Effective September 10, 2026. Updated October 11, 2026
CredentialedMD privacy notice
CredentialedMD is a service of Pure Path Web Solutions in Illinois. We collect only the business and public professional information needed to sell, build, review, host, and maintain a physician portfolio website. CredentialedMD is not a patient portal, clinical system, or medical-record service.
Information we collect
We may collect your name, professional email, phone number, specialty, practice and role, billing status, website goals, domain preference, public professional materials, approved imagery, source links, revision requests, and service correspondence. Stripe processes payment-card and billing information; we do not receive full card numbers.
The builder reads supported CV files in your browser. A free preview is stored in the current browser session. If you ask us to email you a preview link, we save that preview (your professional fields, extracted CV text, portrait and email address) on our server, email you a private link, and delete the saved preview 30 days after your last change. The email you enter in the preview is also prefilled on the Stripe checkout page if you continue. After checkout, your professional fields, extracted CV text, and supplied portrait are saved to your private project on our server as you edit. A secure project link allows you and our authorized review team to access the draft. Keep that link private. Do not use the builder for patient or clinical information.
Information you must not provide
Do not submit patient names, patient contact information, medical records, clinical notes, images of patients, insurance information, private messages, private credentialing documents, passwords, or any protected health information. If restricted information is submitted accidentally, stop using the workflow and contact us so it can be isolated and removed.
How information is used
We use submitted information to verify a paid order; communicate about the project; review sources; draft, stage, approve, launch, and maintain the website; deliver form notices; manage billing; prevent abuse; and meet legal, accounting, and security obligations.
Technical information
Our hosting, security, and payment providers may process an IP address, browser type, device information, request time, referring page, and security logs when someone uses the service. We use this information to operate the site, prevent abuse, and diagnose problems. We do not sell personal information.
Site analytics
On our public pages, such as the home, pricing, guide and contact pages, we may use Google Analytics and Microsoft Clarity to measure aggregated usage: which pages are visited, how visitors find us, and which ordering steps are completed. Clarity may record page interactions such as clicks and scrolling so we can find layout problems. These tools may set their own cookies or similar identifiers.
They do not receive what you type into our forms, your name, email address or phone number, or any patient information. Form fields are masked in session recordings. Private project, builder, review, intake and domain pages do not load these tools. Google advertising features and ad personalization are turned off.
If your browser sends a Global Privacy Control or Do Not Track signal, these tools are not loaded. You can also block them with a content blocker or install the Google Analytics opt-out browser add-on.
Links in our emails carry a random code so we can count whether a person opened the link, separately from automated email scanners. The code contains no name or email address, is removed from the address bar after the page loads, and is matched to a recipient only in our own sending records.
Website assistant
When the website assistant is available on our public pages, the messages you type into it are sent to Anthropic, our AI provider, to generate replies. Anthropic's commercial terms state that Anthropic may not train models on customer content from its services. We do not store your conversation; our servers keep only usage counts, such as the number of messages and the size of each request, to manage cost and prevent abuse. Site analytics may record that the assistant was opened and how many messages were sent, never what they say. Do not share patient information in the assistant. If you ask the team to contact you, the name, email and question you submit are handled like any other website message.
Service providers
The launch architecture uses Stripe for checkout and subscription billing, Railway for hosting and server functions, and Resend for operational email delivery. Cloudflare provides domain availability, registration, and DNS when those features are enabled. Domain registration requires registrant contact and billing details. Registrar disclosure and redaction rules depend on the domain and applicable requirements. Some template fonts load from Google Fonts. Each provider handles data under its own terms and privacy practices.
Publication and professional sources
Information approved for the physician website becomes public after launch. Public registry and professional-source information is treated as evidence for review, not automatic permission to publish every available field. The physician approves final public content.
Retention and deletion
Active-client materials are retained while the service is active. Working source files may be removed 90 days after launch or cancellation when they are no longer needed. Project and support records may be retained for up to 24 months after termination. Billing, tax, fraud-prevention, and legal records may be retained for up to seven years or as otherwise required by law. Information can be deleted earlier on verified request when no legal, accounting, security, or dispute hold applies.
Security
We use access controls, encrypted transport, environment-managed credentials, noindex staging, and limited service-provider access appropriate to this workflow. No internet service can promise absolute security. Do not use the service for restricted clinical information.
Your choices
You may request access, correction, export, or deletion of project information, and may manage future subscription renewals through the Stripe customer portal. Some transaction and legal records may need to be retained.
Children and location
The service is intended for physicians and authorized business purchasers who are at least 18 years old. Information may be processed in the United States and in other locations where our service providers operate.
Changes to this notice
We may update this notice when the service or its providers change. The effective date at the top identifies the current version. Material changes will be posted before they take effect when practical.
Contact
CredentialedMD is a service of Pure Path Web Solutions in Illinois. Submit privacy requests through the secure project reply path or the website inquiry form. We may verify the requester's identity before releasing, changing, or deleting information.