This Privacy Policy explains what information FillMap Technologies LLC (“FillMap”, “we”, “us”) collects when you use fillmap.app (the “Service”), how we use it, and the choices you have.
1. The most important part: no patient data
FillMap is PHI-free by design. The Service looks up insurance plans and drugs — never patients. We do not request, collect, store, or log patient names, dates of birth, member IDs, medical record numbers, or any other protected health information, and our Terms of Service prohibit entering it. Lookups are plan-and-drug queries; we do not build patient profiles of any kind.
2. Information we collect
- Account information: your email address and password (stored as a salted hash by our authentication provider). A free personal account holds only this.
- Organization information: the organization name, who its manager is, the members that belong to it (by email), each member's role, seat counts, and any active one-time invite links the manager has generated.
- Billing information: handled by Stripe. We store your Stripe customer/subscription identifiers and subscription status — never card numbers.
- Technical data: authentication session records (used for security and to enforce seat limits), and standard server logs (IP address, browser type, timestamps) kept by our hosting providers for security and operations.
- Cookies: we use only the cookies needed to keep you signed in. No advertising or cross-site tracking cookies.
3. How we use information
- To provide, secure, and operate the Service (authentication, seat enforcement).
- To bill subscriptions and process refunds via Stripe.
- To send transactional email (verification codes, password resets, billing notices). We do not send marketing email without your consent.
- To troubleshoot, prevent abuse, and improve the Service.
4. Service providers
We share data only with the processors that run the Service:
- Supabase (database & authentication hosting, USA) — account, organization, and session data.
- Vercel (application hosting/CDN, USA) — serves the app; standard request logs.
- Stripe (payments, USA) — billing details and card processing; see Stripe's privacy policy.
- Brevo (transactional email, EU/USA) — your email address, to deliver verification and account emails.
We do not sell personal information, and we do not share it with advertisers or data brokers. We may disclose information if required by law, or to protect the rights, safety, and security of FillMap and its users.
5. Data retention and deletion
Account and organization data are kept while your account is active. If you delete your account (or ask us to at support@fillmap.app), we delete your account and organization records within 30 days, except records we must keep for legal, billing, or security reasons (for example, invoices retained by Stripe).
6. Security
Data is encrypted in transit (TLS) and at rest by our providers; database access is protected by row-level security; payment card data never touches our systems. No method of transmission or storage is 100% secure, but the absence of patient data substantially limits the sensitivity of what we hold.
7. Your rights
You may access, correct, export, or delete your personal information — email support@fillmap.app and we will respond within 30 days. Depending on where you live (for example Texas, California, or the EU), you may have additional statutory rights; we honor verified requests regardless of location.
8. Children
The Service is intended for use by healthcare professionals and is not directed at children under 16. We do not knowingly collect information from children.
9. Changes
We may update this policy from time to time. Material changes will be announced by email or in-app notice before they take effect. The “last updated” date above always reflects the current version.
10. Contact
Privacy questions or requests: support@fillmap.app.