Privacy Policy

PhyCentra is a product and service operated by Folay Healthcare Technologies LLC ("PhyCentra," "we," "us," or "our"). We are committed to protecting the privacy of our users. This Privacy Policy explains what information we collect, how we use it, how we store and protect it, and your rights with respect to your personal information when you use the PhyCentra mobile application (the "Application"). By creating an account and using the Application, you agree to the collection and use of your information as described in this Privacy Policy. If you do not agree, please do not use the Application. This Privacy Policy applies to the PhyCentra mobile application for iOS and Android and the PhyCentra web application (collectively, the "Application"). It does not apply to any third-party websites, services, or applications that may be linked from within the Application.

We use the information we collect solely to provide and improve the PhyCentra service. Specifically, we use your information to:

• Create and manage your account.
• Process and store uploaded documents securely.
• Extract credential-relevant data from your documents using OCR.
• Generate your Credential Readiness Dashboard, status indicators, and Credential Readiness Score.
• Send you reminders and alerts about license, DEA, board certification, and CME expirations and other renewal deadlines.
• Authenticate your identity using one-time passcodes (OTP) sent to your registered email address.
• Maintain session security and application performance.
• Generate credential readiness packets at your request, for your own use in employment, privileging, or licensure applications.

We do not use your information for advertising, third-party profiling, credit decisions, insurance underwriting, employment decisions, credentialing determinations, or automated decisions that produce legal or similarly significant effects, or for any purpose other than providing you with the PhyCentra service. We do not use your uploaded documents, OCR outputs, credential information, or personal data to train third-party artificial intelligence models. PhyCentra does not guarantee that reminders, alerts, or notifications will be delivered, timely, accurate, or sufficient to prevent expiration, lapse, missed deadlines, or noncompliance. PhyCentra is currently offered free of charge. We do not currently collect payment card information or billing information through the Application.

The Credential Readiness Score generated by the Application is an internal, informational indicator based solely on data you have uploaded. It reflects document completeness, expiration timelines, and renewal status as tracked within the Application. The Credential Readiness Score is:

• Not a credentialing determination, licensure status, or risk assessment of any kind.
• Not shared with any third party, including employers, hospitals, credentialing bodies, or licensing boards, unless you affirmatively choose to export and share a credential readiness packet.
• Not used or intended for any eligibility, privileging, underwriting, or employment determination by PhyCentra.
• Informational only and intended solely for your personal awareness and credential management.

PhyCentra does not operate as a credentials verification organization (CVO). The Application does not perform primary source verification and does not access official records from any state medical board, the DEA, ABMS or its member boards, or the NPDB.

PhyCentra does not sell your personal information. We do not share your personal information with advertisers or data brokers. We do not share your licensure, certification, or credential information with employers, hospitals, insurers, credentialing bodies, or government agencies, except where you affirmatively initiate an export or share action within the Application. We share limited information with the following service providers solely to operate the Application:

• Supabase: authentication, database (Postgres), file storage, and backend logic (Edge Functions). Supabase infrastructure is hosted on Amazon Web Services in the United States.
• Amazon Web Services (Amazon Textract): optical character recognition and document data extraction.
• Resend: delivery of one-time passcodes (OTP), verification emails, passwordless authentication emails, and other transactional communications.
• Apple Push Notification service (APNs) and Firebase Cloud Messaging (FCM): delivery of push notifications to iOS and Android devices, respectively.

Each of these providers processes data on our behalf to deliver the specific function described above, under contractual terms that restrict their use of your information, and none of them has independent rights to use your information for their own purposes. If you choose to export, download, or share a credential readiness packet, you are responsible for ensuring that the recipient is correct and authorized to receive the information. PhyCentra cannot control, retrieve, or delete copies of documents once they have been downloaded, saved, forwarded, or otherwise retained by a recipient. The web application allows you to share credential readiness packets through secure share links. Shared credential packets automatically expire 30 days after the share link is created unless revoked earlier by you, and you may revoke an active share link at any time through the Application. We log access to shared credential packets, including the date and time a shared link is opened, for security and audit purposes. Revoking or expiring a link prevents future access through that link but does not retrieve copies already viewed, downloaded, or retained by a recipient. Anyone with an active share link may be able to access the shared packet, so you are responsible for sharing links only with intended recipients and through secure channels. We may disclose your information if required to do so by law, court order, or valid legal process, or to protect the rights, safety, or property of PhyCentra or its users.

Your documents and account data are stored in the United States on infrastructure operated by the providers identified in Section 5, principally Supabase, whose platform is hosted on Amazon Web Services. The Application is intended for use in the United States. If you access the Application from outside the United States, you understand that your information will be processed and stored in the United States. We implement the following security controls:

• Encrypted storage for all documents and personal data.
• Secure API communications using industry-standard encryption protocols.
• Access controls limiting data access to authorized personnel.
• Passwordless authentication using one-time passcodes (OTP) delivered via email. We do not store passwords.
• Automatic session timeout or re-authentication controls designed to protect account access.
• Authentication tokens with automatic expiry; refresh tokens are revoked upon logout.

Because sign-in depends on one-time passcodes delivered to your registered email address, you are responsible for maintaining control of that email address. If you lose access to your registered email address, or if it is compromised, the security of your account and your ability to access it may be affected. Notify us promptly if you lose control of your registered contact methods. No security system is impenetrable. While we use commercially reasonable measures to protect your information, we cannot guarantee absolute security. In the event of a data breach that affects your personal information, we will notify you in accordance with applicable law.

We retain your account information and documents for as long as your account remains active. You may delete individual documents at any time through the Application. When you delete your account, we will delete or de-identify your account data and uploaded documents from active systems within 30 days after account deletion, subject to backup retention, legal obligations, security, fraud prevention, and audit requirements. Data covered by account deletion includes:

• Your account record and all profile information.
• All uploaded documents, including all stored copies.
• All licensure, certification, and professional credential records and notification history.
• All authentication tokens and push notification tokens.

Backup copies may remain in encrypted backups for a limited period after deletion and will be deleted or overwritten according to our normal backup cycle. Certain technical records, such as server logs and diagnostic records, may be retained for a limited period for operational and security purposes. These records do not contain your personal document data. We may retain information for a longer period where required by applicable law or to fulfill a legal obligation. Where required by applicable law, we will provide notice regarding retention practices or user rights.

You have the following rights with respect to your personal information:

• Access: you may access and review the information stored in your account at any time through the Application.
• Correction: you may update or correct inaccurate information in your account profile.
• Deletion: you may delete individual documents or delete your entire account at any time through the Application Settings. Upon account deletion, we will delete or de-identify your account data and uploaded documents from active systems within 30 days, subject to the retention exceptions described in Section 7.
• Deactivation: if you wish to temporarily suspend access to your account without deleting your data, please contact us at the address below.
• Portability: you may request a copy of your personal data by contacting us.

To exercise any of these rights or to make a privacy-related inquiry, please contact us at admin@folayhealth.com.

PhyCentra does not access, retrieve, or use information from any state medical board, the DEA's registration systems, ABMS or its member boards, the National Practitioner Data Bank (NPDB), or any other official licensing or credentialing database. All information processed by PhyCentra is provided directly by you, the user, through voluntary document upload. PhyCentra is not a credentials verification organization and does not operate as a source of primary source verification for any licensing board, hospital, or employer.

The Application is intended for physicians, physicians in training, and medical school graduates. It is not intended for children under 13 years of age. Account registration requires users to be at least 18 years of age. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13, we will delete that information promptly. If you believe a child under 13 has created an account or has otherwise provided us with personal information, please contact us at admin@folayhealth.com.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable law. When we make material changes, we will notify you through the Application or by email to your registered address at least 14 days before the changes take effect. Your continued use of the Application after the effective date of the updated Privacy Policy constitutes your acceptance of the changes.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at: Folay Healthcare Technologies LLC Attn: Privacy Officer admin@folayhealth.com https://www.folayhealth.com