Privacy Policy

DrClub LLC ("we," "us," or "our") respects your privacy and is committed to protecting the personal data of the professionals who use Dr.Club (www.drclub.com). This Privacy Policy explains how we collect, use, disclose, and safeguard your data in accordance with applicable data protection laws, including the General Data Protection Regulation (GDPR), the Turkish Law on the Protection of Personal Data (KVKK, No. 6698), the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), the Delaware Personal Data Privacy Act (DPDPA), the Virginia Consumer Data Protection Act (VCDPA), the Colorado Privacy Act (CPA), the Connecticut Data Privacy Act (CTDPA), and other applicable U.S. state and international privacy laws.

1. Data Controller

The data controller responsible for your personal information is:
DrClub LLC
A Delaware Limited Liability Company (EIN: 41-5085318)

Registered Office:
611 South DuPont Highway, Suite 102
Dover, DE 19901, United States

Principal Business Address:
1604 Crittenden Street NW
Washington, DC 20011, United States

Email: privacy@drclub.com

EU/EEA Representative: If you are located in the European Union or European Economic Area and wish to contact a local representative under GDPR Article 27, please email privacy@drclub.com and we will provide the contact details of our designated EU representative. We are in the process of formally appointing an EU representative and will update this section with their full contact details once appointed.

KVKK Representative: For inquiries from Turkey regarding your rights under KVKK, please contact privacy@drclub.com.

2. Information We Collect

We only collect information necessary to provide and improve our marketing automation services.

• Account Information: Your email address, full name, profile picture (avatar), and professional specialty.
• Professional Profile Data: Information you provide about your medical practice, including your medical license number (if provided), clinic or practice name, professional bio, areas of practice, target audience demographics, and any other professional details you choose to share on the platform.
• Authentication Data: Secure session tokens and Magic Link OTP data.
• Connected Social Media Account Data: When you connect a social media account (Meta/Facebook, Instagram, LinkedIn, X/Twitter, or Threads), we collect and store your public profile data, page/account identifiers, and OAuth access tokens. These tokens grant us permission to perform actions on your behalf, such as publishing and scheduling posts. See Section 6 below for a detailed per-platform breakdown of the data we collect. You may revoke this access at any time by disconnecting the account from your Dr.Club settings.
• Usage and AI Input Data: The preferences, target audience configurations, professional context, text prompts, and any images you upload to edit, that you provide to generate marketing content. This may include your specialty, practice focus areas, and audience demographics. We also record when you finished setting up your account and when your first content strategy was made. We also keep the hour you last opened your dashboard (one value, overwritten on each visit), so that we do not send you a reminder about something you have already come back to see, and so that we can tell you when you have not been back for a while.
• Payment Information: If you upgrade to a paid tier, payment details are collected directly by Stripe. We do not store full credit card numbers on our servers.
• Automatically Collected Technical Data: When you access our website, we automatically collect certain technical information, including your IP address, browser type and version, operating system, device type, unique device identifiers, referring URLs, pages visited, date and time of access, and general geolocation data (city/country level derived from IP address). This data is collected through server logs and tracking technologies.
• Behavioral & Analytics Data: We capture how you use and interact with our website through behavioral metrics, heatmaps, and session replay. This data is captured using first and third-party cookies and other tracking technologies.
• Invitation Data: If a colleague or organisation gave us your professional contact details so that we could invite you to Dr.Club, we hold your email address, your name, and any professional details supplied with them (such as your specialty or country), together with a record of where the details came from. If you open one of those invitations we record that you did and when. If you click a link in one, we also record which link and the browser you used. We keep this whether or not you go on to create an account, and we do not record your IP address. You can ask us to delete it at any time, and every invitation carries a one-click link that stops us contacting you again.
• Profile Details You Ask Us to Find: If you ask us to find your details so that you do not have to type them, we search the public web using your email address, your name if your account has one, your specialty and your country, and show you what we found and the page each detail came from. Your email address is sent to Google as part of that search, so that it can find pages that show your address or the name it is made of. We never look for a photo of you. We do not keep what we found on our servers unless you save it. The search runs on Google, which keeps the request and its answer for up to 30 days to produce the results. Like everything we send to Google, they may also be kept for up to 55 days to detect misuse (see Section 5). Until you save or dismiss them, the suggestions are kept only in this browser tab, for up to two hours, and signing out removes them. You can ignore the suggestions, change them, or type your details in yourself instead.

3. Health Data Exclusion (Zero-PHI)

We do not intend to, nor do we knowingly collect, process, or store Protected Health Information (PHI) or patient medical records. Our Terms of Use strictly prohibit users from inputting patient data into the Service. Any input of such data is unauthorized.

4. How We Use Your Information & Lawful Basis

Under the GDPR and KVKK, we are required to identify a lawful basis for each processing activity. The table below maps each purpose to its corresponding lawful basis:

Where we rely on Legitimate Interest, we have conducted a balancing assessment to ensure our interests do not override your fundamental rights and freedoms. You may object to processing based on legitimate interest at any time by contacting privacy@drclub.com.

Data Protection Impact Assessments (DPIAs): Where required by GDPR Article 35 or applicable U.S. state privacy laws, we conduct Data Protection Impact Assessments for processing activities likely to result in a high risk to data subjects, including the use of AI for content generation and behavioral analytics via Microsoft Clarity.

5. Third-Party Data Processors

To provide our Service, we share data with trusted third-party sub-processors. We maintain data processing agreements (DPAs) with these providers to ensure your data is handled securely and in compliance with GDPR, KVKK, and other applicable data protection laws:

• Vercel: Website hosting and content delivery network (CDN).
• Supabase: Database hosting and authentication management.
• Google (Gemini API): Our AI provider. It writes your strategies, posts and topic ideas, including the posts we make for you each Monday while automatic weekly posts are on, and it makes and edits your images. To do that, we send it your professional profile data (such as your specialty, practice focus and target audience), your weekly plan, the words you type, the titles of your recent posts when you ask for topic ideas or when we make your weekly posts, and any image you upload or ask it to edit, including a logo you add. We use Google's paid Gemini API, so Google processes this data under its Data Processing Addendum, does not use it to improve its products, and keeps it for up to 55 days only to detect and prevent misuse and for any disclosure the law requires. We never ask for patient data. Please do not type or upload any. If you ask us to find your profile details for you, that lookup runs as a Google Search through the same Google API: your email address, your name if your account has one, your specialty and your country are sent as the search query, and Google Search is the source of the details and the pages we then show you. Under Google's terms for Grounding with Google Search, Google keeps the request and its answer for up to 30 days to produce the search results and the search suggestions, and may use them for debugging and testing. This storage is covered by the same Data Processing Addendum. We show those results only to you.
• Stripe: Secure payment processing.
• Resend: Email delivery. Resend sends the emails we send you: sign-in codes, account and security notices, confirmations such as when a post has been scheduled, the weekly posts email while automatic weekly posts are on, reminders about your own account and posts (each with its own link to stop it) and, if you said yes to them, tips. To do that, Resend receives your email address, the subject line and the content of the message. Where a message refers to a post you created, the title of that post appears in it. An account notice may tell you that your account was paused, suspended or made active again, and whether your plan is charged while it is paused. If you have free Pro or Pro through your team, we may email you when your monthly credits are refilled, with how many you now have and when they next refill or your free Pro ends. If a social account you connected is about to stop working, or has stopped working while posts to it are still scheduled, we may email you with the network, when its connection ends, how many of your posts are scheduled to it and when the next one is due. If you finished setting up your account but your content strategy was not made, we may email you once about it, with how many AI credits and posts you have left. Each of these connection and strategy emails has its own link to stop it. If your AI credits, or the posts on your plan, run low or run out, we may email you with how many are left, when they refresh or your free Pro ends, and how to get more, with a link in that email to stop these messages. If your first posts are ready and you have not been back to see them, we may email you once with how many are waiting and your weekly plan. If some of the details on your profile are still empty a few days later, we may email you once with which ones are empty and the reward for adding them. Each of these two emails has its own link to stop it. If you reach your weekly posting target, we may email you once that week with how many posts you shared, how many weeks in a row you have reached it and, when it changes, your streak title. If your streak of weeks on target is about to end, we may email you on a Friday with how many weeks in a row you reached it, how many posts would keep it going and on which networks, and how many posts are waiting in your drafts. Each of these two weekly emails has its own link to stop it. If a post you made is still waiting in your drafts a few days later, we may email you about it, at most once a week, with its title, its network, the day you made it and how many other posts are waiting, with a link in that email to stop these reminders. If you have not opened your dashboard for 2 weeks, we may email you with how many posts are waiting in your drafts or your weekly plan, and once more after a month, with a link in that email to stop these emails. If you signed up but have not finished setting up your account, and did not say yes to tips, we may email you once, a day or two later, with how far you got and, if you are on the free trial, that it has started, with a link in that email to stop this reminder. A tips email may mention how far you got in setting up your account, or your weekly posting target and how many posts you have published or scheduled that week. If automatic weekly posts are on, we email you when your posts are ready, with each new post's title, its first lines and its picture, or we remind you of posts still waiting. You can stop this email with the link in it. Resend does not use your address for its own purposes. For invitation emails we measure opens and clicks ourselves rather than through Resend, so that this data stays on our own systems; Resend is told only to deliver the message. Sign-in codes, receipts and account notices are not tracked this way.
• Upstash: Scheduling. Upstash triggers our background jobs on a timer, for example the job that publishes your scheduled posts. It receives only the instruction to run a job, and no personal data.
• Meta (Facebook & Instagram), LinkedIn, X (Twitter), Threads: Social media APIs used to fetch trends and post content on your behalf. When you publish or schedule a post through Dr.Club, the content you create (including text, images, and any associated profile information such as your name and avatar) is transmitted to the respective social media platform(s) you have connected.
• Microsoft Clarity & Advertising: We partner with Microsoft Clarity and Microsoft Advertising to capture how you use and interact with our website through behavioral metrics, heatmaps, and session replay to improve and market our products/services. Website usage data is captured using first and third-party cookies and other tracking technologies to determine the popularity of products/services and online activity. Additionally, we use this information for site optimization, fraud/security purposes, and advertising. For more information about how Microsoft collects and uses your data, visit the Microsoft Privacy Statement.

We will provide notice of material changes to our sub-processor list (such as the addition of a new sub-processor) by updating this Privacy Policy and, where required by applicable law, by providing you with an opportunity to object to such changes.

6. Social Media Account Connections & Per-Platform Data Disclosure

When you connect a social media account to Dr.Club, you grant us OAuth-based access to perform specific actions on your behalf, including publishing posts, scheduling content, and retrieving public profile information. We request only the permissions necessary to provide our Service.

Below is a detailed breakdown of the data we collect from each third-party platform when you connect your account. This data is collected solely for the purpose of enabling you to manage, publish, and schedule content through Dr.Club.

6.1 Meta (Facebook)

• Data Collected: Your Facebook User ID, name, email address, profile picture, and a list of Facebook Pages you manage. For each connected Page, we collect the Page name, Page ID, Page access token, Page category, and follower count.
• Permissions Requested: Pages management, content publishing, and reading Page insights.
• Purpose: To publish and schedule posts to your Facebook Pages, retrieve engagement metrics, and display your connected pages within Dr.Club.

6.2 Instagram

• Data Collected: Your Instagram Business or Creator account ID, username, profile picture, biography, follower count, and the linked Facebook Page ID. We also collect media engagement data (likes, comments, reach) for content published through our Service.
• Permissions Requested: Instagram content publishing, reading profile information, and reading insights via the Instagram Graph API.
• Purpose: To publish and schedule posts to your Instagram account, retrieve engagement analytics, and display your connected account within Dr.Club.

6.3 Threads

• Data Collected: Your Threads user ID, username, profile picture, biography, and account type. We collect post engagement data (likes, replies, reposts) for content published through our Service.
• Permissions Requested: Threads content publishing, profile reading, and media management via the Threads API.
• Purpose: To publish and schedule text-based posts and media to your Threads account and display your connected account within Dr.Club.

6.4 LinkedIn

• Data Collected: Your LinkedIn member ID, first and last name, email address, profile picture, headline, and a list of LinkedIn Organizations (Company Pages) you manage. For each connected Organization, we collect the organization name, ID, and logo.
• Permissions Requested: Profile reading, organization administration, and content sharing (posting) via the LinkedIn API.
• Purpose: To publish and schedule posts to your LinkedIn personal profile or Company Pages, and display your connected accounts within Dr.Club.

6.5 X (formerly Twitter)

• Data Collected: Your X user ID, username (handle), display name, profile image URL, and follower count. We also collect engagement data (likes, reposts, replies) for content published through our Service.
• Permissions Requested: Read and write access to your account, including the ability to create tweets/posts and upload media via the X API v2.
• Purpose: To publish and schedule posts to your X account, retrieve engagement metrics, and display your connected account within Dr.Club.

6.6 Token Lifecycle & Management

OAuth access tokens obtained from the platforms listed above may be automatically refreshed or rotated as required by each platform's API policies to maintain your active connection. Tokens are stored securely using encryption at rest. Upon disconnection of a social media account, all associated tokens are immediately and permanently deleted from our systems. For each connection we also keep the date it ends, whether and when a platform last refused our access while publishing for you, and when we last emailed you about it, so that we can tell you before your scheduled posts are affected; these are deleted with the connection.

You retain full control over your connected accounts and may disconnect any social media account at any time through your Dr.Club account settings. Upon disconnection, we will promptly delete the associated access tokens, and any pending scheduled posts for that account will be cancelled. Disconnection does not retroactively delete content that has already been published to the third-party platform.

7. Data Retention

We retain your personal data only for as long as is reasonably necessary for the purpose for which it was collected. Below is a summary of our retention periods by category of personal information:

If you delete your account, we will delete or anonymize your personal data within 30 days, except where retention is required for legal, tax, or regulatory compliance purposes as specified above. When an account is deleted, we may send one email to the address it used, to confirm the deletion. Data subject to a legal hold or active dispute may be retained beyond these periods as required by law.

Deleted accounts and the free trial. The free trial is offered once per person. To enforce that, we keep a record when an account is deleted. For the first 30 days that record holds your email address, your name, and a copy of your account data, so that we can help if the deletion was a mistake. After 30 days all of that is erased automatically, and one thing is kept: scrambled fingerprints of the email address the account used. There can be more than one: the address as written, a simplified form of it (Gmail, Outlook and iCloud deliver mail for "jane.doe+x@gmail.com" to "janedoe@gmail.com", so the dots and the part after "+" are ignored), and, if you changed your email, the address that first received the trial. While your account exists, the same kind of fingerprint is stored with it, so a second account for the same inbox does not start another trial.

A fingerprint cannot be read back as an email address. It is produced using a secret key that we hold, which means we can check whether a new signup matches a previously deleted account, but we cannot turn it back into your address or use it to contact you. We also compare invitation lists with it, so that we never invite you to a free trial you can no longer receive. Because we hold the key, we treat the fingerprint as personal data rather than anonymous data, and your rights under Section 8 still apply to it. We keep it for as long as the free trial is offered once per person, because deleting it would allow an unlimited number of free trials per person. If you want it removed, email privacy@drclub.com.

The do-not-email list. If an email to you permanently fails to arrive, or you report one of our emails as spam, we add your address to a list we check before sending anything. This is how we make sure we stop emailing you. We keep that list indefinitely, including after an account is deleted. If we cleared it, deleting and recreating an account would start the emails again, which is the opposite of what you asked for. It records only that an address must not be contacted, and the reason. There are two such lists, deliberately kept separate. Unsubscribing from an invitation adds a scrambled fingerprint of your address to one that stops invitation and marketing email only. It never stops a sign-in code or a receipt reaching you. The other stops everything, and is only added to when a message permanently fails to arrive or someone reports us as spam. If you want your address removed from it, email privacy@drclub.com and we will remove it, but be aware that doing so means we may email you again.

8. Your Privacy Rights

Depending on your jurisdiction, you may have the following rights under applicable data protection laws (including the GDPR, KVKK, CCPA/CPRA, and DPDPA):

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Correction: Request correction of inaccurate or incomplete data.
• Right to Deletion: Request deletion of your data ("Right to be Forgotten").
• Right to Restrict Processing: Object to or restrict the processing of your data.
• Right to Data Portability: Receive your data in a structured, commonly used, and machine-readable format (such as JSON or CSV), and transmit it to another controller without hindrance (GDPR Article 20).
• Right to Opt-Out: Opt out of the sale or sharing of your personal data (see Section 11).
• Right to Withdraw Consent: Withdraw consent at any time, including revoking social media account connections through your account settings.
• Right to Non-Discrimination: Exercise any of these rights without receiving discriminatory treatment from us.

To exercise any of these rights, please email privacy@drclub.com. We will respond to your request within the timeframe required by applicable law: within one (1) month under the GDPR (extendable by two additional months for complex requests), within 45 calendar days under the CCPA/CPRA (extendable by an additional 45 days with notice), or within the applicable timeframe under your state's privacy law.

Authorized Agents: You may designate an authorized agent to submit a privacy request on your behalf. If you use an authorized agent, we may require: (a) a signed written authorization or a valid power of attorney; and (b) verification of your own identity directly with us, unless the agent has a valid power of attorney under applicable state law. We reserve the right to deny requests from agents that do not meet these requirements.

Right to Appeal: If we deny or partially deny your privacy request, you have the right to appeal our decision. To submit an appeal, email privacy@drclub.com with the subject line "Privacy Request Appeal." We will respond to your appeal within 60 days. If your appeal is denied, we will provide you with instructions on how to contact the relevant enforcement authority, including the Delaware Department of Justice, your state's Attorney General, or the applicable supervisory authority.

Right to Lodge a Complaint: If you believe your data protection rights have been violated, you have the right to lodge a complaint with the relevant supervisory authority. For EU residents, this is your local Data Protection Authority. For residents of Turkey, you may file a complaint with the Personal Data Protection Authority (KVKK Board). For U.S. residents, you may file a complaint with your state's Attorney General or the applicable state privacy enforcement agency.

9. Your California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) provides you with specific rights regarding your personal information.

• Categories of Personal Information Collected: Category A: Identifiers (name, email, user ID); Category B: Personal information per Cal. Civ. Code § 1798.80(e) (name, address); Category D: Commercial information (subscription tier, transaction records); Category K: Inferences (AI-generated content preferences and usage patterns). We also collect Internet or other electronic network activity information (usage data, analytics).
• Categories of Sources: Directly from you, from third-party social media platforms via OAuth, and automatically through cookies and tracking technologies.
• Business Purpose for Collection: To provide the Service, generate AI content, publish to social media, process payments, and improve platform performance.
• Categories Shared with Third Parties: Identifiers and professional data shared with our AI provider (Google) for content generation and, if you ask for it, the profile lookup; identifiers and content shared with social media platforms for publishing; payment data shared with Stripe; analytics data shared with Microsoft Clarity.
• Sale of Personal Information: We do not sell your personal information as defined under the CCPA/CPRA.
• Sensitive Personal Information: We may collect your professional license number, which could constitute professional information under the CCPA/CPRA. We do not use this information for purposes beyond those necessary to provide the Service, and we do not use or disclose sensitive personal information for the purpose of inferring characteristics about you. You have the right to limit the use and disclosure of sensitive personal information.
• Retention Periods: For specific retention periods applicable to each category of personal information we collect, please see Section 7 (Data Retention) above.
• Financial Incentive Programs: We offer a free trial of our Service (30 days), which requires creating an account and providing personal information. We do not assign monetary value to your personal information for purposes of calculating the financial incentive. You may stop using the free trial at any time by deleting your account; note that deleting an account does not give you a new trial once you have used it, because the trial is offered once per person (see Section 7). The free trial is offered to demonstrate the value of our paid Service, and the difference in pricing between the free and paid tiers reflects the value of the Service itself, not your personal data.
• Notice at Collection: This Section 9, together with Sections 2 (Information We Collect), 4 (How We Use Your Information), 5 (Third-Party Data Processors), and 7 (Data Retention), collectively serve as our "Notice at Collection" under the CCPA/CPRA.

To exercise your California privacy rights, please contact us at privacy@drclub.com or use the links provided in your account settings. We will verify your identity before processing your request. We will not discriminate against you for exercising your CCPA/CPRA rights.

10. Automated Decision-Making and Profiling

We do not use your personal data for automated decision-making that produces legal effects or similarly significant effects concerning you (as defined under GDPR Article 22 and the Delaware DPDPA). While our Service uses AI to generate marketing content based on your professional profile, this is performed at your request or, while automatic weekly posts are on, on a weekly schedule that you can switch off at any time, and does not constitute profiling for the purpose of automated decisions. You always retain full editorial control over any content before it is published.

11. Do Not Sell or Share My Personal Information

We do not sell your personal information to third parties. We may share certain personal information with our third-party service providers as described in Section 5, solely for the purposes of providing and improving the Service. Where such sharing constitutes "sharing" for cross-context behavioral advertising under the CCPA/CPRA, you have the right to opt out. Microsoft Clarity, which we use for behavioral analytics, may use data collected through cookies and tracking technologies for advertising purposes. You may opt out of this sharing by adjusting your cookie preferences in our Cookie Banner, or by enabling Global Privacy Control (GPC) in your browser (see Section 12).

12. Universal Opt-Out Signals & Do Not Track

Global Privacy Control (GPC): We recognize and honor Universal Opt-Out Mechanisms, including the Global Privacy Control (GPC) signal. If your browser or a browser extension sends a GPC signal, we will treat it as a valid request to opt out of the sale or sharing of your personal information for targeted advertising, as required by the CCPA/CPRA, the Delaware Personal Data Privacy Act (DPDPA), and other applicable U.S. state privacy laws that mandate recognition of such signals.

Do Not Track (DNT): Some browsers offer a "Do Not Track" (DNT) setting. There is currently no universally accepted standard for how companies should respond to DNT signals. However, we do honor GPC signals as described above, which provides a legally mandated equivalent. If a uniform standard for DNT is adopted in the future, we will update this policy to reflect our response.

13. Your Delaware Privacy Rights (DPDPA)

If you are a Delaware resident, the Delaware Personal Data Privacy Act (DPDPA), effective January 1, 2025, grants you the right to access, correct, delete, and obtain a copy of your personal data, as well as the right to opt out of targeted advertising, the sale of personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects. To exercise these rights, contact us at privacy@drclub.com. If we deny your request, you may appeal our decision as described in Section 8. If your appeal is denied, you may contact the Delaware Department of Justice to submit a complaint.

Additional U.S. State Privacy Rights

If you are a resident of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), or any other U.S. state with a comprehensive consumer privacy law, you may have similar rights to those described above, including the right to access, correct, delete, and port your personal data, as well as the right to opt out of targeted advertising, the sale of personal data, and profiling. We honor all such rights in accordance with applicable state law. To exercise your rights, contact us at privacy@drclub.com. If we deny your request, you may appeal our decision as described in Section 8 above. If your appeal is denied, we will provide you with instructions on how to contact your state's Attorney General or applicable enforcement authority.

14. Children's Privacy

Dr.Club is not directed to individuals under the age of 18. We do not knowingly collect personal information from children under the age of 16 (or 13 under the U.S. Children's Online Privacy Protection Act, COPPA). If you become aware that a child has provided us with personal data without parental consent, please contact us at privacy@drclub.com, and we will take steps to delete such information promptly.

15. AI-Generated Content Transparency

Dr.Club uses artificial intelligence (powered by Google's Gemini models) to generate social media content, strategies, and marketing copy based on the professional context you provide. In accordance with the EU AI Act (Article 50) transparency obligations and FTC guidance on AI transparency, we disclose the following:

• Content generated through our Service is produced by AI systems and should be reviewed by you (the licensed professional) before publication.
• Your professional input data (specialty, practice focus, target audience) is used as context for AI content generation. We do not use your data to train, fine-tune, or improve any AI or machine learning models. We send your inputs to Google only to generate the content you ask for, or the weekly posts we make for you while automatic weekly posts are on. Google does not use them to improve its products. It keeps them for up to 55 days to detect and prevent misuse, and for the profile lookup it also keeps the request and its answer for up to 30 days (see Section 5). If this policy changes in the future, we will notify you in advance and provide you with an opportunity to opt out before any such use begins.
• AI-generated content is not a substitute for professional medical advice or judgment. You are responsible for ensuring the accuracy, ethical compliance, and regulatory compliance of all content before it is published.
• Profile details we suggest from a web lookup can be wrong or out of date, and a search can return a different professional with a similar name. Please check every suggested detail, and the source we show next to it, before you save it.

16. International Data Transfers

Because our sub-processors (such as Stripe, Google and Supabase) operate globally, your data may be transferred outside of the United States, the European Economic Area (EEA), or the United Kingdom. When this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission (and the UK Information Commissioner's Office International Data Transfer Agreement, where applicable), an adequacy decision, or equivalent mechanisms recognized under KVKK, to protect your information in accordance with applicable data protection laws including the GDPR, the UK GDPR (Data Protection Act 2018), and KVKK.

17. Security Measures

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include encryption of data in transit (TLS/SSL) and at rest, secure OAuth token storage with encryption, role-based access controls, regular security assessments, and use of industry-standard cloud infrastructure. However, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

18. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by GDPR Article 33.
• Notify affected individuals without undue delay when the breach is likely to result in a high risk to their rights and freedoms, as required by GDPR Article 34.
• Notify affected California residents within 30 calendar days of discovery, as required by California Civil Code § 1798.82 (amended by SB 446, effective January 1, 2026).
• Comply with all applicable U.S. state data breach notification laws, including providing notice to the relevant state Attorney General where required.
• Notify the KVKK Board and affected individuals in Turkey in accordance with KVKK requirements.

Notification will include the nature of the breach, the categories of data affected, the likely consequences, and the measures taken or proposed to address the breach. We maintain an internal incident response plan and conduct regular security assessments to minimize the risk and impact of data breaches.

19. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to analyze site traffic, personalize content, and improve user experience. Below is a summary of the cookie categories we use:

• Strictly Necessary Cookies: Required for authentication, session management, and platform security (e.g., Supabase auth session tokens). These cookies cannot be disabled as they are essential for the Service to function.
• Performance & Analytics Cookies: Used by Microsoft Clarity to collect behavioral analytics data (heatmaps, session replay, page views). These help us understand how you interact with the Service and improve its performance.
• Advertising & Targeting Cookies: Used by Microsoft Advertising and Clarity for site optimization and advertising purposes. These cookies may track your activity across websites to deliver relevant advertisements.
• Invitation Cookie (dc_invite): Set only if you click a link in an invitation email. It holds a reference to that invitation for up to 7 days and does one thing: it lets us count your sign-up as having come from that invitation, which matters if you sign in with Google or LinkedIn using a different address from the one we invited. It is removed as soon as you sign in. It carries no information about you beyond that reference, is not used for advertising, and is not shared.

You have the right to accept or decline non-essential cookies by adjusting your preferences in our Cookie Banner or your browser settings. Declining non-essential cookies will not affect the core functionality of the Service, but may limit certain analytics and advertising features. Your cookie preferences are stored and respected for subsequent visits.

You can change your choice at any time with the Cookie settings button below, which is also at the bottom of our FAQ and Security pages and in your Profile. It opens the Cookie Banner again. If your browser sends a Global Privacy Control signal, we treat it as your decline of non-essential cookies, so we do not ask and we do not load Microsoft Clarity.

Cookie settings

20. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of significant changes by emailing the address associated with your account or by placing a prominent notice on our website at least 30 days before the changes take effect. The "Effective Date" at the top of this page indicates the date of the most recent revision. Your continued use of the Service after such changes constitutes your acceptance of the updated policy.

21. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your privacy rights, please contact us at:

DrClub LLC
1604 Crittenden Street NW
Washington, DC 20011, United States
Email: privacy@drclub.com
Support: support@drclub.com