Privacy Policy

Last updated September 2026

Doctorly builds and hosts websites for physicians. Because of how our product works — we assemble doctor websites from public records before a doctor ever signs up — our privacy practices cover a few different groups of people: doctors whose sites we build, doctors who become customers, patients and visitors who use those sites, and people who simply browse doctorly.me. This policy explains, in plain English, what we collect from each group and what we do with it.

Information we collect about doctors

We create draft websites using information that is already public or professionally published: National Provider Identifier (NPI) registry records, state medical board license data, board certification listings, hospital affiliation pages, published research (for example, PubMed and ClinicalTrials.gov), and practice details such as address, phone number, and office hours from sources like Google Business Profile. We do not collect or use any patient medical records, and we never access non-public clinical information.

When a doctor claims their site, we additionally collect the information needed to run their account: name, email address, verification details, theme and content choices, and billing status.

Doctor data removal requests

If we have built a site for you and you would rather we had not, tell us. Email us or use the contact form on our About page, and we will take the site down and remove your profile from our system. You do not need to be a customer, give a reason, or prove anything beyond a reasonable confirmation that you are the doctor in question. Removal requests are typically processed within a few business days.

Information from visitors to doctor sites

Doctor websites hosted on Doctorly include a contact form. When a visitor submits that form, Doctorly does not store the name, email address, phone number, or message in our database. The submission is processed only transiently and transmitted directly to the doctor's practice by email, using our transactional email provider to deliver it. The provider handles the message content operationally, as part of sending it, under its own security practices — Doctorly does not maintain a Business Associate Agreement (BAA) with the provider, so the contact form should not be used to send protected health information. The only thing we keep is a non-identifying delivery record: for each practice, a daily count of messages delivered or failed, with no visitor name, email, phone, message, or other inquiry content in it. The form is not intended for clinical communication or medical records. If you include health details anyway, they are forwarded to the practice as ordinary email and are not stored in Doctorly's database.

Messages sent directly to Doctorly

This no-storage design applies to forms on customer doctor sites. If you contact Doctorly itself through the About page, we retain the name, email address, and message you provide as a business or support inquiry so we can respond and keep a record of the request. Do not use the Doctorly About form for patient or clinical details.

Authenticated support tickets and conversations with the Doctorly support assistant are also retained so the assistant and our team can respond, preserve context, and resolve the request. These tools are for website, account, billing, and marketing support only. Do not include patient names, medical records, health details, or other protected health information in a support ticket or chat. Messages sent to the support assistant are also processed by our AI service provider to generate a response.

Information we collect automatically

Like most websites, we collect basic technical information when you visit doctorly.me or a hosted doctor site: IP address, browser type, pages viewed, and referring page. We use privacy-respecting aggregate analytics to understand traffic and improve the product, and we share aggregate visit statistics (never individual visitor identities) with doctors about their own sites.

How we use information

We use the information above to build and host doctor websites, verify doctors who claim their sites, process subscriptions, deliver doctor-site contact messages to practices, respond to messages sent directly to Doctorly, provide support, measure and improve the product, and meet legal obligations. We do not sell personal information, and we do not use doctor-site contact form messages for advertising.

Cookies

We use session cookies that keep signed-in doctors logged in to their dashboard. Our self-hosted Umami traffic analytics is configured without analytics cookies, and we do not use third-party advertising cookies. You can block or delete cookies in your browser settings; public marketing and doctor sites will still work, though dashboard sign-in requires session cookies.

Third-party services

We rely on a small set of service providers to run Doctorly: Supabase (database and authentication infrastructure, where site content and messages sent directly to Doctorly are stored — not the contents of customer doctor-site contact forms), Resend (our transactional email provider, which processes doctor-site contact messages operationally in order to deliver them to practices — Doctorly does not maintain a Business Associate Agreement with Resend), Stripe (payment processing — we never see or store full card numbers), Google (fonts and business profile data), our self-hosted Umami analytics service, and our hosting provider. Each of these processes data on our behalf under its own security and privacy commitments.

Data retention and security

We keep doctor account data for as long as the account is active. We do not store submissions from customer doctor-site contact forms: those messages pass through Doctorly only long enough to be delivered to the practice, and we retain only an aggregate daily count of delivered and failed messages per practice, with no visitor information in it. Messages sent directly to Doctorly are retained as business/support correspondence until they are no longer needed for the request or our legitimate records. Unclaimed draft sites and their underlying profiles are removed promptly on request. Data is encrypted in transit, access is restricted to staff who need it, and we review access regularly. No system is perfectly secure, but we take reasonable, industry-standard measures to protect what we hold.

Your rights

Depending on where you live, you may have the right to access, correct, or delete personal information we hold about you. Whether or not a specific law applies, our practice is simple: ask us what we have, and ask us to fix or delete it, and we will.

Changes and contact

If we make material changes to this policy, we will update the date above and, for customers, send a notice by email. Questions, requests, or concerns can be sent through the contact form on our About page.