Privacy Policy

1. Who We Are

Med Profit IQ ("Med Profit IQ," "we," "our," or "us") is a financial intelligence platform designed specifically for medical and healthcare practices. We are operated by Doherty & Associates. Our platform connects to your practice's accounting and financial data to surface real-time analytics, cash flow projections, insurance AR tracking, payroll benchmarks, and tax estimates.

If you have questions about this Privacy Policy, contact us at jim@dohertyandassociates.com.

2. Data We Collect

We collect only what is necessary to provide Med Profit IQ's services.

Account & Contact Data

• Email address (for account creation, early-access list, and service communications)
• Practice name and contact information
• Subscription and billing details (processed by our payment provider)

Financial & Practice Data

• Accounting records synced via QuickBooks Online (revenue, expenses, accounts receivable, payroll)
• AR aging buckets, practice summary metrics, and historical financial data you authorize
• QuickBooks Online OAuth tokens (used solely to read authorized data from your QBO account)

Usage & Analytics Data

• Page views, feature interactions, and session activity (via Meta Pixel and our internal analytics beacon)
• Browser type, IP address, and device identifiers (collected automatically)
• Audit log entries (actions performed within the platform, including timestamps and IP addresses)

3. How We Use Your Data

We use collected data to:

• Provide, operate, and improve the Med Profit IQ platform
• Generate financial intelligence dashboards, projections, and alerts
• Authenticate your sessions and maintain account security
• Send transactional emails (signup confirmation, alerts, billing)
• Comply with legal obligations and maintain immutable audit logs
• Analyze aggregate usage patterns to improve product features

We do not sell your data to third parties. We do not use your financial data for advertising or marketing targeting beyond aggregate, de-identified analytics.

4. Data Storage & Security

We take the security of your financial data seriously.

• Database: Stored on Neon PostgreSQL with SOC 2 compliance and encrypted connections
• Access control: Administrative access requires a bearer token; all admin actions are logged
• Audit logs: Immutable append-only records of all data access events, indexed for compliance review
• Infrastructure: Hosted on Render's managed cloud infrastructure with automatic security patching
• QuickBooks tokens: OAuth access tokens are stored encrypted and used only for authorized read operations

5. Third-Party Services

Med Profit IQ integrates with and relies on third-party services. Each operates under its own privacy policy.

QuickBooks Online (Intuit) — We use the QuickBooks Online API to read authorized accounting data. You control what data Med Profit IQ can access via the QBO OAuth authorization flow. Med Profit IQ only requests read-only scopes necessary to provide the service. Intuit's privacy policy governs their handling of data: intuit.com/privacy.

Meta Pixel — We use Meta's advertising pixel to measure the effectiveness of our marketing (page views, lead events). Meta may use this data for ad targeting on their platforms. You can opt out via Meta Privacy Settings.

Payment Processing — Billing and subscription payments are handled by Stripe. We do not store full credit card details. Stripe's privacy policy applies: stripe.com/privacy.

Email Delivery — Transactional emails (signup notifications, alerts) are delivered via Postmark. Recipient email addresses are transmitted to Postmark solely for delivery purposes.

6. HIPAA Business Associate Considerations

Med Profit IQ processes financial and billing data from medical practices, not Protected Health Information (PHI) as defined under HIPAA. Typical data includes revenue totals, expense categories, payroll figures, insurance AR bucket amounts, and anonymized encounter-level billing metrics.

If your use of Med Profit IQ involves the processing of PHI in connection with healthcare operations, you may be required to execute a Business Associate Agreement (BAA) with us before transmitting such data. Contact jim@dohertyandassociates.com to discuss BAA requirements.

7. Data Retention & Deletion

We retain your data for as long as your account is active or as needed to provide services. Specifically:

• Account data: Retained for the duration of your subscription plus 90 days after cancellation
• Financial sync data: Retained for the duration of your subscription; deleted within 30 days of account closure
• Audit logs: Retained for a minimum of 12 months for compliance purposes
• Email addresses (early-access list): Retained until you request removal

To request deletion of your data, email jim@dohertyandassociates.com with subject "Data Deletion Request." We will process your request within 30 days and confirm when deletion is complete.

8. Your Rights

Depending on your location, you may have rights regarding your personal data, including:

• Access: Request a copy of the data we hold about you
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your data (subject to legal retention requirements)
• Portability: Request your data in a machine-readable format
• Opt-out: Unsubscribe from marketing communications at any time

To exercise any of these rights, contact jim@dohertyandassociates.com.

9. Cookies & Tracking

Med Profit IQ uses browser local storage (not cookies) to maintain session state and visitor analytics identifiers. We do not use persistent tracking cookies for advertising.

The Meta Pixel uses cookies controlled by Meta. You can manage these through your browser settings or Meta's privacy controls.

10. Changes to This Policy

We may update this Privacy Policy to reflect changes to our practices or legal requirements. When we do, we will update the "Last updated" date at the top. For material changes, we will notify active subscribers via email at least 14 days before the change takes effect.

11. Contact Us

Questions, concerns, or requests related to this Privacy Policy:

Doherty & Associates / Med Profit IQ
Email: jim@dohertyandassociates.com

12. GDPR — Rights of EU/EEA Data Subjects

If you are located in the European Union or European Economic Area (EEA), the General Data Protection Regulation (GDPR) provides you with the following rights regarding your personal data:

• Right of Access (Art. 15): You may request a copy of all personal data we hold about you in a machine-readable format.
• Right to Rectification (Art. 16): You may request correction of inaccurate or incomplete personal data.
• Right to Erasure / "Right to Be Forgotten" (Art. 17): You may request deletion of your personal data. We will process erasure requests within 30 days. Certain data may be retained where required for legal compliance (e.g., HIPAA audit logs).
• Right to Data Portability (Art. 20): You may request your data in a structured, commonly used, machine-readable format (JSON).
• Right to Restriction of Processing (Art. 18): You may request that we restrict the processing of your data while a dispute is pending.
• Right to Object (Art. 21): You may object to processing based on legitimate interests, including direct marketing.

Legal Basis for Processing

• Performance of a contract (Art. 6(1)(b)): Processing your account data, financial sync data, and communications necessary to deliver the Med Profit IQ service you subscribed to.
• Legitimate interests (Art. 6(1)(f)): Analytics on marketing pages (Meta Pixel) to understand the effectiveness of our marketing. You may decline non-essential cookies via the cookie consent banner shown on first visit.
• Legal obligation (Art. 6(1)(c)): Retaining audit logs and billing records as required by applicable law.

Cookie Consent & Meta Pixel

The Meta Pixel is a non-essential tracking script used for advertising analytics. EU/EEA visitors are shown a cookie consent banner on their first visit. The Pixel will not load until you click Accept. If you click Decline, the Pixel is blocked for your session and all future sessions on this device. You can change your preference by clearing your browser's Local Storage for this site.

Data Transfers Outside the EEA

Med Profit IQ is hosted on infrastructure in the United States (Render / Neon). By using our service, your data may be transferred to and processed in the US. We rely on Standard Contractual Clauses or other legally recognised transfer mechanisms where applicable. Contact us at jim@dohertyandassociates.com for details on our transfer safeguards.

How to Exercise Your GDPR Rights

Email jim@dohertyandassociates.com with subject "GDPR Request" and specify the right you wish to exercise. We will respond within 30 days. You also have the right to lodge a complaint with your local supervisory authority (e.g., your country's Data Protection Authority).