Privacy Policy

1. Who we are

MedicalMatch Corp (“MedicalMatch,” “we,” “us,” or “our”) operates the Healthcare Workforce Operating System, with a marketplace solution embedded, available at medicalmatch.io and through related products. This Privacy Policy explains what personal information we collect, how we use it, and the rights you have under state and federal privacy laws.

2. Information we collect

We collect the following categories of personal information:

1. Identifiers, such as name, email address, phone number, postal address, employer or facility, professional license number, IP address, and device identifiers.
2. Commercial information, such as records of services requested, services provided, shifts filled, and transaction history.
3. Internet or network activity, such as pages visited on medicalmatch.io, links clicked, time spent, referring source, and interaction with our forms and emails.
4. Geolocation, limited to general location derived from IP address and, where you grant permission within the platform, device-level location used to match clinicians to nearby shifts.
5. Professional information, such as credentials, certifications, work history, specialties, and employment status.
6. Inferences drawn from the above, such as predicted match quality for a given shift or facility.

We do not knowingly collect personal information from anyone under 16. We do not sell or share personal information of consumers we have actual knowledge are under 16.

3. Where the information comes from

1. Directly from you, through forms, account registration, applications, uploads, and communications.
2. Automatically, through cookies, pixels, session recording tools, and similar technologies when you visit medicalmatch.io.
3. From third parties, including our customers (health systems and facilities), credential verification vendors, background check vendors, and professional licensing databases.

4. Why we collect it

We use personal information to:

1. Operate the MedicalMatch platform, verify credentials, match clinicians to shifts and roles, and process payments.
2. Communicate with you about your account, shifts, applications, and platform updates.
3. Improve the platform, measure performance, and develop new features.
4. Market our services to prospective customers and clinicians, where permitted.
5. Comply with legal obligations, respond to lawful requests, and protect the rights, property, and safety of MedicalMatch, our users, and the public.

5. Who we share it with

We share personal information with the following categories of third parties, each only for the purposes described:

1. Health system and facility customers, when you apply to or accept a shift, interview, or role with them.
2. Analytics providers, including Google (Google Analytics, Google Tag Manager), Microsoft (Clarity), and HubSpot, to measure site and product usage.
3. Advertising networks, including Meta Platforms (Facebook, Instagram), LinkedIn, and Google (Google Ads), for marketing to prospective customers and clinicians through cross-context behavioral advertising. You can opt out of this sharing at any time using the Do Not Sell or Share My Personal Information link in our footer.
4. CRM and marketing automation, including HubSpot, to manage contacts and campaigns.
5. Credentialing and verification vendors, including ClearStar for background checks and licensing verification services.
6. Hosting, infrastructure, and security providers that support platform operations.
7. Professional advisors, including attorneys, auditors, and consultants, under confidentiality obligations.
8. Government or regulatory bodies, where required by law, subpoena, or lawful process.

6. Sale and sharing for cross-context behavioral advertising

Under CPRA and parallel state laws, our use of Meta Pixel, LinkedIn Insight Tag, Google Ads, and similar advertising trackers may be considered “sharing” personal information for cross-context behavioral advertising. We do not sell personal information for monetary consideration.

To opt out, use the Do Not Sell or Share My Personal Information link in our website footer, click “Deny” or “Allow selection” in our cookie consent banner, or enable the Global Privacy Control (GPC) signal in your browser. We honor the GPC signal as a valid opt-out request for the browser transmitting it.

7. Retention

We retain personal information only as long as needed for the purposes described in this policy, to comply with legal obligations, to resolve disputes, and to enforce agreements. Specific retention periods:

1. Account and credential records: for the life of the account, plus 7 years after closure, to meet healthcare recordkeeping standards.
2. Transaction records: 7 years after the transaction.
3. Website analytics data (Google Analytics): up to 14 months.
4. Website session recordings (Microsoft Clarity): up to 13 months.
5. Marketing contact records (HubSpot): until you unsubscribe or request deletion, up to 3 years of inactivity.

8. Your rights

If you are a resident of California, Colorado, Connecticut, Virginia, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Minnesota, Maryland, Tennessee, Indiana, Kentucky, or Rhode Island, you have the following rights, subject to state-specific conditions:

1. Right to know what personal information we have collected about you, and to receive a copy.
2. Right to delete personal information we have collected from you.
3. Right to correct inaccurate personal information.
4. Right to opt out of sale and sharing of personal information for cross-context behavioral advertising.
5. Right to limit use of sensitive personal information.
6. Right to non-discrimination for exercising any of these rights. We will not deny you services, charge different prices, or provide a different level of service because you exercised a privacy right.

9. How to exercise your rights

Submit a request by emailing [email protected] with “Privacy Request” in the subject line, or by mailing the address in Section 14 below. We will respond within 45 days of receiving a verifiable request, with a one-time 45-day extension if reasonably necessary, as permitted by law.

To verify your identity, we will ask you to confirm information already on file. For sensitive requests (deletion, correction), we may ask for additional verification.

10. Authorized agent

You may designate an authorized agent to submit a request on your behalf. We will require written authorization signed by you, and we may ask you to verify your identity directly with us before processing the agent’s request, as permitted by law.

11. Global Privacy Control

MedicalMatch honors the Global Privacy Control (GPC) browser signal. When our website receives a GPC signal from your browser, we treat it as a valid opt-out of sale and sharing of personal information for cross-context behavioral advertising for that browser.

12. Cookies and tracking

We use cookies, pixels, and session recording tools, including Google Tag Manager, Google Analytics, Google Ads, Microsoft Clarity, Meta Pixel, LinkedIn Insight Tag, and HubSpot tracking. Strictly necessary cookies are set without consent. All other cookies and trackers are set only after you accept them through our cookie consent banner. You can change your preferences at any time using the Cookie Preferences link in our footer.

13. Security

We maintain administrative, technical, and physical safeguards designed to protect personal information. No system is perfectly secure. If we become aware of a security incident affecting your personal information, we will notify you as required by applicable law.

14. Contact us

For privacy questions or to exercise your rights:

15. Changes to this policy

We may update this Privacy Policy. We will post the updated version at medicalmatch.io/privacy-policy with a new “Last updated” date. Material changes will be communicated by email to registered users where we have an email on file.