Privacy Policy

1Scope and Privacy Commitment

This Privacy Policy explains how PENCIL Health, LLC, doing business as PENCIL Health, collects, uses, discloses, and protects personal information through https://www.pencilhealth.com, PENCIL Health accounts, membership enrollment, payment-related records, transactional communications, and related services (collectively, the “Services”). It does not govern a member’s independent handling of information after a care plan is printed or downloaded from the platform.

PENCIL Health does not sell patient services, operate a patient portal, or request patient information. The Services are intended primarily for healthcare professionals and authorized practice staff.

2Information We Collect

Information You Provide

• Account and identity information, such as name, professional title, credentials, email address, telephone number, country, and login information.
• Professional and organization information, such as practice name, business address, license jurisdiction and number when collected for verification, and authority to enroll an organization.
• Membership and transaction information, such as plan, seat and staff-login counts, price, taxes, purchase and renewal dates, payment status, and Stripe transaction identifiers.
• Practice configuration and member content, such as a practice logo, trade name, contact details, templates, private library content, and care-plan customizations that do not contain patient information.
• Communications you send directly to us, including support, billing, privacy, accessibility, licensing, or legal inquiries.

Information Collected Automatically

• Device and network information, such as IP address, browser, operating system, device type, language, approximate location derived from IP address, and identifiers.
• Usage and log information, such as pages and features viewed, searches, clicks, access time, referring page, session activity, errors, security events, and account actions.
• Cookie and similar-technology information described in the Cookie Notice.
• Email-delivery and verification information, such as recipient email address, message type, send and delivery time, delivery status, bounce or complaint status, and verification-link or code activity.

Information From Service Providers

We may receive transaction status, billing contact details, fraud or risk signals, limited payment-method information such as brand and last four digits, and related records from Stripe. We may receive analytics reports from Google Analytics and transactional-email delivery records from Resend. We do not intend to receive complete payment-card numbers from Stripe.

3No Patient Information

DO NOT SUBMIT PATIENT NAMES, CONTACT DETAILS, MEDICAL RECORD NUMBERS, DATES OF BIRTH, IMAGES, CLINICAL RECORDS, OR OTHER INFORMATION THAT IDENTIFIES OR COULD REASONABLY IDENTIFY A PATIENT.

PENCIL Health does not design the Services to create, receive, maintain, or transmit patient information on behalf of a member. A member’s use of an external printer, email account, text service, patient portal, electronic health record, or storage system is outside the Services and governed by the member’s own privacy and security obligations.

4How We Use Information

We use personal information to:

• create, verify, administer, secure, and support accounts and staff logins;
• confirm eligibility, credentials, organization authority, and country availability;
• provide memberships, platform features, practice customization, and support;
• process payments, renewals, taxes, refunds when applicable, and transaction records;
• send verification, security, receipt, renewal, cancellation, service, policy, and other transactional messages;
• measure Website use, diagnose problems, improve navigation, and develop features;
• detect fraud, misuse, scraping, security threats, and violations of agreements or law;
• protect rights, safety, intellectual property, systems, members, and third parties;
• comply with legal, tax, accounting, sanctions, recordkeeping, and regulatory obligations; and
• establish, exercise, or defend legal claims.

PENCIL Health does not currently use account email addresses for newsletters or marketing campaigns. If that changes, we will provide legally required notices, choices, and unsubscribe mechanisms and update this Policy.

5Legal Bases for EEA and UK Processing

Where the European Economic Area (“EEA”) or United Kingdom data-protection laws apply, we process personal information based on one or more of the following: performance of a contract or steps requested before a contract; compliance with legal obligations; legitimate interests such as securing, administering, and improving the Services, preventing misuse, and protecting legal rights; and consent, including consent for nonessential analytics cookies where required. You may withdraw consent through Cookie Settings or by contacting us, without affecting prior lawful processing.

6How We Disclose Information

We may disclose information to:

• Stripe, which processes payments, fraud screening, transaction records, and related services;
• Resend, which sends and records verification and transactional email events;
• Google Analytics, when enabled under applicable consent settings, to measure Website and feature use;
• hosting, database, storage, security, authentication, technical support, tax, accounting, legal, and professional service providers;
• an acquiring or successor organization in a merger, financing, reorganization, sale of assets, or similar transaction, subject to appropriate protections;
• government authorities, courts, regulators, or other parties when reasonably necessary to comply with law, protect rights or safety, investigate misuse, or establish or defend claims; and
• other parties at your direction or with your consent.

Service providers are permitted to process information for contracted purposes and subject to applicable agreements and law. Their independent activities may also be governed by their own privacy policies.

7Key Service Providers

Stripe

Stripe processes payment and transaction information. PENCIL Health should not receive or store complete payment-card numbers. Stripe’s privacy information is available at https://stripe.com/privacy.

Resend

Resend, operated by Plus Five Five, Inc., delivers account-verification and transactional emails and may process recipient addresses, message content, delivery events, IP or device information associated with verification activity, and related logs. Resend states that account data, email metadata, logs, and API records are stored in the United States. Its privacy information is available at https://resend.com/legal/privacy-policy.

Google Analytics

Google Analytics may use first-party cookies and similar technologies to collect device, browser, approximate location, and Website-activity information and produce usage reports. At launch, PENCIL Health intends to use analytics for measurement rather than advertising, remarketing, or personalized advertising. Google’s privacy information is available at https://policies.google.com/privacy. You may manage analytics through Cookie Settings.

8Cookies and Similar Technologies

We use essential technologies for login, security, session continuity, payment flow, load balancing, and saved privacy preferences. With legally required consent, we may use Google Analytics to understand aggregate use and improve the Website. We do not currently use advertising or remarketing cookies. See the Cookie Notice for more information.

9Sale, Sharing, and Targeted Advertising

PENCIL Health does not sell personal information for money. PENCIL Health does not knowingly share personal information for cross-context behavioral advertising or use personal information for targeted advertising at launch. If these practices change, we will update this Policy and provide legally required opt-out mechanisms before implementing the change.

10International Transfers

PENCIL Health is located in the United States, and its providers may process information in the United States and other countries. Those countries may have privacy laws different from those where you live. Where required, we use legally recognized safeguards or vendor transfer mechanisms for cross-border transfers. Stripe and Resend publish information about their own international-transfer mechanisms.

Before intentionally offering services in a jurisdiction that requires a local privacy representative or additional notice, PENCIL Health will evaluate and implement that requirement or restrict availability in that jurisdiction.

11Data Retention

We retain personal information for as long as reasonably necessary for the purposes described in this Policy, including to maintain an account and membership, provide Services, preserve agreement and transaction records, comply with tax and legal obligations, resolve disputes, enforce agreements, maintain security, and support ordinary backups. Retention varies by data type, legal requirement, account status, and operational need. We delete or de-identify information when it is no longer reasonably necessary, subject to backup, legal, fraud-prevention, and recordkeeping requirements.

12Security

We use reasonable administrative, technical, and organizational safeguards appropriate to the Services. No transmission, platform, vendor, or storage system can be guaranteed completely secure. You are responsible for strong credentials, protecting verification links and codes, maintaining current devices, limiting staff access, and promptly reporting suspected misuse.

13Your Privacy Choices and Rights

Depending on where you live and subject to legal exceptions, you may have rights to request access, correction, deletion, restriction, objection, portability, or information about our processing; withdraw consent; or appeal a privacy-request decision. You may also have rights to opt out of sale, sharing, targeted advertising, or certain profiling. PENCIL Health does not currently engage in sale, cross-context behavioral advertising, or legally significant automated decision-making.

Submit a request to penciladmin@pencilhealth.com. We may need to verify your identity and authority. Authorized agents must provide legally sufficient proof of authority. We will not discriminate against you for exercising an applicable right. EEA and UK individuals may also complain to their local supervisory authority.

You can change analytics-cookie choices through Cookie Settings. Where required and technically supported, we will process recognized browser-based opt-out preference signals in accordance with applicable law.

14Children

The Services are not directed to children, and professional accounts are not available to anyone under 18. We do not knowingly collect personal information from children under 13. If you believe a child submitted information, contact penciladmin@pencilhealth.com.

15Changes and Contact

We may update this Policy and will post the revised version with a new effective date. We will provide additional notice when required for a material change. Privacy questions and requests may be sent to penciladmin@pencilhealth.com or PENCIL Health, LLC, 10117 N 92nd St Ste 101, Scottsdale, AZ 85255.