Privacy Policy

Last updated: July 27, 2026

This Privacy Policy explains how DPCfind (“DPCfind,” “we,” “us,” or “our”) handles information in connection with the website at dpcfind.com and its subdomains (the “Site”). DPCfind is a free, informational directory of Direct Primary Care (“DPC”) practices in the United States. Please read this Policy together with our Terms of Use and Disclaimer.

The short version

DPCfind is built to be privacy-respecting by default. We do not require accounts, show ads, set advertising or retargeting cookies, build marketing profiles, or sell or rent your personal information, and there are no sign-up or contact forms. We do use Google Analytics to understand how the Site is used, which sets analytics cookies. You can decline it through the cookie notice or the “Your Privacy Choices” link in the footer, and we honor your browser’s Global Privacy Control signal. The home page also features a few practices from your state, chosen using a coarse state-level location our host reads from your IP address and that we never store. The sections below describe what is processed and the third parties involved.

Information we do not collect

  • No accounts or registration. The Site has no log-in, and we do not ask you to create an account.
  • No forms. There are no contact, sign-up, newsletter, or “claim your listing” forms on the Site, so we do not collect names, email addresses, phone numbers, or payment information from visitors.
  • No advertising or marketing cookies. We do not show ads or use advertising, retargeting, or cross-site marketing cookies. We use only the analytics cookies described below, and you can decline them.
  • No advertising profiles or data sales. We do not build marketing profiles about you, use session-replay tools, or sell or rent your personal information.
  • No precise device location. The Site never requests your device’s GPS or browser geolocation, so you will never see a location permission prompt. Search results are driven only by the ZIP code or city name you type yourself. One section of the home page features practices from your general area using a coarse, state-level estimate our host derives from your IP address, described below. Nothing narrower than a state is ever used, and we do not store it.

Information that is processed automatically

Server logs (via our hosting provider)

The Site is hosted on Vercel. Like virtually all websites, when your browser requests a page, our hosting provider automatically processes standard technical request data — including your IP address, browser type and user-agent, the date and time of the request, and the URL or page requested. This data is used to deliver the Site, maintain security, and diagnose technical problems. Vercel processes it as our hosting/infrastructure provider; see the Vercel Privacy Policy.

Your search terms

When you search the directory, the location or text you type (for example, a ZIP code or city) is placed into the page’s web address as a query parameter (such as ?q=denver) so the page can show matching results and so the results can be bookmarked or shared. Your search is processed on our server against a static data file to filter the listings; we do not use it to identify you, and we do not share it with advertisers or data brokers. Because the search term forms part of the requested URL, it may incidentally appear in the standard server request logs described above. We recommend not typing sensitive personal information into the search box.

State-level location for featured listings

The home page shows a short list of highly rated practices in your state. To choose that list, our server reads a region header that our hosting provider attaches to your request, which it infers from your IP address. That value is state-level at best. It is not precise geolocation, it says nothing about your street, neighborhood, or coordinates, and it is used for one thing only, which is deciding which three listings to feature.

We do not store, log, or retain your IP address or the state derived from it for this purpose. We do not attach it to a cookie, an identifier, or a profile, and we do not disclose it to any third party. If you visit from outside the United States, or if the region cannot be determined, the home page simply falls back to a national list. Under the CCPA/CPRA an IP address is personal information, while “precise geolocation” (location within a radius of about 1,850 feet) is a separate sensitive category carrying extra obligations. A state-level estimate sits far outside that radius, so this processing does not involve sensitive personal information.

Analytics (Google Analytics)

We use Google Analytics 4, a service provided by Google, to understand how visitors use the Site in aggregate — for example, which pages are viewed, approximate location (derived from IP and not stored by Google in full), and general device and browser information. Google Analytics sets cookies and assigns a random identifier to your browser so it can recognize returning visits; it does not tell us who you are. We have IP-anonymization enabled, we do not use Google Analytics for advertising, and we do not combine analytics data with any other information to identify you.

Analytics runs only if you have not opted out. You can decline analytics at any time using the cookie notice or the “Your Privacy Choices” link in the footer, and we automatically treat a browser Global Privacy Control (GPC) signal as an opt-out. You can also install the Google Analytics Opt-out Browser Add-on. Google’s handling of the data it receives is governed by the Google Privacy Policy.

Third-party services

A small number of third parties may receive limited technical information (such as your IP address) directly from your browser when certain pages load. This happens because your browser requests content from them — not because we send them your personal information.

  • Google Analytics (all pages). As described above, Google receives analytics data (such as your IP address and pages viewed) unless you have opted out. Governed by the Google Privacy Policy.
  • Google Maps (practice detail pages). Individual practice pages embed a map using the Google Maps Embed service. When such a page loads, your browser connects to Google, which may receive your IP address and set its own cookies, governed by the Google Privacy Policy. If you do not visit a practice detail page, no map loads.
  • Images hosted by listed practices. Some listings display a photo (for example, of a physician) that is loaded directly from the practice’s own website or its image host. When such an image loads, your browser contacts that third-party site, which may receive your IP address. We do not control those sites’ privacy practices.

We do not use Google Fonts as an external request (web fonts are self-hosted by the Site), and we do not embed third-party advertising networks, social media trackers, or video players.

How we use information

The information described above is used only to operate, secure, and improve the Site. That means serving pages, preventing abuse, troubleshooting errors, showing you state-relevant listings on the home page, and (through Google Analytics) understanding aggregate usage so we can make the directory better. We do not use it for advertising or automated decision-making about you, and we do not combine it to build a marketing profile or to identify individual visitors.

How we share information

We do not sell, rent, or trade your personal information for money, and we do not share it with third parties for their own advertising or marketing. Information is disclosed only: (a) to service providers that operate the Site on our behalf — our host (Vercel) and our analytics provider (Google, for the Google Analytics data described above, unless you opt out); (b) when required by law, legal process, or a valid governmental request; or (c) to protect the rights, property, or safety of DPCfind, our users, or the public.

Cookies and tracking technologies

DPCfind sets no first-party cookies of its own. The cookies you may receive in connection with the Site are:

  • Google Analytics cookies — set by Google to measure aggregate usage, only if you have not opted out. Declining analytics (via the cookie notice, the “Your Privacy Choices” footer link, or a Global Privacy Control signal) prevents these from being set.
  • Google Maps cookies — set by Google only if you open a practice detail page that loads a map.

We honor the Global Privacy Control (GPC) signal as an opt-out of analytics. You can also block or delete cookies through your browser settings.

Your privacy rights (California and other U.S. states)

Depending on where you live, you may have rights under laws such as the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA/CPRA”), and similar state privacy laws, including the right to know what personal information is collected, to access or delete it, to correct it, and to opt out of its sale or sharing.

We do not maintain accounts or collect personal information through forms, and we do not sell your personal information for money. However, our use of Google Analytics involves disclosing limited information (such as your IP address and pages viewed) to Google, whichmay be considered “sharing” or a “sale” under some state privacy laws.

To opt out, use the “Your Privacy Choices” link in the footer or the cookie notice, or send a Global Privacy Control signal from your browser — we treat any of these as an opt-out of analytics. We do not knowingly process “sensitive personal information” for purposes that would require an additional opt-out. To exercise any other right, or to ask what (if anything) we hold about you, contact us using the details below; we will not discriminate against you for exercising your rights.

Children’s privacy

The Site is intended for a general, adult audience and is not directed to children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, please contact us and we will take appropriate steps to address it.

Data security and retention

We rely on our hosting provider’s industry-standard security controls to protect the Site. Because we do not maintain a database of visitor personal information, the only visitor data that exists is the transient technical log data described above, retained by our hosting provider for limited operational periods. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Information about listed practices

Separately from visitor data, the Site publishes business information about DPC practices and their physicians (such as practice name, address, listed pricing, publicly listed clinician names, professional credentials, and photographs or biographies sourced from practices’ own public websites and public records). This information is about businesses and professionals in their professional capacity, not about Site visitors. For how practice information is sourced, and how a practice can request a correction or removal, see our Terms of Use and Disclaimer.

International visitors

The Site is operated in and intended for users in the United States. If you access it from outside the United States, any technical data processed is processed in the United States, which may have different data-protection laws than your jurisdiction.

Changes to this Policy

We may update this Policy from time to time. When we do, we will revise the “Last updated” date above. Material changes will be reflected on this page; your continued use of the Site after an update means you accept the revised Policy.

Contact us

Questions about this Policy or your privacy can be sent to support@dpcfind.com.