Privacy Policy

1. Scope

This Privacy Policy explains how RoverHealth Inc. ("RoverHealth," "we," "us") collects, uses, shares, and protects information when you visit our website or use our platform.

It applies to physicians who create accounts, representatives of healthcare facilities, and visitors to our site. It does not apply to the privacy practices of any facility you engage with through the platform, which maintain their own policies.

2. Information you give us

When you sign up or communicate with us, we collect the information you provide, which may include:

• Identity and contact details — first name, last name, and email address.
• Professional details — your role (physician or facility), medical specialty, job title, and organization or practice name.
• Credentialing materials — your curriculum vitae and any supporting documents you upload, including licensure, board certification, and malpractice history information.
• Correspondence — the content of emails, texts, or calls you exchange with our team.
• Payment and tax details — where required to pay you for completed shifts.

3. Information we collect automatically

When you use the platform, we and our infrastructure providers automatically collect limited technical information, including IP address, browser and device type, pages viewed, and the dates and times of your visits. We use this to operate the service, diagnose problems, and protect against abuse.

4. Cookies

We use a strictly necessary session cookie to keep you signed in after you use an email sign-in link. It is set as HttpOnly, Secure, and SameSite=Lax, and it expires after 30 days or when you sign out.

We do not use this cookie to track you across other websites. If we introduce analytics or advertising cookies in the future, we will update this policy and, where required, request your consent first.

5. How we use your information

We use the information described above to:

• Create and administer your account, and authenticate you through email sign-in links.
• Verify your licensure, credentials, and professional history, including periodic re-verification.
• Match you with shifts, and present your qualifications to facilities considering you for a role.
• Facilitate payment for completed shifts and meet related tax and recordkeeping obligations.
• Send transactional messages such as confirmations, sign-in links, and service notices.
• Send you information about opportunities and updates, where you have not opted out.
• Detect, investigate, and prevent fraud, abuse, and security incidents.
• Comply with legal obligations and enforce our Terms & Conditions.

6. How we share your information

We share information in the following circumstances, and not otherwise:

• With healthcare facilities — your professional profile and credentialing materials, so they can evaluate you for a shift. We share these with facilities relevant to the roles you are pursuing.
• With service providers — vendors that host our infrastructure, store data and uploaded files, deliver email, verify credentials, and process payments, each acting on our instructions.
• With insurers and credentialing partners — where necessary to place professional liability coverage or verify your standing.
• For legal reasons — where required by law, subpoena, or regulator, or to protect the rights, safety, or property of RoverHealth, our users, or the public.
• In a business transfer — in connection with a merger, acquisition, financing, or sale of assets, subject to this policy.

7. We do not sell your information

RoverHealth does not sell your personal information, and does not share it for cross-context behavioral advertising, as those terms are defined under applicable state privacy law.

8. Service providers we rely on

Our platform is built on third-party infrastructure. These providers process data on our behalf under contractual confidentiality and security obligations, and are not permitted to use it for their own purposes.

This includes providers for website and application hosting, database storage, file storage for uploaded documents, and transactional email delivery. We review this list as our stack changes and will update this policy accordingly.

9. Health information and HIPAA

The information we collect from physicians is professional and credentialing information about you — it is not protected health information about patients.

RoverHealth does not seek, and asks that you never submit, patient records or other protected health information through our platform, email, or forms. Where we act as a business associate of a covered entity under a separate written agreement, the terms of that agreement govern the handling of any protected health information.

10. Data retention

We retain your account information for as long as your account is active, and afterwards for as long as needed to comply with legal, tax, credentialing, and recordkeeping obligations, resolve disputes, and enforce our agreements.

Credentialing documents and payment records are generally retained longer than marketing contact details, because law and insurance requirements demand it. When information is no longer needed, we delete it or de-identify it.

11. Security

We use administrative, technical, and physical safeguards designed to protect your information, including encryption in transit, access controls, signed and time-limited sign-in links, and restricted internal access to credentialing files.

No method of transmission or storage is completely secure. We cannot guarantee absolute security, and you share information with us at your own risk. If we become aware of a breach affecting your information, we will notify you as required by law.

12. Your choices and rights

You can update your account information at any time, or ask us to do it for you. You can opt out of marketing email using the unsubscribe link or by replying to any message; we will still send transactional messages necessary to operate your account.

Depending on where you live, you may have the right to request access to the personal information we hold about you, to request correction or deletion, to request a portable copy, to opt out of sale or sharing (which we do not do), and to be free from discrimination for exercising these rights.

To make a request, contact us at jennifer@roverhealth.ai. We will verify your identity before acting, and will respond within the timeframe required by applicable law. You may designate an authorized agent to make a request on your behalf.

13. State-specific disclosures

California residents have rights under the California Consumer Privacy Act as amended by the CPRA, including the rights described above and the right to limit the use of sensitive personal information. We do not use sensitive personal information for purposes beyond those permitted without a limitation right.

Residents of other states with comprehensive privacy laws — including Colorado, Connecticut, Virginia, Texas, Oregon, and Montana — have comparable rights, including the right to appeal a denied request. To appeal, reply to our response and we will review it.

14. Children's privacy

The platform is intended for licensed medical professionals and authorized facility representatives. It is not directed to anyone under 18, and we do not knowingly collect information from children. If we learn we have, we will delete it.

15. International users

RoverHealth operates in the United States, and information we collect is stored and processed there. If you access the platform from outside the United States, you understand that your information will be transferred to and processed in the United States, where privacy laws may differ from those in your jurisdiction.

16. Changes to this policy

We may update this Privacy Policy as our practices evolve. When we do, we will revise the "Last updated" date above. If the change is material, we will provide additional notice by email or through the platform.

17. Contact us

Questions, requests, or complaints about this policy can be sent to jennifer@roverhealth.ai.

RoverHealth Inc., 123 Main Street, Suite 200, New York, NY 10001.