Privacy Policy

LIKE A KING INC. is responsible for personal information processed through readyseen.com, except information a clinic copies into its own records after receiving your brief, which is the clinic's responsibility. Contact us through the contact form or by mail at the address above.

Spots, photos, interview answers, medicines, insurance details and drafts of your brief are saved only in your browser's storage on your device. We do not receive them unless you share a brief. Clearing your browser's site data deletes them; we cannot recover them.

If you create an account we hold: your email address; the name you give; a scrypt hash of your password (never the password); an encrypted two-factor secret and hashed recovery codes if you turn two-factor on; when you accepted the Terms; your plan and billing status; the devices signed in (browser type and phone/computer, not IP addresses); and an activity log of security events such as sign-ins and password changes.

When you create a share link or send a brief to a clinic, your device encrypts it with a new key (AES-256-GCM). For links, the key is in the part of the link after "#", which browsers never send to servers. For clinics, the key is locked to that clinic's own public key, so only its team can open it with their vault passphrase. We store the ciphertext, the expiry, the label you chose for the clinic, and a log of when it was opened (the time, and for links the device type; never IP addresses). Ciphertext is erased when the share expires or you turn it off.

For a practice that registers, we hold the practice name, address, phone, National Provider Identifier, the responsible clinician's state licence details, team members' emails and roles, and the results of verification checks against public federal sources (the NPPES NPI Registry, the HHS-OIG exclusion list, SAM.gov exclusions and Medicare enrolment data). These checks concern the practice and the licensed clinician, not patients.

Payments are processed by Stripe, Inc. on pages it hosts. We receive a customer reference, the plan, its status and renewal date; we never receive full card numbers. Stripe's own privacy policy applies to the information you give it.

We send account email (confirmations, password resets, security alerts, clinic invitations and verification results) through our own mail service, delivered by our email host. We do not send marketing email unless you ask for it, and account email contains no health information.

Our servers process the technical data needed to deliver pages (such as IP address and browser type) transiently to route requests and enforce rate limits; we do not write IP addresses into our database. We use no analytics cookies, advertising identifiers, third-party pixels or session-recording tools. To know which pages are read, we count page views as a number per page per day (for example “/pricing: 40 on October 25”), with no cookie, IP address or identifier attached; browsers that send Do Not Track or Global Privacy Control are not counted. The only cookie is a strictly necessary sign-in cookie (rs_session), set when you sign in.

The current version uses no artificial intelligence. Briefs are assembled from your own answers, photos are never analysed, and warning-sign prompts come from fixed written rules. If we add an AI feature, we will update this policy before it launches and it will be off unless you turn it on.

To provide the Service; to secure it (rate limits, lockouts, audit logs); to verify clinics; to process subscriptions; to send account email; to meet legal duties; and to count usage in aggregate (for example, how many briefs were shared this week) without looking at content.

• The recipients you choose for each brief.
• Service providers that host or operate the Service for us under contracts limiting them to that: our server host (data centre in Finland, EU), our email host, and Stripe for payments.
• Legal reasons: to comply with valid legal process or to protect someone's life or safety. We will tell you about a government request unless the law forbids it. Because brief contents are end-to-end encrypted, we cannot hand them over.
• A business transfer: if ReadySeen is acquired, this policy continues to apply to your information and we will tell you before any change.
• We never sell personal information or share it for cross-context behavioural advertising.

Account information is kept until you delete your account. Shared-brief ciphertext is erased at expiry (1 hour to 7 days, as chosen) or when you turn the share off; a content-free record (times only) remains for 1 year so you and the clinic can see the history. Security logs are kept for 1 year. Billing records are kept for 7 years because tax law requires it. Backups roll over within 30 days.

Encryption in transit (TLS with HSTS); end-to-end encryption of every shared brief; passwords hashed with scrypt; two-factor sign-in required for clinic and admin accounts; least-privilege roles; audit logs; rate limits; and a strict content-security policy with no third-party scripts. No system is perfectly secure. If a breach affects your information we will notify you and regulators as the law requires, including under the FTC Health Breach Notification Rule. See Security.

From your account page you can download what we hold about you and delete your account immediately. Depending on your state (for example California, Colorado, Connecticut, Virginia, Washington, Nevada, Texas or Oregon) you may also have rights to know, correct, opt out and appeal. Ask through the contact form; we answer within 45 days, never charge for a reasonable request, and never treat you differently for using your rights. An authorised agent may act for you with proof of authority.

ReadySeen's consumer service is generally not covered by HIPAA. When a clinic subscribes to receive briefs, we act as that clinic's business associate under a business associate agreement for the briefs sent to it. The Service is for adults 18 and over; we do not knowingly collect information from children under 13. Links to other websites (for example a clinic's own booking page) are governed by those sites' policies.

We will notify you of material changes in the app or by email before they take effect. Still open before this policy takes effect: review by licensed counsel and a written data map signed off by them. Contact: the contact form, or LIKE A KING INC., One World Trade Center, Suite 8500, New York, NY 10007, United States.