Privacy policy

What we collect

• Account details: your email address, name, and whether you signed up as a physician or an employer. If you set a password, we store only a salted scrypt hash of it.
• Match quiz answers: your preferences (regions, schedule, pay, practice setting and similar), your career details (degree, boards, skills, licenses, start date), and the match profile we derive from them.
• NPI: the NPI number you enter, plus what the public NPPES registry run by CMS returns for it: the registered name, taxonomy (specialty or in-training status) and state. We re-check verified NPIs against the registry automatically, about once a day.
• CV: if you upload one, we store the file. Our own servers extract short highlights from it (for example, skills and training) using fixed rules; the file is not sent to any outside AI service. Groups see only the highlights you approve.
• Messages and hiring activity: conversations with groups, interview requests and times, the roles you save or pass on, and hire and interview outcomes either side reports.
• Job alerts and email preferences: saved searches and whether you want alert and message emails.
• Employer information: for employers, organization details (name, type, description, website, contact email), the jobs you post and your decisions on candidates.
• Validation study answers: if you take part in our match-quality study at /validate, we store your ratings, any notes, and the optional name and role you give. We also store a study cookie and a one-way hash of your browser's user-agent string to spot duplicate or automated submissions. Study answers are kept separately from VitalPair accounts.
• Technical data: IP addresses, used briefly for rate limiting and abuse prevention, and the cookies listed below.

Cookies and local storage

• jdmd_session: keeps you signed in (up to 30 days).
• jdmd_cand: links an unfinished, not-yet-signed-in profile to your browser (up to 60 days).
• jdmd_pwbind: lasts 15 minutes and confirms that a password sign-up is finished in the same browser that started it.
• jdmd_val: used only by the validation study.
• Your browser's local storage keeps quiz progress markers so you can pick up where you left off.

We don't use advertising or third-party tracking cookies.

How we use it

To match you with roles or candidates; to show physicians to groups according to their privacy settings; to deliver messages; and to send the emails the service depends on: sign-in and confirmation links, “finish later” links you ask for, message notifications and job alerts. You can turn off message and alert emails in your notification settings or with the unsubscribe link in those emails. Sign-in links still arrive.

Physicians control visibility. You can hide from browsing entirely or from specific groups. Before there is mutual interest, a group sees an anonymous summary (degree, boards, skills, licenses, start date and highlights you approved), never your name. Your name and CV are shared with a group only once you both express interest, you start the conversation, or you accept an interview. Your CV is not available in a conversation that was declined.

Who we share it with

We do not sell your personal information, and we do not use it for targeted advertising. We use a small number of service providers to run VitalPair. They process data only to provide their service to us:

• Vercel: hosting.
• Supabase: our database.
• Resend: email delivery.
• Google Workspace: our support inbox, if you email us.

We look up NPIs in the public NPPES registry run by CMS.

Keeping, exporting and deleting your data

We keep your data while your account is active. Sign-in links expire after 15 minutes and work once. Unfinished profiles that were never linked to an account stay until you delete them.

• Download your data: signed-in physicians and employers can download a JSON copy of their data from their profile or dashboard.
• Physicians: deleting your account removes your account, match profile, CV, NPI details, saved jobs, alerts and conversations. An unfinished profile without an account can be deleted from the quiz or profile page in the browser that created it.
• Employers: deleting your account removes your sign-in, closes every job you posted, and erases your groups' contact email, description and website. Group names, closed listings and existing conversations remain for the physicians you spoke with, without any link to your account.
• Validation study answers are not linked to accounts, so account tools don't reach them. Email us with any question about study data.

You can also email support@vitalpair.com to ask for a copy of your data or its deletion.

Your privacy rights

Depending on where you live, including several US states such as California, Colorado, Connecticut and Virginia, you may have the right to know what personal information we hold about you, and to access, correct, delete or get a copy of it. You can use the self-serve tools above or email support@vitalpair.com with the subject “Privacy request”. We may need to confirm the request comes from you.

Changes

If we change this policy, we'll update the date at the top of this page. See also our terms of use.

Contact

Questions or requests about your data: support@vitalpair.com.