Privacy Policy

MDLaunch LLC | Effective Date: August 30, 2026

This Privacy Policy describes how MDLaunch LLC, a Colorado limited liability company ("MDLaunch," "we," "us," or "our"), collects, uses, and shares information in connection with our website at mdlaunch.com (the "Site") and our physician platform and related services (collectively, the "Services").

By using the Services, you agree to the collection and use of information as described in this Privacy Policy.

1. Information We Collect

1.1 Information You Provide

When you create an account or use the Services, you may provide:

• Account information. Name, email address, phone number, and login credentials.
• Professional information. Medical credentials, specialty, practice name and address, NPI number, and other professional details you provide or confirm during onboarding.
• Uploaded content. Headshots, biography text, CV or resume files, and other materials you upload for use on your website.
• Payment information. Billing address and payment method details, which are processed by our third-party payment processor and not stored on our servers.
• Communications. Messages you send to us through the platform or via email.

1.2 Information from Public and Third-Party Sources

To generate your professional profile and website, we collect publicly available information about you from the following sources:

• National Plan and Provider Enumeration System (NPPES). NPI number, legal name, credentials, specialty taxonomy, practice addresses, and license information.
• PubMed / National Library of Medicine. Published research articles, clinical trial participation, and academic affiliations.
• Professional data providers. Education history (medical school, residency, fellowship), work history, LinkedIn profile URL, and professional headline.
• Public web sources. Existing practice websites, hospital roster pages, physician directory profiles, and review platform profiles (ratings and review counts only, not individual patient reviews).

This information is used solely to pre-populate your professional profile and generate your website content. You review and approve all information before it is published.

1.3 Information Collected Automatically

When you visit the Site or use the platform, we automatically collect:

• Usage data. Pages viewed, features used, actions taken within the platform, and session duration.
• Device and browser information. IP address, browser type, operating system, device type, and screen resolution.
• Cookies and similar technologies. We use cookies and similar tracking technologies for authentication, analytics, and to remember your preferences. See Section 8 for details.

1.4 Information We Do Not Collect

MDLaunch does not collect, process, or store patient health information (PHI) or patient personally identifiable information. The platform is designed exclusively for physician users. Contact forms or appointment request features on generated websites, if offered, are configured to route directly to the physician's own practice systems and do not pass through or store data on MDLaunch servers.

2. How We Use Your Information

We use the information we collect to:

• Provide the Services. Resolve your professional identity, generate your website content, host and maintain your website, manage your domain, and deliver ongoing content and reporting.
• Verify accuracy. Cross-reference information from multiple sources to build an accurate professional profile.
• Improve the platform and train our AI systems. We use aggregated professional data, platform usage patterns, and content performance metrics to improve our AI content generation engine, develop better website templates, and enhance the overall quality and accuracy of the Services. This training uses professional and usage data in aggregate or de-identified form. We do not use individual patient data (which we do not collect) for any training purpose. You may opt out of having your data used for AI training purposes by contacting us at the address in Section 13.
• Communicate with you. Send account notifications, service updates, and respond to your inquiries.
• Comply with legal obligations. Meet applicable legal, regulatory, and compliance requirements.
• Enforce our Terms. Detect and prevent fraud, abuse, or violations of our Terms of Service.

3. How We Share Your Information

We do not sell your personal information to third parties. We have not sold personal information in the preceding twelve (12) months and will not sell personal information in the future.

We share your information only in the following circumstances:

3.1 Published Website Content

The primary purpose of the Services is to publish a professional website on your behalf. Information you approve for publication (your name, credentials, practice information, professional biography, and related content) will be publicly available on your website.

3.2 Service Providers

We share information with third-party service providers who assist us in operating the platform, including:

• Hosting and infrastructure. Cloud hosting providers that store and serve your website and platform data.
• Domain registration. Domain registrars that process domain purchases on your behalf.
• Payment processing. Payment processors that handle subscription billing. These processors are PCI-DSS compliant and we do not store your full payment card information on our servers.
• AI services. Artificial intelligence providers that power our content generation engine. Your professional data is sent to these providers for the purpose of generating website content. These providers are contractually prohibited from using your data for their own purposes, including training their own models on your data.
• Analytics. Analytics services that help us understand how the platform is used.

All service providers are bound by contractual obligations to protect your information and use it only for the purposes for which it was disclosed.

3.3 Legal Requirements

We may disclose your information if required by law, legal process, or government request, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

3.4 Business Transfers

If MDLaunch is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change and any choices you may have regarding your information.

3.5 With Your Consent

We may share your information with third parties when you direct us to or provide explicit consent.

4. Data Retention

We retain your information for as long as your account is active or as needed to provide the Services. After account termination:

• Your website content and professional profile data are retained for 90 days to allow for export and migration.
• Account and billing records are retained as required by applicable law and accounting standards.
• Aggregated, de-identified usage data may be retained indefinitely for analytics, product improvement, and AI training purposes.

You may request deletion of your data at any time by contacting us. We will process deletion requests within 30 days, subject to any legal retention obligations.

5. Data Security

We implement reasonable technical and organizational measures to protect your information, including:

• Encryption of data in transit using TLS and encryption of data at rest.
• Role-based access controls limiting employee access to personal information on a need-to-know basis.
• Regular security reviews and vulnerability assessments.
• Secure development practices for our platform and generated websites.

However, no method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a security breach affecting your personal information, we will notify you in accordance with applicable law.

6. Your Rights

Depending on your location, you may have the following rights regarding your personal information:

• Access. Request a copy of the personal information we hold about you.
• Correction. Request correction of inaccurate or incomplete information.
• Deletion. Request deletion of your personal information, subject to legal retention requirements.
• Portability. Request a copy of your data in a commonly used, machine-readable format.
• Opt out of sale. MDLaunch does not sell your personal information to third parties.
• Opt out of AI training. Request that your data not be used for AI model training and improvement purposes.

To exercise any of these rights, contact us at the address below. We will verify your identity before processing your request. We may request additional information to confirm you are the person whose data is at issue. We will respond to verified requests within 30 days.

If you designate an authorized agent to make a request on your behalf, the agent must provide written authorization signed by you. We may contact you directly to verify the request.

6.1 Colorado Privacy Act

If you are a Colorado resident, you have additional rights under the Colorado Privacy Act (CPA), including the right to opt out of targeted advertising and profiling. MDLaunch does not engage in the sale of personal data or targeted advertising based on personal data. To exercise your CPA rights, contact us using the information in Section 13.

6.2 Other US State Privacy Rights

Residents of states with comprehensive privacy laws (including California, Virginia, Connecticut, and others) may have additional rights, including the right to know whether we process their personal information, the right to access and delete that information, and the right to opt out of the sale of personal information or use for targeted advertising. MDLaunch does not sell personal information or use it for targeted advertising.

7. Categories of Personal Information

The following table describes the categories of personal information we collect, consistent with US state privacy law requirements:

We retain collected categories of information as follows: Categories A through E are retained for as long as your account is active and for 90 days following termination. See Section 4 for full retention details.

8. Cookies and Tracking Technologies

We use the following types of cookies:

• Essential cookies. Required for authentication, security, and basic platform functionality. These cannot be disabled.
• Analytics cookies. Help us understand how visitors use the Site and platform. You may opt out of analytics cookies through your browser settings or by contacting us.

We do not use advertising or cross-site tracking cookies. We do not sell data to advertisers or ad networks. We do not engage in targeted advertising.

9. Do-Not-Track Signals

Some web browsers transmit "Do-Not-Track" (DNT) signals. Because no uniform standard for interpreting DNT signals has been adopted, we do not currently respond to DNT browser signals. If a standard is established in the future, we will update this policy to reflect our practices.

10. Third-Party Links

Your generated website or our Site may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies.

11. Children's Privacy

The Services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a minor, please contact us and we will delete it promptly.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the platform at least 30 days before they take effect. The "Effective Date" at the top of this page indicates when this Privacy Policy was last revised.

13. Contact Us

If you have questions about this Privacy Policy, wish to exercise your privacy rights, or want to submit a data subject access request, contact us at:

MDLaunch LLC Denver, Colorado

Email: hello@mdlaunch.io