Privacy Policy
This Privacy Policy describes how Spot Now LLC, a Delaware limited liability company (“Spot Now,” “we,” “us”), handles personal information across the Spot Now platform — the patient site, the provider site, and related services.
1. Data we collect and its sources
Account and profile data you provide (name, date of birth, contact details, preferred language, communication preferences); dependent and representative information you add; insurance information you choose to store; booking details needed for a specific appointment (reason for visit, uploads such as orders or referrals where a provider requires them); technical data necessary to operate and secure the service (device, log, and session information); and location information you enter — precise device location is used only with your permission and is never required when a ZIP-code search is sufficient. Provider directory information comes from public, licensed, and provider-supplied sources with recorded provenance. We apply data minimization: clinical or sensitive information is collected only when a specific booking or workflow requires it.
2. How we use data
To operate search and booking; to communicate confirmations, reminders, and account alerts (transactional communications are separate from marketing, which requires distinct consent you can withdraw); to bill provider organizations for their listing subscriptions — patients are never charged by Spot Now, and we do not process patient payments; to maintain security, prevent fraud and abuse, and audit access; to meet legal obligations; and to improve the service using privacy-conscious, first-party measurement. We do not sell personal information, and we do not use advertising trackers on authenticated, search, booking, or payment pages.
3. Sharing
With providers you book with or send requests to (only what the provider requires); with service vendors under contracts that restrict use (hosting, communications delivery, payments) — vendors handling protected health information are engaged under Business Associate Agreements where required; with authorized representatives you designate; and where required by law. A current vendor register with PHI status, security review, and agreement status is maintained internally.
4. Cookies and analytics
Spot Now uses first-party, privacy-conscious analytics with consent management. No advertising pixels, session-replay tools, third-party marketing trackers, or unapproved chat widgets run on authenticated pages, symptom or provider searches, booking pages, payment pages, or patient dashboards. Personal health details never appear in URLs, referrers, analytics events, page titles, or error payloads. Essential cookies maintain sessions and security; you can manage optional cookies through the consent banner in production.
5. This Privacy Policy vs. the Notice of Privacy Practices
This Privacy Policy describes how the Platform handles data generally. Where Spot Now or a participating provider acts as a HIPAA covered entity or business associate, the applicable Notice of Privacy Practices describes HIPAA-specific uses, disclosures, and individual rights for protected health information. If the two documents differ for PHI, the Notice of Privacy Practices controls to the extent HIPAA applies.
6. Consumer health data notice
Some states — for example Washington under the My Health My Data Act, and Nevada and Connecticut under similar laws — grant specific rights over “consumer health data,” meaning personal information linked to you that identifies your past, present, or future physical or mental health. On Spot Now that can include the care categories you search, the providers you book, appointment reasons you choose to share, and insurance details you store.
We collect consumer health data only to operate search and booking as described in Sections 1 and 2. We do not sell consumer health data, do not share it for advertising, and do not use it to build advertising profiles. It is shared only as described in Section 3 — principally with the provider you book with, and with vendors under contracts restricting their use of it. You may ask us to confirm what consumer health data we hold about you, to access it, to have it deleted, and to withdraw any consent you previously gave, by writing to privacy@getmyspotnow.com; we verify and honor such requests within the time your state’s law requires, and you may appeal a refusal by replying to our decision. We do not discriminate against you for exercising these rights. [Counsel review: confirm the final state-by-state notice set before publication.]
7. Retention and deletion
Retention periods are configured by record type (profiles, appointments, payments, consents, communications, audit logs, uploaded documents, backups) and approved by legal and compliance personnel. You may request account deletion; some records must be retained after account closure — for example appointment, payment, consent, and audit records required by law — and we explain this at the time of your request.
8. Security
Encryption in transit and at rest, managed keys with rotation, role-based and attribute-based access controls, multifactor authentication for privileged access, audit logging of sensitive access, environment isolation, and an incident-response and breach-notification process. No system is perfectly secure; report concerns via Responsible Disclosure.
9. Children
Accounts are created by adults. Care for minors is managed through parent, guardian, or authorized-representative access with verification, and adolescent records receive additional protection where state law requires. The Platform is not directed at children and does not knowingly collect data directly from children.
10. Your state privacy rights
Depending on your state (including California, Colorado, Connecticut, Texas, Virginia, and others with comprehensive privacy laws), you may have the right to: know what personal information we hold about you and access a copy; correct inaccurate information; delete your information; obtain it in a portable format; opt out of the sale or sharing of personal information, of targeted advertising, and of profiling with significant effects; and limit the use of sensitive personal information.
Spot Now does not sell personal information, does not share it for cross-context behavioral advertising, and does not use sensitive personal information for purposes beyond operating the service — so there is nothing to opt out of today; the “Do Not Sell or Share My Personal Information” and “Limit Use of Sensitive Personal Information” links in the footer bring you to this section, which serves as the required method of submitting such a request should our practices ever change. To exercise any right, email privacy@getmyspotnow.com from the address on your account or describe your account so we can verify you; an authorized agent may submit a request with proof of authority. We respond within the period your state’s law requires, we do not discriminate against you for exercising rights, and if we refuse a request you may appeal by replying to our decision — we will explain the outcome of the appeal and how to contact your state attorney general.
11. International visitors
The Platform is operated from the United States for services delivered in the United States. If you access it from elsewhere, your information is processed in the United States. The Platform is not offered in the European Union or the United Kingdom. [Counsel review: add GDPR/UK sections only if the service is later offered in those markets.]
12. Changes and contact
Material changes are versioned, dated, and notified. Privacy office: privacy@getmyspotnow.com — also the channel for privacy complaints, which you may raise without retaliation.