Privacy Policy

CashDocs is a cash-pay healthcare marketplace: you see a doctor's real price, book a visit, and pay directly — no insurance. This policy explains what we collect, why, and who touches it. It applies to the CashDocs website, the patient and doctor apps, and the CashDocs Pro portal.

What we collect

• Account details — name, email, phone, city, and a password we store only as a salted hash.
• Booking details — the doctor, service, appointment time, price, and payment status of visits you book, and the short visit note your doctor may add when the visit ends.
• Payment details — handled by Stripe, our payment processor. Card numbers never touch CashDocs servers; we keep only Stripe's reference tokens and the amounts charged or refunded.
• Reviews and support messages — what you write when you review a doctor or contact support.
• For doctors — practice details, license and credentialing information you submit for verification, and payout account status (bank details live with Stripe, never with us).

Health information

CashDocs is a booking and payment layer, not a medical record, and we keep health information to a minimum. It can appear in three places:

• The service you book — so the practice knows what the visit is for.
• Casey, the care guide — what you type or say to Casey, and any photo you send when photo sharing is turned on, is sent to OpenAI to generate a reply. Voice clips are turned into text and not kept. Conversations, and any photos (stored privately, never at a public link), are deleted after 7 days.
• Visit notes — when your doctor wraps up a visit they can add a short note, which you can see in your account next to that visit.

Our text messages, app notifications and email subject lines say when and with whom — never what the visit is for.

Location

If you let your browser or phone share its location, we use it only to show your city so we can list practices near you. On the website, your coordinates — rounded to about a kilometre — are sent to OpenStreetMap's Nominatim service to look up the city name; in the iPhone app, Apple's own geocoder does that. When you type a ZIP code in the apps, it is looked up with Zippopotam.us to fill in your town. We don't store your coordinates; only the city you choose to save in your profile.

How we use it

• To run the service: showing you doctors, holding and charging payments when a doctor confirms, and telling you by email, text and app notification when a visit is confirmed, declined, moved or cancelled, and when money is refunded.
• To verify doctors before they can accept patients.
• To answer support requests and resolve billing disputes.
• To keep the marketplace honest — reviews are tied to real visits.

We do not sell your personal information, and we do not use it for third-party advertising.

Who we share it with

• Your doctor — the details they need to run your visit: your name, contact information, and the booking itself.
• Stripe — to process payments and doctor payouts. Stripe and the Apple Pay and Google Pay wallets may collect device and network information (such as device identifiers and IP address) to prevent fraud.
• Supabase — our database and file-storage provider, where account and booking data is hosted.
• Email and SMS providers (Resend, Twilio) — to deliver sign-in codes and the booking updates described above. When you call a practice through its CashDocs number, Twilio connects the call and we keep the time, length and calling number so the practice can see it came through CashDocs; we don't record calls.
• Daily — runs video visits. The call streams between you and your doctor; we don't record it.
• OpenAI — powers Casey, the care guide, as described under Health information above. Don't share anything with Casey you wouldn't want written down — Casey is not a doctor.
• Google and Apple — if you choose to sign in with them, and Google Maps to find addresses and practices near you.
• OpenStreetMap (Nominatim) and Zippopotam.us — to turn a rounded location or a ZIP code into a city name, as described under Location above.
• Firebase and Apple Push — to deliver app notifications to your phone.
• Vercel — hosts the website and the service behind the apps.
• Law — if we're legally required to, we comply, and no more than that.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent are never shared with any third party. Phone numbers are given to our SMS provider for the sole purpose of delivering the messages you asked for, and to no one else.

Text messages (SMS)

CashDocs sends transactional text messages about visits you book. You opt in by entering your mobile number in your CashDocs account or during booking on cashdocs.com, and by checking the consent box shown next to that field. Consent is not a condition of purchase — you can use CashDocs without it, and email carries the same information.

• What we send — a verification code when you sign in by phone, and updates about your own appointments: confirmation when a doctor accepts, notice if a doctor can't take the visit, a note when a new time you picked has been sent to the practice, and cancellation or refund notices. We don't send appointment reminders.
• How often — only in response to something you did. A typical patient receives a few messages per booking; we send no recurring or marketing texts.
• Opting out — reply STOP to any message to stop them immediately; reply HELP for help, or email support@cashdocs.com.
• Cost — message and data rates may apply. Carriers are not liable for delayed or undelivered messages.

Your choices

• You can view and edit your profile details in your account at any time.
• Delete your account yourself — in the app (Profile → Delete account) or on the website (Account → Profile). Your sign-in, phone number, saved cards and Casey conversations are erased right away. Records of past visits and payments are kept for 7 years, as medical and tax record rules require, then removed. See cashdocs.com/delete-account.
• You can request a copy of your data, or ask us to delete your account for you, at support@cashdocs.com.
• Receipts for HSA/FSA reimbursement are yours — print them from Billing whenever you need.

Security

Traffic is encrypted in transit. Passwords are hashed, payment credentials live with Stripe, and administrative actions inside CashDocs are permission- gated and written to an audit log.

Children

CashDocs is for adults 18 and over. We don't knowingly collect data from children.

Changes

If this policy changes in a way that matters, we'll say so in the product — not bury it. The date at the top always tells you the current version.

Contact

Questions, requests, or complaints: support@cashdocs.com. CashDocs serves Bergen County, New Jersey and nearby.