Privacy Policy

Last updated: July 25, 2026

CollabraMatch LLC ("CollabraMatch," "we," "us," or "our") operates the CollabraMatch platform, a healthcare professional collaboration service. This Privacy Policy explains how we collect, use, disclose, and protect your information when you use our platform.

1. Information We Collect

We collect information you provide directly when creating your account and using our services:

• Account Information: Name, email address, phone number, and professional credentials.
• Professional Credentials: License numbers, NPI number, board certifications, practice specialties, and credential documentation.
• License Verification Data: Information obtained from the California Department of Consumer Affairs (DCA) to verify your professional license status.
• Business Information: Practice address, business entity information, and tax identification details (W-9).
• Payment Information: Card and bank-account payment details, collected and processed by our third-party payment processor, Stripe. We do not store full card numbers on our servers.
• Identity Verification Data: Supervising physicians who enroll to receive payouts complete identity verification through Plaid. Plaid collects the verification information directly from you — which may include a government-issued photo identification document and a self-portrait photograph — and returns only the verification outcome to us. We do not receive or store those images.
• Payout Bank Account Information: Physicians link a bank account for payouts through Plaid. We retain only the limited details needed to originate a payment, such as the account type, a masked account number, and the last four digits of the routing number, together with an access token issued by Plaid that we store encrypted.
• Uploaded Documents: Curriculum vitae (CV), insurance certificates, and other professional documents you upload.
• Usage Data: Information about how you interact with the platform, including pages visited, features used, and timestamps.

2. How We Use Your Information

We use your information to:

• Verify your identity and professional credentials.
• Facilitate matching between supervising physicians and practitioners.
• Generate and manage Collaborative Practice Agreements (CPAs).
• Process subscription payments and physician payouts.
• Track compliance documentation and monthly attestations.
• Send transactional communications (account updates, compliance reminders, payment confirmations).
• Maintain audit trails as required by California healthcare regulations.
• Improve and develop our platform and services.

3. Third-Party Services

We share information with the following categories of third-party service providers:

• Stripe: Payment processing for practitioner subscription billing, including card and bank-debit payments. Stripe's privacy policy governs their handling of payment data.
• Plaid: Identity verification and bank-account verification for physician payout enrollment. Plaid collects identity and financial-institution information directly from you, and its handling of that information is governed by Plaid's own privacy policy and end user privacy policy.
• TaxBandits: Collection of IRS Form W-9 and preparation and filing of Form 1099-NEC for physicians who receive payouts.
• Mercury: Origination of ACH bank transfers for physician payouts.
• California DCA iServices API: License verification and status monitoring for California-licensed healthcare professionals.
• SignWell: Electronic signature services for legal documents.
• Google: Authentication services (OAuth 2.0) for account sign-in.
• TextLink: Delivery of SMS messages, including phone verification codes, signing reminders, and compliance notifications.
• EmailIt: Delivery of transactional email, orchestrated through our workflow automation service (n8n).
• Cloudflare: Website hosting, data storage, security, and performance services.

We do not sell your personal information to third parties.

4. Data Retention

• Collaborative Practice Agreements and onboarding documents: Retained for 7 years after termination, as required by California healthcare recordkeeping standards.
• Audit logs: Retained for 10 years.
• Account information: Retained while your account is active and for 30 days after account termination to allow data export.
• Payment and payout records: Retained as required by tax and financial recordkeeping regulations, including IRS information-return requirements applicable to Forms W-9 and 1099-NEC, and in accordance with the data retention policies of our payment and banking providers.

5. California Privacy Rights (CCPA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA):

• Right to Know: You may request information about the categories and specific pieces of personal information we have collected about you.
• Right to Delete: You may request deletion of your personal information, subject to certain exceptions (such as regulatory retention requirements).
• Right to Opt-Out: We do not sell personal information, so this right does not apply.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise these rights, contact us at info@collabramatch.com.

6. Protected Health Information (PHI)

CollabraMatch is not designed to collect, store, or transmit Protected Health Information as defined by HIPAA. Users are prohibited from uploading or sharing PHI on the platform unless a separate Business Associate Agreement (BAA) is in place. Any clinical communications between collaborating professionals must occur through HIPAA-compliant channels outside of CollabraMatch.

7. Security Measures

We implement commercially reasonable security measures to protect your information, including:

• Encryption of data in transit (TLS/HTTPS) and at rest.
• Role-based access controls limiting who can view your information.
• Regular security assessments of our infrastructure.
• Incident response protocols with regulatory notification procedures.

No method of transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

8. Children's Privacy

CollabraMatch is intended for licensed healthcare professionals. We do not knowingly collect information from individuals under 18 years of age. If we become aware that we have collected information from a minor, we will promptly delete it.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will provide at least 30 days' notice of material changes by posting the updated policy on our website and notifying active users by email. Your continued use of the platform after the effective date of changes constitutes acceptance of the updated policy.

10. Contact Us

If you have questions about this Privacy Policy or wish to exercise your privacy rights, contact us:

CollabraMatch LLC
365 Perkins Street #201
Oakland, CA 94610
Email: info@collabramatch.com
Phone: (858) 245-5644