What we keep, what we don't, and where the data comes from

The short version

DocBeat holds no patient records and asks for none. There are no accounts, no logins and no passwords. Using the site means typing a place, a specialty or a name into a search box and reading public information about physicians. That is the whole exchange.

What we keep is listed below. During the testing phase it is more than it was: we now record how each page is used and can watch recordings of visits, because that is how we learn what works and what does not. What we still do not keep is your identity.

What the site stores about a visit

A short list, and only when each thing happens:

Search text. The words typed into the search box, what they resolved to (a town, a specialty, a name), how many results came back, and whether a spelling correction was applied. This is how we find searches that return nothing and fix them. Since October 2026 we also keep text typed into the box and then paused on or abandoned without searching, because a search that never ran is often the one we most need to understand.

Suggestions while you type. As you type in the search box, the letters typed so far are sent to our server so it can suggest towns and names. They are used to answer and are not stored; only the search you actually run is recorded.

Results shown and opened. When a page of results appears, we record which physicians were on it (their public NPIs, in order) and which page it was. When a result is opened, we record the search text, the physician's public NPI and its position in the list. Together these tell us whether a search gave people what they were looking for.

Profile views and taps. When a profile is opened, when a phone number is tapped or copied, when Directions or Share is used, when a filter, a suggestion or the map is used, we record that it happened, with the physician's public NPI where one applies.

One question after a call. If you tap a phone number, the site may later ask whether you got an appointment. Answering is optional and takes one tap. We record the answer (for example "not taking new patients" or "within a month") with the physician's public NPI, because it is the most direct evidence there is of whether a listing is accurate. It is not linked to you.

Near me. If you press "Near me", your browser asks your permission. If you give it, your location is sent with that one search so we can find physicians nearby. We record that a location search happened; the coordinates themselves are not written to our database.

Your call list. If you add physicians to a call list, the list is kept in your own browser and nowhere else: we do not have it and could not show it to anyone. We record only that a physician was added to or removed from someone's list, and the outcome of a call if you choose to note one. A list you share travels as a link containing the physicians' public NPIs and nothing about you.

Errors. If a page fails to load, we record which kind of page it was and a reference for finding the fault in our logs. Nothing you typed is included.

How a visit began. Once per visit we record three categories: the kind of place you came from (a search engine, a social site, another website, or directly), the size class of your screen (phone, tablet or desktop), and the kind of page you arrived on, and whether this browser has been here before. Never the address of the page you came from, and never your browser's identifying string.

How each page was used. When you leave a page we record which kind of page it was, how far down it you scrolled, and how many seconds it was open and visible. Nothing you typed or clicked is in that record; those have their own entries above.

Recordings of visits. During the testing phase, the site loads Microsoft Clarity, which records mouse movement, scrolling, taps and the pages visited and plays them back to us as a recording, with heatmaps of where people click. It is tagged with the visitor cookie below so a recording can be matched to our own records of the same visit. The two founders watch them to find where the site confuses people. Clarity holds the recordings under its own policy, currently for 30 days.

Reports. If you use "Report inaccurate information" on a profile, we store the NPI, the reasons you chose, any note you write, and an email address only if you choose to give one so we can reply.

Email sign-ups. If you ask to be told when we cover your state, or when a physician near your search is accepting new patients, we store the address you typed, which of those you asked for, and the search it was about. It is used for that one message and nothing else, and it is deleted once the message has gone or the moment you ask (write to hello@docbeat.ai).

A visit id. To count whether a search led to a profile and then to a call, each browser tab gets a random id that lasts only as long as the tab is open; the browser discards it when the tab closes. Each record also carries the country and state the request came from, at that level only.

A visitor cookie. Since October 2026 the site sets one cookie of its own, a random id that lets us tell a returning browser from a new one and follow a search on one day to a call on another. It names a browser, not a person: there is no account, name or email to attach it to, it is never sold or shared, and it expires after 400 days or whenever you clear your cookies.

None of these records carries an IP address, a device identifier, a name or an account. We do not sell or share visit-level data with anyone.

What the site does not do

No advertising cookies. The one cookie the site sets is its own visitor id, described above, and Microsoft Clarity sets a few of its own to recognise a session for its recordings; nothing is set by an advertiser or shared with one. Traffic counts come from a privacy-preserving analytics service that does not use cookies.

No third-party advertising scripts. Nothing on any page loads from an ad network.

No sale of visitor data. A record of an individual visit is never sold or shared. What we may license is the aggregate: statistics built from many visits, such as demand for a kind of physician by town, from which no visit or person can be recovered.

No health information. We never ask why you are looking for a physician, and the search box is not a place to put medical details. If you type them anyway, they land in the search log described above; we do not read individual searches, and the log exists to improve results, not to study people.

Where the physician information comes from

Every physician listed is drawn from public records: the federal National Provider Identifier registry, state medical licensing boards, Medicare enrollment and opt-out files, and the practices' or their networks' own published pages for facts such as a membership care model. Each fact on a profile traces to one of these sources. Where we are not sure, we leave the physician out rather than publish with a caveat.

Street addresses are shown only where the record indicates a clinical location. Where an address may be a residence, the profile shows the town only, and the map shows an approximate position rather than a point.

Physicians who believe their listing is wrong can use the report button on their profile or write to us; corrections are checked against the primary source and applied.

How the site is built and hosted

The site runs on Vercel and reads physician data from a database hosted on Supabase. All traffic between your browser and the site, and between the site and its database, is encrypted in transit. The browser is served read-only views of the data; the credentials that can write to the database never reach the browser and are held as server-side secrets.

The hosting provider keeps standard, short-lived request logs for operating the service, as any host does. Those logs are the provider's, are not exported into our database, and are not used to identify visitors.

Search endpoints are rate-limited, so the directory cannot be copied wholesale by an automated client. The limiter counts requests against a one-way, daily-changing fingerprint of the requesting address; the address itself is not stored.

Physicians can confirm their own availability through a signed, expiring link that we send only to a contact tied to their practice. We record the answer, its date and how the link was delivered.

Reporting a security concern

If you find a vulnerability or something that looks wrong, write to hello@docbeat.ai with what you saw and how to reproduce it. We read every message, we will not take action against good-faith research, and we will tell you what we did about it.