Privacy Policy

1. Scope

This Privacy Policy explains how [LEGAL ENTITY NAME] ("ShadedMD," "we") collects, uses, and shares information when you use our website and evaluation service. Because our service involves your health information, we hold it to the strictest standard we apply to any data. [Attorney: confirm HIPAA covered-entity / business-associate structure with the physician group and attach a Notice of Privacy Practices if required.]

2. Information we collect

• Identity & contact: name, email, phone, date of birth, state.
• Health information: the conditions you select, your symptom description, and treatments you list, collected solely for your medical evaluation.
• Vehicle details: year, make, model (optional), for your certificate.
• Payment: handled by our payment processor (NMI); we receive confirmation and transaction details only, never your full card number.
• Technical: device, browser, and usage data (see Cookies below).

3. How we use it

To deliver your evaluation to the reviewing physician; to issue and email your certificate; to provide support and process refunds; to send service emails such as receipts and renewal reminders; to secure and improve the service; and to comply with law. We never sell your personal or health information, and we never share your health information for advertising.

4. Who we share it with

• The reviewing physician licensed in your state. Your questionnaire exists so they can evaluate you.
• Service providers under confidentiality obligations: secure hosting and database (Supabase), email delivery (Resend), payment processing (NMI).
• Legal: if required by law, subpoena, or to protect rights and safety.

Nothing is sent to your DMV unless you file it yourself.

5. Security & retention

Data is encrypted in transit and at rest, access is role-restricted (physicians see only what they need to review), and certificate links use unguessable tokens. We retain evaluation records as required for medical-record and legal purposes, typically [X years, per attorney / state medical-records rules] , then delete or de-identify them.

6. Your rights

You may request access to, a copy of, correction of, or deletion of your information (subject to medical-record retention laws) by emailing support@shadedmd.com. California residents: [CCPA/CPRA disclosures: attorney to complete]. We honor verified requests within 30 days.

7. Cookies & analytics

We use essential cookies to run the site and privacy-respecting analytics to understand aggregate usage. We do not use advertising trackers on pages where you enter health information.

8. Children

The service is for adults 18 and older. We do not knowingly collect information from children.

9. Changes & contact

Material changes will be posted here with a new date. Privacy questions: support@shadedmd.com, or write to [BUSINESS ADDRESS].