Legal

    Privacy Policy

    Privacy Policy

    TruthTides ("TruthTides," "we," "us," or "our") respects your privacy. This Privacy Policy describes the personal information we collect, how we use and share it, and the choices you have. It applies to truth-tides.com, truthtides.com, and any subdomains and related services (the "Services").

    Plain-language summary. We are an educational reference platform, not a healthcare provider. We do not knowingly collect Protected Health Information (PHI). We collect account, contact, billing, and usage data needed to run the Services. We use Supabase (database, auth, storage), Stripe (payments), Resend (email), and Lovable (AI gateway) as service providers. We do not sell your personal information.

    1. Information We Collect

    Account information. When you create an account we collect your email address, password (stored as a salted hash by our authentication provider), and any optional profile information you provide.

    Physician credentialing information. If you claim a physician listing, we collect your full name, professional credentials, National Provider Identifier (NPI), practice address, contact information, and any documents you upload to support credentialing (stored in a private, access-controlled bucket).

    Billing information. Payments are processed by Stripe. We receive limited information from Stripe (such as the last four digits of your card, billing zip, subscription status, and transaction history). We do not store full card numbers, CVVs, or bank account numbers.

    Lead and contact submissions. When you submit a contact form, demo request, blog subscription, or city-notify form, we collect your name, email, and any message or context you choose to provide.

    Reference-tool queries. When you use the TruthSource AI reference tool, we log the text of your query, your selected role (physician or patient), the AI model used, response token counts, and a timestamp. Queries are used for service operation, abuse prevention, rate-limiting, and quality improvement. Do not include Protected Health Information in your queries — they are not designed to handle PHI.

    Automatically collected data. Like most websites, we automatically collect technical information such as your IP address, device and browser type, referring URL, pages viewed, and timestamps. This is used for security, performance, and analytics.

    Cookies and similar technologies. We use essential cookies required to operate the Services (for example, to keep you signed in) and limited analytics cookies. We do not use cross-site advertising cookies.

    2. Information We Do Not Collect

    • Protected Health Information (PHI) under HIPAA. TruthTides is not a Covered Entity or Business Associate and is not designed to receive PHI. Do not submit PHI to the Services.
    • Full payment card data. Stripe handles all card data; we never receive it.
    • Sensitive categories such as government IDs, biometric data, or precise geolocation, unless you voluntarily provide them in a credentialing context.

    3. How We Use Information

    • Operate, maintain, and improve the Services.
    • Authenticate users and secure accounts.
    • Process payments and manage subscriptions.
    • Verify physician credentials via the NPPES NPI registry.
    • Respond to inquiries and provide customer support.
    • Send transactional email (account, billing, credentialing, abandoned-checkout reminders).
    • Send marketing email only to addresses that have opted in; every marketing email contains a one-click unsubscribe link.
    • Monitor for abuse, fraud, and violations of the Terms of Service.
    • Comply with legal obligations and enforce our rights.

    4. Legal Bases (EU/UK Users)

    Where the GDPR or UK GDPR applies, we process personal data on the following bases: (a) performance of a contract (running your account, providing the Services); (b) legitimate interests (securing the Services, preventing abuse, improving features, limited analytics); (c) consent (marketing email, optional cookies); and (d) legal obligation (tax, accounting, responding to lawful requests).

    5. How We Share Information

    We share personal information only as described below. We do not sell personal information.

    • Service providers that process data on our behalf, under contract, including: Supabase (hosted database, authentication, storage, edge functions), Stripe (payments and subscription management), Resend (transactional and marketing email delivery), Lovable / AI gateway (AI model inference for the TruthSource tool), and our hosting and content-delivery providers.
    • Public NPI registry look-ups for physician credentialing (information you submit is checked against publicly available NPPES data).
    • Legal and safety disclosures when required by law, subpoena, or court order, or when necessary to protect rights, property, or safety.
    • Business transfers. If TruthTides is involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred subject to standard confidentiality protections.
    • With your consent for any other disclosure.

    6. Data Retention

    • Account data: retained while your account is active; deleted (or anonymized) within a reasonable period after account closure, subject to legal-hold and tax-record obligations.
    • Reference-tool query logs: retained for up to twelve (12) months for quality, security, and rate-limiting, then deleted or de-identified.
    • Email send / suppression logs: suppression entries are retained indefinitely so we can honor opt-outs; send logs are retained for ninety (90) days.
    • Billing records: retained per Stripe's policies and U.S. tax-record requirements (typically seven years).
    • Credentialing documents: retained while the listing is active and for a reasonable post-cancellation period for audit and dispute resolution.

    7. Security

    We use industry-standard administrative, technical, and physical safeguards designed to protect personal information, including: encryption in transit (TLS) and at rest at the database layer, Row Level Security on every user-data table, role-segregated access, secrets stored in managed key storage (never in source code), private storage buckets with signed-URL access for credentialing documents, JWT-verified access on every server function, and periodic security scanning. No system is perfectly secure, and we cannot guarantee absolute security of any data transmitted to or stored by the Services.

    If we become aware of a personal-data breach that materially affects you, we will notify you and applicable authorities as required by law.

    8. Your Choices and Rights

    • Access, correction, deletion, portability. You may request access to, correction of, or deletion of your personal information by emailing info@truth-tides.com. Account deletion cascades to the records linked to your user ID; certain residual data may be retained for legal compliance.
    • Marketing email. Every marketing email includes a one-click unsubscribe link. You may also email us. Suppression takes effect on processing and is permanent.
    • Cookies. You can configure your browser to block or delete cookies; some features may not work without essential cookies.
    • Do Not Track. We do not currently respond to Do Not Track signals.

    9. California Residents (CCPA / CPRA)

    California residents have the right to know what personal information we collect, to request deletion or correction, to opt out of "sales" or "sharing" of personal information (we do neither), and to non-discrimination for exercising these rights. You can exercise these rights by emailing info@truth-tides.com. We may verify your identity before fulfilling a request. You may also designate an authorized agent.

    Categories of personal information collected in the last 12 months: identifiers (name, email), commercial information (subscription history), internet/network activity (usage and log data), professional information (NPI, credentials, for physician users), and inferences drawn from the above (for analytics and abuse prevention).

    10. European Economic Area / UK Residents (GDPR)

    If you are in the EEA or UK, you have the right to access, rectify, erase, restrict, port, and object to processing of your personal data, and to withdraw consent at any time without affecting the lawfulness of prior processing. You also have the right to lodge a complaint with your local supervisory authority.

    Where we transfer personal data outside the EEA/UK, we rely on appropriate safeguards such as Standard Contractual Clauses with our service providers.

    11. Children

    The Services are not directed to children under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

    12. Changes to This Policy

    We may update this Privacy Policy from time to time. For material changes we will provide reasonable notice (for example, by email or an in-app notice). Continued use of the Services after an update constitutes acceptance.

    13. Contact

    Questions or requests regarding this Privacy Policy? Email info@truth-tides.com or use the contact page.