Privacy Policy

Resident Help (“we,” “us”) runs residenthelp.org for resident physicians facing remediation, probation, leave, fitness-for-duty referrals, committee proceedings, non-renewal, or dismissal. Your presence on this site can itself be sensitive, so we collect as little as we can, never sell it, and keep it away from your program. This policy explains what we collect, why, who can see it, and how to have it deleted.

The short version

• We do not sell, rent, or trade personal information, and we do not use it for advertising.
• We never contact your program, institution, or employer without your written permission.
• Your Residency Record is yours. Our staff have no access to it by design.
• Analytics run only on public pages and are turned off on signed-in pages.
• Chat messages are sent to our AI provider to write the reply. We do not store them.
• You can ask us to delete your information at any time.

Information you give us

• Intake form: name, personal email, phone (optional), state of training, specialty, training level, the issues you select, your nearest deadline, a short account of what happened, and any documents you choose to upload.
• Account (Google sign-in): the name, email address, and account identifier Google shares with us when you sign in. We never receive your Google password.
• Residency Record: checklist progress, key dates, and files you store in your private record.
• Working with us: if we review or take on your matter, documents you send in response to our requests, conflict-check information, and engagement records.
• Blog updates: your email address if you subscribe.
• Messages: anything you send us by email.
• RH Bot chat: the questions you type into the chat assistant. See RH Bot chat below.

Please do not send identifiable patient information. If you need to describe a clinical event, leave out patient names, dates of birth, and record numbers. We are not a HIPAA covered entity and this site is not designed to hold protected health information.

Information collected automatically

• Server logs: our host records standard request data such as IP address, browser type, page requested, and time, for security and reliability.
• Abuse protection: to throttle spam on the intake form, we store one-way (SHA-256) digests of the submitting IP address and email, never the raw values and never your narrative.
• Analytics: on public pages only, we use Vercel Web Analytics for aggregate page-view counts. It does not use advertising cookies or build profiles across sites. Events on signed-in areas such as the portal are dropped in your browser before they are sent.
• Cookies: we use only cookies needed to keep you signed in and secure. We do not use advertising or cross-site tracking cookies.
• Activity records: we log security-relevant actions, such as sign-ins and access to case files, so we can detect and investigate misuse.

RH Bot chat

RH Bot answers general questions using the content of this site. When you send a message, the conversation so far is sent to our AI provider, which writes the reply. Under its terms for business customers, our AI provider does not use these messages to train its models, and it deletes them within 30 days, unless they are flagged as violating its usage policy, in which case it may keep them for up to two years, or the law requires it to keep them longer.

We do not store chat messages or replies. They are not saved to our database, not linked to your account or any intake, and not written to our logs, and our staff do not see them. Our host’s server logs record that a chat request was made, as with any page request. To prevent abuse, your IP address is held in server memory for up to ten minutes to limit how many messages can be sent, and is not saved. The conversation itself lives only in your browser tab and is gone when you close it.

Please do not put names, your institution, patient information, or health details in the chat. Replies are general information, not legal advice, can be wrong, and do not create an attorney client relationship. To reach a person, use the intake form.

How we use information

• To review your intake, run a conflict check, and respond to you.
• To provide representation or a referral if you and we agree to it in writing.
• To run your account and the Residency Record tools you choose to use.
• To send updates you asked for, which you can stop at any time.
• To keep the site secure, prevent abuse, and meet legal and professional obligations.

Anything you share through intake is treated as confidential prospective-client information, even if we do not end up representing you.

Who can see it

• Our reviewers: only staff and attorneys with a need to know can read intake and matter information. Staff accounts require multi-factor authentication.
• Service providers: Supabase (database, sign-in, and private file storage, hosted in the United States), Vercel (website hosting and analytics), Google (sign-in), and our AI provider (replies in the RH Bot chat; see above). They process data for us under their own security and privacy terms and may not use it for their own purposes.
• Referral counsel: only with your permission, and only what is needed for the referral. We neither pay nor accept anything of value for referrals.
• Legal requirements: if the law requires it, such as a valid subpoena or court order. Where we can, we will tell you first and assert any privilege or protection that applies.

We never share your information with your program, institution, or employer unless you direct us to.

How we protect it

Data is encrypted in transit and at rest. Database tables use row level security so each person can reach only what they are permitted to see. Uploads are kept in private storage buckets, not public links. Residency Record contents are owned by you and are not visible to staff. No system is perfectly secure; if a breach affects your information, we will notify you as the law requires.

How long we keep it

We keep information only as long as we need it for the purpose you gave it, to check for conflicts of interest, and to meet our legal and professional record-keeping duties. Residency Record content stays until you delete it or close your account. Blog subscriptions end when you unsubscribe.

Your choices and rights

Wherever you live, you can ask us to tell you what we hold about you, correct it, give you a copy, or delete it. You can delete Residency Record items yourself at any time. To close your account or delete an intake, email us from the address you used. We will confirm your identity and act within 30 days. We may keep limited records if we already represent you or the law requires it, and we will tell you if so.

Use on hospital networks

Programs and hospitals can often monitor their devices, networks, and email. Use a personal device, a personal network, and a personal email account when you use this site.

Children

This site is for adults in graduate medical education. We do not knowingly collect information from anyone under 18.

Changes to this policy

If we change this policy, we will post the new version here and update the date above. If a change materially affects how we use information you already gave us, we will tell you before it takes effect.

Contact

Questions or requests: intake@residenthelp.org. Please write from a personal account. See also our Terms of Use and Legal Notices.