Terms of Use and Privacy Policy

1. Agreement and eligibility

These Terms of Use govern your access to WhiteCoat Wallet and its related services, operated by DarkNight Racing LLC ("we," "us," or "our"). By selecting an acceptance control that links to these Terms, you agree to them. If you do not agree, do not create an account or use the service. You must be at least 18 and legally able to enter this agreement. If you act for an organization or another professional, you must have authority to do so.

2. What the service does

WhiteCoat Wallet helps organize professional license numbers, National Provider Identifiers (NPIs), DEA registration information, certifications, continuing education records, uploaded documents, and applicable renewal dates. Features may include scanning, expiration reminders, and summaries of renewal requirements. Available features and supported professions or jurisdictions may vary.

3. Your account and authority

Provide accurate account information, keep your contact details current, and protect your login credentials. Notify us promptly at [SUPPORT EMAIL] if you suspect unauthorized access. Only submit documents and information you own or are authorized to manage. Do not impersonate another professional or falsely represent a credential. You are responsible for activity you authorize and for your failure to take reasonable steps to secure your account; this does not excuse our own legal obligations.

4. Reviewing entered and scanned information

You are responsible for reviewing information you enter and any information extracted from scans or uploaded documents. Automated extraction may misread names, credential numbers, dates, course hours, or other fields. Correct errors before relying on displayed information, calculations, or reminders. An uploaded document or displayed credential is not proof that we have verified its authenticity or current status. Retain original documents and an independent copy of important records.

5. Permitted information and prohibited uploads

Use the service for professional credential management. Do not submit patient information, medical records, protected health information (PHI), Social Security numbers, government identity documents unrelated to the service, payment card numbers in document uploads, or passwords for external accounts. Review documents and remove prohibited information before uploading. If you discover an accidental upload, contact [PRIVACY EMAIL] promptly without repeating the sensitive information in an ordinary email.

6. Reminders and renewal responsibility

Reminders are a convenience and do not replace your own calendar or official notices. Delivery depends on accurate dates and contact details, your notification settings, network availability, and third-party delivery systems. Reminders may be delayed, filtered, disabled, or not delivered. You remain responsible for determining and meeting deadlines, completing applications and education, paying fees, and maintaining authority to practice, whether or not a reminder arrives.

7. Licensing guidance and continuing education

Renewal summaries, fees, education calculations, and rule updates are informational and are not legal or professional compliance advice. Rules can change and can differ by profession, state, credential, renewal cycle, and individual circumstances. Guidance may be incomplete or outdated and is not a promise of continuous monitoring. Verify current requirements directly with the issuing board, certifying body, or agency. The issuing authority determines whether a course, topic, credit, or completion date qualifies. Unless expressly stated in a separate written agreement, we do not submit renewals or guarantee approval or compliance.

8. No official affiliation or patient care function

WhiteCoat Wallet is an independent organizational service. Unless expressly identified, it is not affiliated with or endorsed by a licensing board, CMS, DEA, or a certifying organization. It does not issue licenses, confer prescribing authority, provide clinical services, or serve as a patient record system. The service is not offered for storing or processing PHI. These Terms do not determine whether HIPAA applies to a particular activity or waive any legal duty.

9. Your documents and our processing permission

You retain your rights in information and documents you submit. You grant us a nonexclusive permission to host, store, back up, reproduce, process, extract and display information, and transmit it to service providers as needed to provide and secure the service and carry out your instructions, consistent with the Privacy Policy. This permission does not transfer ownership or independently authorize advertising uses, sale of your documents, or general-purpose AI model training. Retention after deletion or account closure is limited as described in the Privacy Policy and required by law.

10. Acceptable use and app ownership

Do not upload malicious software, bypass access controls, access another user’s records without authority, disrupt the service, or use credentials to facilitate fraud or unlawful prescribing. You may use the app for its intended purpose while you comply with these Terms. We and our licensors retain rights in the software, design, and original content. These Terms do not restrict rights that applicable law requires us to preserve.

11. Fees and subscriptions

WhiteCoat Wallet is currently free to use. If we introduce paid plans, we will update these Terms and show prices, billing frequency, automatic renewal, cancellation, and refund terms before you are asked to pay. Any purchase must display the applicable charges and renewal terms before you agree to pay. Nothing in these Terms limits mandatory cancellation or refund rights.

12. Availability and account closure

We may change features or suspend access for security, suspected unlawful activity, or a material violation of these Terms. We will give reasonable notice of material service discontinuation or account termination when practicable and lawful, including information about available record retrieval. Urgent security or legal circumstances may require immediate action. You may close your account through Settings > Delete my account in the app, or by contacting [SUPPORT EMAIL]. Record export and deletion are handled as described in the Privacy Policy. Ending access does not erase accrued payment obligations or legally required rights.

13. Warranties

To the extent permitted by law, the service is provided “as is” and “as available.” We disclaim implied warranties of merchantability, fitness for a particular purpose, and noninfringement, and do not guarantee uninterrupted availability, error-free extraction, reminder delivery, or complete and current regulatory information. These limits do not remove any warranty or remedy that cannot legally be excluded.

14. Limits on liability

To the extent permitted by law, DarkNight Racing LLC is not liable for indirect, incidental, special, consequential, or punitive damages arising from the service, including lost profits or business interruption related to missed reminders, incorrect information, or missed renewal deadlines. To the extent permitted by law, our total liability arising from the service is limited to the greater of $100 or the amount you paid us for the service during the 12 months before the event giving rise to the claim. These limits do not apply to fraud, willful misconduct, gross negligence, or liability that applicable law does not allow us to limit. They do not waive legally required privacy, security, or consumer protection duties.

15. Changes disputes and contact

We will post revised Terms with an updated effective date and provide notice of material changes through an email to the address on your account and a notice in the app that asks you to review and accept the updated version before you continue. Where law requires renewed agreement, we will obtain it before applying the change. Changes will not retroactively remove accrued rights. These Terms are governed by the laws of [STATE], excluding conflict-of-law rules, subject to mandatory protections available to you. Disputes may be brought in [COURTS AND LOCATION], except where law requires otherwise. If a provision is unenforceable, the remaining provisions continue to apply. Contact DarkNight Racing LLC at [SUPPORT EMAIL] or [BUSINESS MAILING ADDRESS].

1. Information you provide

We collect information you manually enter, scan, upload, or send to us. This includes professional identifiers such as license numbers, NPIs, and DEA registration numbers; license types and jurisdictions; issuing organizations; issue and expiration dates; certifications; and continuing education details such as course names, providers, completion dates, credit amounts, and certificates. Uploaded files may contain names, addresses, signatures, photographs, and other details appearing on the original document. We store the documents you upload and the credential information associated with your account.

We also collect your name, email address, password (stored only as a one-way hash, never in readable form), sign-in session records, your NPI if you add it, your reminder and email preferences, and, if you turn it on, a private calendar feed link. If you contact support, we collect your message and the information you choose to provide. Do not include patient information or other prohibited information in uploads or support messages.

2. Scanning and automatic collection

When you scan or upload a document, your device may first reduce the size of a photo, and the file is then sent to our server, which sends it to our AI provider, Anthropic, PBC, to read the document. If text extraction is used, it converts document content into fields the app can display and use for tracking. Anthropic receives the scanned file and returns the fields it reads, such as the credential type, number, holder name, NPI, dates, and course hours. We do not review scans before the results are shown to you; you review and correct them before saving. Anthropic's commercial terms state that data sent through its API is not used to train its models. [VERIFY: Anthropic's current API data retention period and processing locations.]

We use one essential cookie to keep you signed in; it expires after 30 days or when you sign out. Our hosting provider records standard server logs, such as IP address, browser type, pages requested, times, and errors, which we use to operate and secure the service. The app keeps a short activity log (up to 60 recent pages opened and errors) in your browser's local storage; it stays on your device unless you choose to attach it to a support request. We record which reminder emails were sent and when, so a reminder is not sent twice. If you install the app, it stores an offline page and icon on your device. We do not use analytics, advertising, or tracking tools.

3. Public sources and payment information

The app does not look you up in public registries. It links to the NPPES NPI Registry so you can find your own NPI, but we do not retrieve information about you from it. General rule summaries may be obtained from licensing authorities and other published sources. Renewal rule research uses Anthropic's AI with public web sources and is reviewed by us before it is shown; it uses the credential type and jurisdiction only, not your personal information. The service is currently free, and we do not collect payment information.

4. How we use information

We use credential information and uploaded documents to display your records, track applicable expiration dates and continuing education progress, and provide reminders. We use profession, jurisdiction, and credential details to provide relevant renewal guidance. We use account and contact information to provide access, communicate about your account, and respond to support requests. We use server logs, sign-in session records, and any activity log you choose to attach to a support request to troubleshoot problems, protect accounts, and prevent misuse. We also use information to comply with applicable law and maintain necessary business records. We do not use your information for analytics, advertising, or marketing.

5. Service providers and authorized access

We disclose information to providers that perform functions for the service, as applicable: hosting and storage, authentication, document processing, reminder delivery, customer support, security, and payment processing. Our providers are Vercel Inc. (hosting, server logs, and storage of uploaded files), Neon (the database that stores your account and credential records), Anthropic, PBC (reading documents you scan, and researching renewal rules), and Resend (delivering reminder, password reset, rule change, and support emails, which include your name, email address, credential name, credential number, and expiration date). These providers should receive only the information needed for their role. [VERIFY: accept each provider's data processing agreement and confirm it limits their use of your information to providing services to us.]

The app gives no one, including our administrators, a way to view another user's documents or credential records. Administrators can see support requests (with any activity log a user chooses to attach) and the shared renewal rules. The company's owners, who manage our hosting and database accounts, could technically reach stored data; they use that access only to operate, secure, and troubleshoot the service or when required by law. Accounts are individual: each account belongs to one professional, and no employer or organization can see or manage another person's records. The only sharing feature is the optional calendar feed, a private link that shows your credential names and expiration dates in a calendar app. Anyone who has the link can see those dates, and you can replace or turn off the link at any time in Settings.

6. Other disclosures

We may disclose information when reasonably necessary to comply with applicable law or valid legal process, protect legal rights, investigate fraud, or respond to a security threat. Information may be transferred in a merger, acquisition, financing, or sale of business assets, subject to applicable law and appropriate confidentiality protections. We may also disclose information at your direction or with valid consent when required.

7. Data sales advertising and AI training

We do not sell your personal information, share it for cross-context behavioral advertising, or use it for targeted advertising. The service contains no advertising or tracking software. We do not use your documents or extracted content to train AI models or for any purpose other than providing the service. Our AI provider, Anthropic, states in its commercial terms that it does not train models on data sent through its API. [VERIFY: confirm no training opt-in is enabled on our Anthropic account.]

8. Server storage and security

Uploaded documents and credential records are stored on servers operated by Vercel Inc. and Neon in the United States [VERIFY: region shown for the database and file store in Vercel]. The service is intended for users in the United States. We use encryption in transit (HTTPS) and encryption at rest by our providers, passwords stored only as salted one-way hashes, random session keys in secure cookies that page scripts cannot read, access checks that limit every record and file to its owner, private file storage with no public links, and limited administrator access to protect information. No internet transmission or storage system can be guaranteed completely secure. We will respond to security incidents and provide notifications as required by applicable law. This statement does not limit our legal obligations.

9. Retention deletion and backups

We retain account records, documents, extracted credential information, support communications, and logs for as follows: account records, documents, and credential information until you delete them or close your account; sign-in sessions for up to 30 days; password reset links for 60 minutes; support messages for [VERIFY: choose a period, such as 2 years]; and server logs for the limited period our hosting provider keeps them. You can request deletion or account closure through Settings > Delete my account, or by emailing [PRIVACY EMAIL]. Following a verified request, we delete or deidentify eligible information from active systems within 30 days (account deletion in the app takes effect immediately), subject to applicable legal requirements. Backup copies expire or are removed within the database provider's rolling recovery window of [VERIFY: restore window set in Neon, such as 7 days]; we keep no other backups. We retain only information needed for a valid legal obligation, dispute, fraud prevention purpose, or other applicable exception, for only as long as that obligation or exception requires. Information read from a scan is kept only as the fields saved in your records, so it is deleted with them. Deleting a license, course, or account also removes its stored documents and files. Emails already delivered to your inbox are not affected, and providers delete what they hold under their own retention terms.

10. Your choices and privacy requests

You may request access, correction, a copy of your information, or deletion by contacting [PRIVACY EMAIL] or using the edit and delete options on each record, or Download my data and Delete my account in Settings. Additional rights may apply based on your location and applicable law, including portability, withdrawal of consent, and opt-outs from specified processing. We may verify your identity or an authorized agent’s authority before acting. We respond within legally required timeframes and explain any lawful denial. Where an appeal right applies, submit an appeal through an email to [PRIVACY EMAIL] with the subject line "Privacy appeal"; our response will explain any further complaint options. We do not unlawfully discriminate against you for exercising applicable rights.

Manage reminders through Settings (reminder emails and rule change emails), the reminder days on each license, and the optional calendar feed. Reminders are sent by email only; we do not send text messages or push notifications. Disabling a channel may stop reminders through that channel. Essential account and security notices may still be sent where permitted. We do not send marketing emails. Camera or photo access is governed by your device permissions; disabling access may prevent scanning without preventing manual entry where supported.

11. Intended audience and policy changes

The service is intended for adults managing professional credentials and is not directed to children under 18. Contact us if you believe a child has provided personal information. It is not intended to collect patient records or PHI. Professional information can still be personal or confidential even when some identifiers are publicly searchable. We will post policy updates with a revised effective date and provide material-change notices through an email to the address on your account and a notice in the app that asks you to review and accept the updated version before you continue. We will obtain additional consent when required by law.