Privacy Policy
Last updated: May 2026
Plain English. No legalese, no tricks. If something is not clear, email us and we will explain it.
Who we are
okDoktor is a free directory of US healthcare providers built on top of the publicly available CMS NPI Registry . We have no investors, no advertisers, and no interest in monetising your personal data.
Provider data
All base provider information — names, addresses, specialties, NPI numbers — is sourced from the CMS National Provider Identifier Registry, a public federal database. This data is public record. We do not claim ownership of it. You can access the original data directly at npiregistry.cms.hhs.gov .
Phone numbers are only shown to signed-in users and are never exposed in page source, search results, or API responses to unauthenticated requests. This is to reduce scraping and spam to providers.
What we collect about you
When you sign in with Google or GitHub we receive:
- Your name — displayed on your account page
- Your email address — stored as a one-way hash. We cannot read your email, only verify it matches.
- Your OAuth provider user ID (e.g. your Google or GitHub user ID)
We do not store your email in plain text. We do not store your OAuth access token after the login flow completes.
When you use the site we log:
- Which provider contact details you viewed — stored as user ID + provider NPI, for abuse prevention only
- Bookmarks you save
- Corrections or suggestions you submit
We use a single session cookie to keep you logged in. No other cookies.
What we do not collect
- No medical history, symptoms, or health information — ever
- No payment details
- No precise location data
- No tracking pixels, analytics scripts, or third-party trackers
- No advertising identifiers
okDoktor products are ad-free. We do not allow advertisers to target you or influence what you see.
Data sharing
We do not sell your data. We do not share your data with advertisers or data brokers. We share data only with:
- Google / GitHub — only during the OAuth login flow, as required
- Our hosting provider — data is stored on our server
- Law enforcement — only if legally required under US law
Data retention
- Sessions expire after 30 days of inactivity
- To delete your account, email [email protected] — we will remove it within 7 days
- Corrections you submitted may remain in the directory after account deletion as part of the community record
Your rights
You can request access to, correction of, or deletion of your personal data at any time by emailing us. We will respond within 7 days.
Contact
Questions, removal requests, or concerns: [email protected]
This policy may be updated occasionally. The date at the top will always reflect the last change.