Service providers and other recipients

We share limited personal information with vetted service providers who process it on our behalf under written agreements, only as needed to run the Service. Our current providers include:

• Stripe: payment processing and fraud prevention (United States).
• Resend: transactional and marketing email delivery (United States / EU).
• Vercel: web application hosting, logging, and content delivery (United States, with global edge).
• Cloudflare: DNS and network security (United States, with global edge).
• Amazon Web Services: database (RDS Postgres) and worker hosting (United States).
• Plausible: cookieless, first-party website analytics that does not set cookies or build a cross-site profile of you (European Union).
• Advertising platforms (for example, Google and Meta): we measure ad conversions server-side, from our own backend, using the data you already gave us. We do not load their client-side tracking code or cookies in your browser.
• Professional advisors: accountants, lawyers, and auditors, under duties of confidentiality.

We may also disclose personal information if required by law, court order, or other valid legal process; to protect the safety, rights, or property of SharedRates, our users, or the public; or as part of a corporate transaction such as a financing, merger, acquisition, or sale of assets, in which case we will ensure the recipient is bound by equivalent privacy obligations.

6. International data transfers

SharedRates is based in Canada and most of our service providers operate in the United States or the European Union. By using the Service, you acknowledge that your personal information may be transferred to, stored in, and processed in Canada, the United States, the EU, or other jurisdictions, where privacy laws may differ from those in your home jurisdiction. We contractually require our service providers to protect personal information consistent with this Policy and with applicable law.

7. Cookies and tracking

We use only a small set of essential first-party cookies. We do not use advertising cookies or third-party tracking cookies, our analytics is cookieless, and we do not load third-party client-side tracking code. Because nothing non-essential is set, there is nothing for you to accept or reject. The cookies we do set are:

• sr_session: an opaque first-party identifier that ties together your steps in a single session (for example, a free rate check and the purchase that follows) so we can measure our own conversions server-side. It is not shared with third parties.
• sr_landing: set on your first visit only, it records the page you landed on, the domain of the website that referred you (not the full address), and any campaign or ad-click tags in the link, so we can tell which link or campaign brought you here. If you arrived from a Google or Meta ad, the ad-click identifier may be sent from our servers to that platform to measure the ad’s results (see Section 5).
• sr_promo and sr_promo_c: remember that you arrived through a partner or colleague link so the discount applies at checkout. 30 days.

We measure website analytics with a cookieless, first-party tool (Plausible) and measure ad conversions server-side, from our own backend. You can clear or block cookies through your browser settings. Our site does not currently respond to Do Not Track browser signals.

8. How long we keep information

We keep personal information only as long as we need it for the purposes in Section 3, or as required by law. Typical retention periods are:

• Rate Report records: your report stays accessible for 12 months from purchase. We keep the underlying report data for about 13 months from purchase (the extra month covers your final quarterly update email), after which it is purged or de-identified; we retain a minimal record of the transaction itself.
• Purchase and tax records: retained for up to seven years after the transaction, as required by Canadian tax and corporate record-keeping rules.
• Email subscriptions and interest lists: retained until you unsubscribe or request deletion, plus a short suppression-list retention so we don’t re-contact you after you opt out.
• Usage logs and analytics: typically retained in identifiable form for up to 13 months, then aggregated or deleted.
• Support correspondence: retained for up to three years after the last interaction.

9. Security

We use administrative, technical, and physical safeguards to protect personal information, including TLS encryption in transit, encryption at rest for production databases and backups, strict access controls, secret management outside of source code, secure coding practices, and third-party processors that meet recognized security standards. No system is perfectly secure; if you believe your information has been compromised, contact us at privacy@sharedrates.com immediately.

10. Your privacy rights

Depending on where you live, you may have some or all of the following rights, subject to legal limits:

• Access: request a copy of the personal information we hold about you;
• Correction: ask us to fix inaccurate or incomplete information;
• Deletion: ask us to delete personal information, subject to legal and contractual retention requirements;
• Portability: request your information in a commonly used electronic format;
• Withdraw consent: withdraw consent to processing (including marketing) at any time, which will not affect processing carried out before the withdrawal;
• Opt out: of any “sale” or “sharing” of personal information and of targeted advertising (note that we do not currently sell or share personal information, or run targeted advertising, as those terms are defined under U.S. state privacy laws);
• Non-discrimination: you will not receive discriminatory treatment for exercising your privacy rights.

To exercise a right, email privacy@sharedrates.com. We will verify your request using the email address on file for the relevant transaction or subscription, and will respond within the time required by applicable law (typically 30 days under PIPEDA and 45 days under most U.S. state laws). You may use an authorized agent where the law allows.

Canadian residents who are not satisfied with our response may contact the Office of the Privacy Commissioner of Canada at priv.gc.ca. California residents can designate an authorized agent to make requests on their behalf and have the additional rights to limit use of sensitive personal information and to opt out of automated decision-making; we do not currently conduct automated decision-making that produces legal or similarly significant effects.

11. Children

The Service is intended for adult professionals. We do not knowingly collect personal information from anyone under 18, and the Service is not directed to children under 13. If you believe a child has provided us with personal information, contact us and we will delete it.

12. Changes to this policy

We may update this Policy to reflect changes in our practices, technology, or the law. When we do, we will post the updated version on this page and update the “Last updated” date above.

13. How to contact us

1001570949 Ontario Corporation
Attn: Privacy Officer
3 Hamel Ave, Guelph, Ontario, Canada
privacy@sharedrates.com