Privacy Policy

If you create an account, we collect your email address and, if you set one, a password. We also store what you do in your workspace: panels and saved profiles, recent searches, profiles you reveal, enrichment requests and waitlist signups, and your email preferences.

Like most websites, our servers record basic technical information such as IP address, browser type, and pages requested. We use this to operate and secure the service.

We use your account information to sign you in, run your workspace, and send you transactional email such as confirmation and password-reset links. We do not send marketing email unless you opt in, and we do not use your account data to build advertising profiles.

We do not sell your personal data. We do not share your email address, your saved lists, or your search activity with third parties for their own use.

The directory publishes professional information about the public activity of physicians and researchers: identity and practice information from the federal NPPES registry, publications and citation metrics, registered clinical trial roles, industry payments reported to CMS Open Payments, NIH funding records, and, on enriched profiles, professional information gathered from cited public pages. Every fact links the source it came from, and our methodology describes how records are matched to the right person.

We process this information on the basis that it is professional, public-record information about professional activity, presented neutrally and without interpretation on the public layer. We do not publish home addresses, personal contact details beyond what the federal registry lists as practice contact information, or any information about health, family, or private life.

If a profile about you is inaccurate, use the “Suggest an update” control on the profile or email us. We review every report, correct what the evidence supports, and suppress records that do not meet our matching bar. If you are in a jurisdiction that grants you rights over published personal data (for example the EU or UK), you can exercise them through the same contact.

We use Supabase to provide authentication and to store account data, and standard hosting infrastructure to serve the site. These providers process data on our behalf under their own security and privacy commitments; they do not use it for their own purposes.

We use cookies to keep you signed in. We do not use advertising or cross-site tracking cookies.

We keep account data for as long as your account exists. You can delete your account yourself at any time from workspace settings, which removes your panels, activity and preferences immediately, or email us and we will remove it within 30 days, except where we must keep records to meet legal obligations.

You can ask us for a copy of the personal data we hold about you, ask us to correct it, or ask us to delete it, by emailing us from the address on your account. We will not discriminate against you for exercising any privacy right. California residents have these rights under the CCPA; residents of the EU and UK have equivalent rights under the GDPR. We do not sell personal data, so there is nothing to opt out of selling.

Passwords are hashed, connections are encrypted in transit, and access to account data is limited to what is needed to operate the service. No system is perfectly secure, but we design for the smallest possible data footprint.

findmyKOL is a professional tool and is not directed at children under 16. We do not knowingly collect information from them.

If we change this policy, we will update the date at the top of this page. Material changes will be flagged to signed-in users.

Questions, corrections, or deletion requests: hello@findmykol.com. This policy is governed by the laws of the United States.