Last updated: November 12, 2026. This contact.doctor privacy policy explains what information we collect when you visit, why, how long we keep it, who receives it, and the choices and rights you have. contact.doctor is a U.S. website intended for users in the United States. In short: we don’t ask for your health information, the doctor directory is built from public federal records, not from you, and the site is paid for by advertising from Google, which you can limit at any time.
Who we are
contact.doctor (“we”, “us”) is an independent website, operated from the United States, that maps U.S. doctors, clinicians, hospitals, drugs and health-care spending using public government data. You can reach us through our contact page (choose “Privacy request”).
Information we collect
When you browse
- Server logs. Like every website, our web server records your IP address, the date and time, the page or data file requested (including search words in the address, such as a specialty and a place), the referring page and your browser type. We use logs only for security and fixing problems, and they are deleted after 14 days.
- Analytics. We use Google Analytics (through Google’s Site Kit plugin) to count visits and see which pages are useful. Google Analytics sets first-party cookies and receives your IP address. See “Your choices” below to switch it off.
- Advertising. We show, or are preparing to show, ads from Google (Google AdSense). Google and its advertising partners may use cookies, device identifiers and your IP address to show ads, measure them, prevent fraud and, unless you opt out, personalize ads based on your visits to this and other websites. Google’s use of this information is governed by Google’s advertising policies (opens in a new tab). We don’t choose individual ads, and advertisers never influence our data or articles.
- Settings on your device. If you choose dark mode, color-blind-friendly colors, higher contrast, map colors or privacy choices, that choice is saved in your own browser (local storage). It never leaves your device.
- Security. Our security tools (fail2ban on the server and the Wordfence plugin) may record IP addresses that attack the site and block them for a time.
When you contact us or subscribe
- Contact form: your name, email address, the topic and your message. We use them only to answer you, and keep messages for up to two years unless you ask us to delete them sooner.
- Mailing list: your email address, when you subscribed and confirmed. We use it only to send new articles and maps (about once a month), with no ads. Every email has a one-click unsubscribe link; after you unsubscribe we keep only a record that you did, so we don’t email you again.
- To stop spam, both forms store a one-way, salted code made from your IP address (not the address itself) for one hour.
What we never collect
We do not ask for, and you should not send us, health information about yourself or anyone else, insurance details, Social Security numbers or payment card numbers. We don’t use your precise location, contacts or social-media logins. Ads are never targeted using the health topics, doctors, drugs or places you look up here: we don’t pass that information to advertisers.
Information about doctors and other clinicians
The directory shows information about health professionals and organizations from public federal sources, mainly the CMS National Plan and Provider Enumeration System (NPPES/NPI Registry), Medicare Care Compare, Medicare claims summaries, CMS Open Payments, state licensing boards and other sources listed in our methodology. This is public information about professional activity, published by the government. Clinicians can ask us to correct or update a listing through the contact page (choose “Correct or update a doctor’s listing”); most corrections also need to be made at the original source, such as NPPES, so they last.
How we use information
- To run, secure and improve the site, and to understand which pages are useful.
- To pay for the site through advertising, as described above.
- To answer messages and send the mailing list you asked for.
- To meet legal obligations, such as responding to valid legal requests.
Who receives information
We do not sell personal information for money, and we never give advertisers your messages or email address. We use a small number of service providers who process data for us under their own terms: our hosting provider (DigitalOcean, servers in the United States), Google (Analytics and AdSense) and Defiant Inc. (Wordfence security). Under some state laws, such as California’s, letting Google use cookies to personalize ads can count as “selling” or “sharing” personal information for “targeted” or “cross-context behavioral” advertising. That is why you can opt out, as explained next. We may also disclose information if the law requires it, to protect people’s safety, or as part of a transfer of the site, in which case this policy continues to apply.
Your choices
- Do not sell or share / targeted ads: use the button on our Your Privacy Choices page. Ads may still appear, but not personalized ones. You can also manage Google’s ads at Google My Ad Center (opens in a new tab) and opt out of many ad networks at aboutads.info (opens in a new tab).
- Global Privacy Control: if your browser sends the GPC signal, we treat it as a request to opt out of sale, sharing and targeted advertising for that browser, and we also switch analytics off.
- Analytics: switch it off on the Your Privacy Choices page.
- Cookies: you can block or delete cookies in your browser settings. The site works without them. See Cookies & storage.
- Email: unsubscribe with the link in any email.
Your privacy rights in U.S. states
Depending on the state you live in, you may have the right to know what personal information we hold about you, get a copy, correct it, delete it, and opt out of its sale, sharing or use for targeted advertising. These rights come from laws such as the California Consumer Privacy Act (CCPA, as amended by the CPRA) and the privacy laws of Virginia, Colorado, Connecticut, Utah, Texas, Oregon and other states. In the last 12 months, the categories of personal information collected through the site were identifiers (such as IP addresses and cookie IDs), internet activity (pages viewed and how you reached them) and, for people who write to us, contact details and messages. Google may make inferences about interests for advertising.
To make a request, use the contact page and choose “Privacy request”. We will verify the request in a way that fits the information involved (usually by replying to the email address in question), answer within the time the law sets (usually 45 days), and never treat you differently for using your rights. An authorized agent may act for you with proof of authority. If we deny a request, you can appeal by replying to our answer.
Consumer health data
We don’t collect consumer health data as defined by laws such as Washington’s My Health My Data Act. Server logs can show which specialty, drug or place someone searched for; we use these only for security and troubleshooting, never to infer anything about a visitor or to target ads, and delete them after 14 days.
Children
The site is for a general adult audience. We don’t knowingly collect personal information from children under 13, and we don’t sell or share the information of anyone we know to be under 16. If you think a child has sent us information, contact us and we’ll delete it.
How long we keep information
- Server logs: 14 days.
- Contact messages: up to 2 years.
- Mailing list: until you unsubscribe (then only a do-not-email record).
- Analytics: kept by Google for the retention period set in our Google Analytics account; we use reports only in aggregate.
- Advertising cookies: set and kept by Google under its own policies; you can delete them in your browser.
Security
We use encrypted connections (HTTPS), keep software updated, limit administrator access and monitor for attacks. No system is perfectly secure, so we collect as little as we can.
Visitors outside the United States
contact.doctor is designed for, and directed at, users in the United States. If you visit from elsewhere, your information is processed in the United States under this policy and U.S. law. For visitors in the European Economic Area, the United Kingdom and Switzerland, advertising and analytics cookies are off by default. You can still ask us to access or delete information about you through the contact page.
Do Not Track
Browsers’ “Do Not Track” setting has no common standard; we honor Global Privacy Control instead, as described above.
Changes
We’ll update this page when our practices change and change the “Last updated” date. Significant changes will also be noted on the home page.
Contact
Questions or requests: use our contact page and choose “Privacy request”.