Privacy Policy

1. Overview

This Privacy Policy explains how Shortlist Referral Network LLC (“Shortlist,” “we,” “us,” or “our”) collects, uses, and protects information in connection with the Shortlist platform (“Service”).

Shortlist is a business-to-business referral directory tool. We do not knowingly collect information about patients or clients of Listed Professionals or Listed Facilities. The information described below relates to Network Administrators, Listed Professionals, and Listed Facilities (i.e., business and professional contact information), not personal health information of care recipients.

2. Information We Collect

2.1 Account information

When you create an account, we collect your name, email address, and password (stored in encrypted/hashed form, never in plain text). If your organization invites you, we also store your role (Admin, Editor, or Viewer) and organization affiliation.

2.2 Directory information

Network Administrators and authorized users enter information about Listed Professionals and Listed Facilities, which may include: name, practice/facility name, contact information (email, phone, website), practice address, fee ranges, licensure/credential information, and professional attributes (modalities, specializations, populations served, insurance accepted, and similar directory fields).

2.3 Usage and device information

We automatically collect limited technical information necessary to operate the Service, such as IP address, browser type, device information, and access timestamps (e.g., for security logging and audit trails).

2.4 Cookies

We use strictly necessary cookies to keep you signed in securely (see Section 6). We do not use advertising or cross-site tracking cookies.

3. How We Use Information

We use the information described above to:

• Provide, maintain, and secure the Service;
• Authenticate users and enforce role-based permissions;
• Enable Network Administrators to build and manage their referral directories;
• Communicate with you about your account, security notices, or changes to the Service;
• Maintain audit logs of who created, modified, or deleted directory records, for accountability and troubleshooting; and
• Comply with legal obligations.

We do not sell personal information, and we do not use directory or account data for third-party advertising.

4. How We Share Information

We do not share your information except:

• Within your Network: Directory information you or your organization enters is visible to other authorized users within your Network, according to their assigned role.
• Service providers: We use third-party infrastructure providers (e.g., hosting, database, and email-delivery providers) to operate the Service. These providers process data on our behalf and are contractually restricted from using it for other purposes. [List key subprocessors here, e.g., Railway (hosting), Netlify (web hosting), and your email provider.]
• Legal requirements: We may disclose information if required by law, subpoena, or to protect the rights, property, or safety of Shortlist, our users, or others.
• Business transfers: If Shortlist is involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction, subject to this Policy or a policy at least as protective.

5. Data Security

We take reasonable technical and organizational measures to protect information, including:

• Passwords are stored using industry-standard hashing (never in plain text);
• Authentication is handled via secure, httpOnly cookies to reduce exposure to cross-site scripting;
• Access to directory data is restricted by role-based permissions; and
• All data in transit is encrypted via HTTPS/TLS.

No system is perfectly secure, and we cannot guarantee absolute security. If we become aware of a data breach affecting your information, we will notify affected users and organizations as required by applicable law.

6. Cookies and Similar Technologies

We use a single strictly-necessary authentication cookie to keep you securely signed in. This cookie is required for the Service to function and is not used for advertising, analytics, or cross-site tracking. Because it is essential to the Service, it cannot be disabled while remaining signed in.

7. Data Retention

We retain account and directory information for as long as your organization’s account remains active, or as needed to provide the Service. If your organization’s account is closed, we will delete or anonymize associated data within [X days/months], except where we are required to retain it for legal, security, or audit purposes (e.g., audit logs of prior changes).

8. Your Rights and Choices

Depending on your location, you may have rights to access, correct, or delete personal information we hold about you, or to object to certain processing. To exercise these rights, contact us at [privacy email]. We will respond within the timeframe required by applicable law.

If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA/CPRA). [Confirm applicability with counsel and expand this section if you have California users.]

Network Administrators are responsible for ensuring they have an appropriate basis for entering information about Listed Professionals and Listed Facilities into the Service, and for responding to those individuals’ requests regarding their own information where applicable.

9. Children’s Privacy

The Service is not directed to individuals under 18, and we do not knowingly collect information from children. The Service does not collect any information about patients or clients of any age.

10. International Users

[PLACEHOLDER — if Shortlist only operates within the United States, state that explicitly. If there is any possibility of international users, this section needs specific legal review regarding cross-border data transfer mechanisms.]

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will provide notice (such as by email or an in-product notice) before the changes take effect.

12. Contact Us

Questions about this Privacy Policy, or requests regarding your information, can be sent to [privacy email].