Last updated: September 11, 2026
MyDocTalk is operated by Little Cloud Software LLC ("we", "us"). This policy explains what information the MyDocTalk website and mobile apps (together, the "Service") collect, how it is used, and the choices you have. The Service is built for medical and dental practices and their staff; it is not intended for patients or the general public.
Account information. Your name, email address, phone number, time zone, role, and the practice you belong to, entered when an account is created.
Practice information. Practice and office names, addresses, phone numbers, specialties, accepted insurance, logos, and referral questions your practice configures.
Referral and message content. Messages, referrals, patient details entered into a referral, clinical notes, and attached photos or documents. This content may include protected health information ("PHI") that your practice chooses to share with another practice.
Device and technical information. For the mobile apps: a device identifier, device name, platform, app version, and a push-notification token. For all use: IP address, browser or app type, pages or screens visited, and timestamps, kept in server logs.
Billing information. Plan selection and subscription status. Card details are entered directly with our payment processor, Stripe, and never stored by us.
To provide the Service: delivering messages and referrals between practices, showing referral status, sending notifications, and maintaining your account. To keep the Service secure: authenticating sign-ins, detecting misuse, and auditing access to referrals. To operate the business: billing, support, and service announcements. We do not sell personal information, and we do not use referral or message content for advertising or to train machine-learning models.
You can receive email and push notifications about new messages and referral activity. Push notifications are delivered through Apple Push Notification service and Firebase Cloud Messaging and contain only a short, non-clinical summary (for example, a sender name and a subject line); they never contain patient details. Each notification type can be turned off in Settings.
Camera and photos are used only when you choose to attach an image to a message or referral; the app does not scan your library. Face ID, Touch ID, or your device's biometric unlock is used only to lock the app on your device. Biometric data never leaves your device and is not sent to us. Notifications are optional and can be declined or revoked in your device settings.
Practices use the Service to exchange PHI as part of patient referrals. We act as a business associate to those practices and handle PHI only as needed to provide the Service and as permitted by the Business Associate Agreement with each practice and by HIPAA. Access to PHI inside the Service is limited to the members of the sending and receiving practices, and access is logged.
Information is shared with: the practice members and the receiving practice you send a message or referral to; service providers who process data on our behalf under contract, currently Amazon Web Services (hosting, storage, and email delivery), Stripe (payments), Google Firebase and Apple (push-notification delivery); and authorities when required by law or to protect the rights and safety of users. We do not share information with advertisers or data brokers.
Data is encrypted in transit using HTTPS and at rest on our storage systems. Sign-in supports two-factor authentication, and the mobile apps can be locked with your device's biometrics. Files are stored in private storage and served only through short-lived, signed links. No system is perfectly secure; if we learn of a breach affecting your information we will notify affected practices as required by law.
Account and practice information is kept for as long as the practice's account is active. Referral and message content is retained as part of the practice's records until the practice deletes it or closes its account, after which it is removed from active systems within 90 days and from backups on their normal rotation. Server logs are kept for a limited period for security and troubleshooting.
You can update your profile and notification preferences in Settings. Practice administrators can add and remove members and edit practice information. To request access to, correction of, or deletion of your personal information, or to close an account, contact us at the address below; requests involving PHI are routed to the practice that controls that record. Depending on where you live you may have additional rights under local law, which we will honor.
The Service is for healthcare professionals and is not directed to anyone under 18. Patient records entered by a practice may describe minors; those records are controlled by the practice under HIPAA.
We may update this policy from time to time. Material changes will be announced in the Service or by email before they take effect, and the date at the top will change.
Little Cloud Software LLC, Utah, USA. Questions or requests about privacy can be sent to support@mydoctalk.com.