Privacy Policy

What we collect, and when

Nothing is collected until you do one of these things:

• Create a patient account: your name, a username, your email address and a password (we store only a one-way hash of the password, never the password itself). We send a confirmation link to the address you give; the account can see provider contact details only once the address is confirmed.
• Request a consultation with a provider: your name, email address, phone number if you give one, the treatment you are interested in and the message you write.
• Leave a review: your rating, the text you write, and the first name and last initial shown next to it. Reviews are invited through a single-use link we email to people who requested a consultation.
• Ask a question: the question, any detail you add, and the display name you choose (for example “Ana, 34”).
• Save a provider as a favourite: the link between your account and that provider.
• Ask for a provider profile (providers only): your name, credential, email address, phone number, practice name, city, state, the Empire courses you have taken and anything you add.
• Keep a provider profile (providers only): everything you publish, plus your license number and NPI, which we keep private and never show on the site.
• Use the chat bubble: what you type goes to our chat provider (see “Companies that help us run the site”).
• Automatically, on every visit: your IP address, browser type, the pages you open and when, and the approximate city derived from your IP address. This is standard web traffic data.

Why we use it

We use this information only to:

• Pass a consultation request to the provider you chose, so they can contact you. That is the whole purpose of the request.
• Confirm your email address, sign you in, and warn you if someone repeatedly tries to sign in to your account with the wrong password.
• Send the review invitation you agreed to when you requested a consultation, and publish the review you write.
• Set up and verify provider profiles: we check a provider’s request against Empire Medical Training’s training records before creating a profile.
• Moderate what is published, answer your messages and keep the site secure — including detecting bots and abuse.
• Understand how the site is used, in aggregate, through analytics.

Health-related information

A consultation request, a question or a review may say something about your body or your health — “I am interested in treatment for melasma”, for example — because you chose to write it. Under some state laws (including Washington’s My Health My Data Act, and similar laws in Nevada and Connecticut) that counts as consumer health data. Here is how we handle it:

• We collect it only because you typed it into a form, and only for the purpose that form states (usually: so the provider you chose can contact you).
• We do not sell it. We do not use it for advertising, we do not send it to advertising networks, and we do not build advertising profiles from it.
• We never send the contents of a form to our analytics or chat providers.
• We do not use location tracking or geofencing of any kind.
• You can withdraw your consent and have it deleted at any time (see “Your rights”). If you delete it, we also tell the provider it was sent to, but we cannot delete what they have already recorded in their own systems.
• Empire Verified is not a HIPAA covered entity. The provider you contact usually is, for the records they keep about you as a patient.

Who sees your information

The provider you contact receives your consultation request: name, email, phone, treatment and message. Nobody else receives it, and the provider agrees under our terms not to use it for anything but that request and your care.

Reviews, questions and answers are public by design and appear on the site and in search engines. Your email address is never published.

Provider contact details (phone and email) are shown only to signed-in patients who have confirmed their email address, and to the provider and our staff.

Our staff at Empire Medical Training see what is needed to run the site: moderation queues, profile requests, and consultation requests when a provider asks for help.

We do not sell personal information, and we do not share it with data brokers or advertisers.

We disclose information when the law requires it, to protect someone’s safety, or to enforce our terms — and we will tell you when we are allowed to.

Companies that help us run the site

These companies process data on our behalf, under contracts that limit what they may do with it:

• DigitalOcean (New York) — the servers and database where the site and its data live.
• Cloudflare — network security in front of the site, the Turnstile bot check on our forms (which looks at your browser and IP address to tell people from scripts), and storage of provider photos.
• Mailgun — sends our emails (confirmations, review invitations, security notices, provider notifications).
• Google — Google Analytics 4 for aggregate usage statistics, and Google Maps for the provider map. Google Analytics receives page views and standard device data; it does not receive anything you type into a form.
• LiveChat (Text, Inc.) — the chat bubble. Anything you type in the chat, and the pages you visit while chatting, are processed by LiveChat.

Cookies and browser storage

We keep this to the minimum the site needs:

• Sign-in cookies (two, unreadable by scripts): one keeps you signed in for 15 minutes at a time, the other renews it for up to four days. Signing out deletes both.
• Security cookies set by Cloudflare to run the bot check and protect the site from attacks.
• Analytics cookies set by Google Analytics (for example “_ga”) to tell returning visits from new ones in aggregate statistics.
• Chat cookies set by LiveChat to keep your conversation open between pages.
• Browser storage for small conveniences, such as remembering which panel you collapsed. It stays in your browser and is never sent to us.
• We do not use advertising cookies. Most browsers let you block or delete cookies; the site keeps working without the analytics and chat ones.

Reviews and how verification works

A review is marked “verified patient” only when it comes from the single-use link we emailed to someone who requested a consultation through this site. Providers cannot write, buy or remove reviews, and they cannot see your email address in the published review.

Providers may reply publicly to a review. If a reply reveals private information about you, tell us and we will remove it.

The site is new. While providers are still claiming their profiles, some listings are illustrative examples prepared by Empire Medical Training; they are excluded from search engines and are being replaced as real providers join.

Before and after photos

Photos are published by providers, who confirm they hold a signed photo-release form from the patient, and our team reviews each case before it appears. If a photo of you was published without your consent, write to us and we will take it down while we look into it.

How long we keep it

We keep information only as long as it is useful for the purpose it was collected:

• Consultation requests: 12 months after the last activity on the request, then deleted. The provider keeps their own record under their own rules.
• Patient accounts: until you delete them, or after 24 months without a sign-in, when we delete inactive accounts.
• Reviews, questions and answers: published until you ask us to remove them.
• Provider profile requests: 24 months, so we can recognise a repeat request.
• Provider profiles: while the profile is active, plus 12 months in case of a dispute.
• Web traffic records: up to 12 months.

How we protect it

The site is served only over HTTPS. Passwords are stored as one-way hashes. Sign-in cookies cannot be read by scripts on the page. Provider license and NPI numbers are never shown publicly. Forms are protected against bots, and sign-in attempts are limited. Access to the data is limited to the Empire Medical Training staff who run the site.

No system is perfectly secure. If a breach affects your information, we will tell you and any regulator the law requires, without unreasonable delay.

Your rights

Whoever you are and wherever you live, you can email [email protected] to: see what we hold about you; correct it; remove a review or question you wrote; withdraw consent for consumer health data; or delete your account and everything linked to it. We answer within 30 days and we do not treat you differently for asking.

If you live in a US state with a privacy law (California, Washington, Colorado, Connecticut, Virginia and others) you may have additional rights, including the right to appeal a decision we make about your request. Tell us in your email and we will explain how.

We do not sell personal information or share it for targeted advertising, so there is nothing to opt out of on that front.

Children

The site is for adults. We do not knowingly collect information from anyone under 18; if you believe we have, tell us and we will delete it.

Changes and contact

If we change this policy we will update the date above and, for changes that matter, say so on the site before they take effect.

Questions and requests: [email protected], or by post to Empire Verified, c/o Empire Medical Training, 2601 E. Oakland Park Blvd, Suite 600, Fort Lauderdale, FL 33306.