Privacy Policy

1. Information we collect

Information you provide

When you sign in, Firebase Authentication processes account and authentication information. Depending on the method you choose, this may include your email address, password credentials handled by Firebase, Google display name, and Google profile image.

If you contact us, we receive the information in your message. When authenticated contribution features are available, they may collect the hospital, service, date, price, insurance details, and description you submit. Contributions require authentication, remain unverified pending review, and do not automatically enter public pricing data.

Public search information

You may select a procedure, city, or ZIP code without signing in. Canonical procedure and city paths are part of the page URL. An exact ZIP selection is stored in the URL fragment, which browsers do not send as part of an HTTP request.

Information collected automatically

Our hosting, security, content-delivery, and API providers may process ordinary technical information such as IP address, request time, requested path, browser or device type, referring page, and security events. This operational information supports delivery, reliability, abuse prevention, and troubleshooting.

2. How we use information

We use information as reasonably necessary to:

• provide public price-search and account authentication;
• operate, secure, maintain, and troubleshoot the services;
• respond to requests and communicate with you;
• review authenticated contributions when that feature is available;
• prevent fraud, misuse, and security incidents; and
• comply with law and protect legal rights.

MedHood does not sell personal information. The service does not use advertising, remarketing, or product analytics trackers.

3. Legal bases

Where applicable law requires a legal basis, we rely on performance of requested services, legitimate interests in operating and securing the service, consent when requested, and compliance with legal obligations. You may withdraw consent where processing depends on it, without affecting earlier lawful processing.

4. When we share information

We share information with service providers only as needed for them to perform services for us. Current infrastructure includes:

• Vercel for the public Next.js frontend;
• Cloudflare for DNS, content delivery, and API security;
• AWS infrastructure for the Express API and database;
• Firebase Authentication and Google for account sign-in; and
• professional advisers or authorities when legally required.

We may also transfer information in a merger, financing, acquisition, reorganization, or sale of assets, subject to applicable law. We do not publish account identity with a contribution.

5. Cookies and browser storage

Firebase Authentication may use browser storage and related technologies to keep you signed in and protect authentication flows. Blocking required storage may prevent sign-in or other requested features from working.

We do not use advertising cookies, Google Analytics, remarketing pixels, or abandoned-cart tracking.

6. Google sign-in

If you choose Google sign-in, Google provides Firebase Authentication with information needed to authenticate you, which may include your name, email address, and profile image. Google processes information under its own privacy terms. MedHood does not request your Google contacts, friends list, files, or social feed.

7. Data retention

We retain information for as long as reasonably necessary for the purposes described here, including account operation, security, contribution review, dispute resolution, and legal compliance. Retention periods vary by the information and provider. We may retain limited records where law or legitimate security needs require it.

8. Information security

We use administrative and technical safeguards intended to protect information. No internet transmission or storage system is completely secure, so we cannot guarantee absolute security. Do not submit credentials or sensitive health information through general contact messages.

9. Children

The services are not directed to children under 13, and we do not knowingly collect their personal information. If you believe a child has provided personal information, contact us so we can review and address the request.

10. Privacy rights and choices

Depending on your location, you may have rights to request access, correction, deletion, restriction, objection, or portability of personal information, and to appeal or withdraw consent. These rights can be limited by applicable law.

To make a request, email medhoodteam@gmail.com. We may need to verify your identity before acting on a request.

11. United States processing

MedHood and its providers process information in the United States. If you access the services from another country, your information may be transferred to a jurisdiction with different data-protection laws.

12. Changes to this policy

We may update this policy as the service or legal requirements change. The date at the top identifies the current version. Material changes may also be announced through the service when appropriate.

13. Contact us

Questions or privacy requests may be sent to MedHood LLC at medhoodteam@gmail.com.