Security and data handling

We collect as little as possible

Registry listings hold only public fields from the NPPES NPI Registry: name, credential, practice address, city, state, practice phone, NPI, and license number and state when present. We do not store mailing addresses from the registry, and we do not store photos of providers who have not claimed their profile.

Patient inquiries ask only for what a therapist needs to reply: first name, email, an optional phone number, preferred contact time, in person or online, and how the person plans to pay. A short message is optional.

• We do not store session notes, treatment records or clinical documentation.
• We do not ask patients for diagnoses, symptoms or health history.
• Patients search without an account.

Inquiry senders are asked to leave out medical details

The inquiry form tells every sender not to include medical details in the message. A first message only needs to say who you are and how to reach you. Clinical conversations belong between the patient and the therapist, after they connect.

Encryption in transit

Every page and every request to nearbytherapy.com is served over HTTPS, so data travelling between your browser and our servers is encrypted in transit. Passwords are stored as one way hashes, never as readable text.

Access controls and roles

Each inquiry is visible only to the clinician it was sent to and, on group accounts, to the people the practice owner has given access. Practice owners manage billing, routing and staff access. Staff roles can read and assign inquiries without access to billing. Clinicians edit only their own profiles. Inside our own team, access to production data is limited to the people who operate the service and is used only to run and support it.

Email confirmation before anything is delivered

Therapist accounts are confirmed with a six digit code sent to the account email. Patient inquiries are delivered only after the sender confirms their email with a code, which keeps automated messages and mistyped addresses away from your inbox.

How long we keep data

• Undelivered inquiries, where the sender never confirmed their email, are deleted after 90 days.
• Delivered inquiries stay available to the receiving clinician while the account is active.
• Registry listings follow the monthly NPPES refresh. Deactivated NPIs are hidden, and listings removed on request stay hidden on every refresh.
• Technical logs are kept for a limited period to keep the service secure and are then deleted.

Full details are in our privacy policy.

Service providers we rely on

We use a small number of service providers in categories that any web service needs: a hosting provider, an email delivery provider, a payment processor and cookieless analytics. Each receives only the data needed for its task. Card details are entered on the payment processor's page and never reach our servers.

Data processing addendum for clinics

Clinic plan accounts receive a data processing addendum that describes how we process inquiry data on behalf of the practice, plus single sign-on with the organization's identity provider and CSV export of inquiries. Read more on the group practice directory listing page.

Report a security issue

If you believe you have found a security vulnerability on nearbytherapy.com, write to [email protected] with a description and the steps to reproduce it. Please do not access data that is not yours and give us reasonable time to fix the issue before sharing it publicly. We reply to every security report.