Privacy Policy

Last updated: September 28, 2026

CareCost ("we," "us," or "our") is committed to protecting the privacy of our users. This Privacy Policy explains how we collect, use, and protect your information when you use our drug cost estimation service.

1. Information We Collect

Account Information: When you create an account, we collect your email address, password (stored securely via Supabase Auth), and practice name.

Practice Information: Practice name, NPI, address, phone number, and operational preferences (fee schedules, default settings).

Usage Data: Each time an estimate is shown, we log the drug, the payer or insurance type, where the price came from, and a one-way code that tells two estimates apart. We use this to count usage and improve the prices. We do not know, and do not log, which patient an estimate is for.

Website Visits: When you read our public pages, we use Google Analytics and our own visit log. The visit log keeps the page you viewed, your city, and the name of the organization that owns the network you are on (for example, a hospital system or an internet provider). We do not store your IP address in it. We also keep a random ID in your browser so we can count repeat visits. It is not tied to your name or email. On a repeat visit we may ask what your job is. If you answer, we store that answer with the visit. You can clear the ID any time by clearing your browser’s site data.

2. Information We Do NOT Collect or Store

Patient Health Information (PHI): CareCost is designed with a privacy-first architecture. The estimator never asks for a patient’s name, date of birth or member ID. The math runs in your browser. To look up prices, coverage rules and assistance programs, your browser sends our servers the drug code, the payer, and any diagnosis codes you enter. The benefit numbers you type (deductible, amount met, coinsurance) stay in your browser, except in feedback: When your staff send us feedback from the app, it is stored with a copy of the estimate on screen (drug, dose, patient weight, payer, state, costs and benefit amounts) so we can reproduce the problem. It never includes a patient’s name, and there is no field for one. Please do not type patient names into feedback. Estimate data is:

• Never linked to a patient
• Never sold. The only outside service that sees any of it is Google Analytics, which records which features and drug codes are used — never patient details
• Not saved as an estimate: CareCost has no saved-estimate feature. To keep a copy, download the PDF

3. How We Use Your Information

• To provide and maintain the CareCost service
• To manage your account and subscription
• To track usage for billing purposes
• To communicate service updates and important notices
• To improve our service based on aggregate, non-identifying usage patterns

4. Data Security

We use industry-standard security measures including:

• TLS encryption for all data in transit
• Row-Level Security (RLS) in our database ensuring practice isolation
• JWT-based authentication with short-lived tokens
• Service-role separation between client and server operations

5. Third-Party Services

We use the following third-party services:

• Supabase — Authentication and account data storage
• Stripe — Payment processing (we never see or store your credit card details)
• Vercel — Application hosting

6. Data Retention

Account and practice data is retained for the duration of your subscription. Upon account cancellation, we retain your data for 30 days in case of reactivation, then permanently delete it.

7. Your Rights

You may:

• Access and update your account information at any time through Settings
• Request a copy of all data we hold about your practice
• Request deletion of your account and all associated data

8. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via the email associated with your account.

9. Contact

For privacy-related questions or requests, contact us at legal@carecostestimate.com.