Privacy Policy

1. Information We Collect

Personal Information

We collect information that you provide directly to us, including:

• Account Information: Name, email address, password, phone number
• Professional Information: Medical credentials, specialties, licenses, work history, education
• Job Preferences: Location preferences, salary expectations, work-life balance priorities
• Application Materials: Resumes, CVs, cover letters, references
• Communications: Messages with employers, support inquiries, feedback

Usage Information

We automatically collect information about how you use our Service:

• Device Information: IP address, browser type, operating system, device identifiers
• Log Data: Pages viewed, time spent, links clicked, search queries
• Location Data: General geographic location based on IP address
• Performance Data: Page load times, errors, crashes

Third-Party Information

We collect information from third-party sources to enhance our Service:

• Reddit Intelligence: Publicly available posts and comments from healthcare subreddits
• Salary Data: Public compensation benchmarks from trusted sources
• Employer Reviews: Publicly available employer ratings and reviews
• Professional Databases: Publicly available licensing and credential information

2. How We Use Your Information

We use the information we collect to:

• Provide the Service: Match you with relevant job opportunities, calculate burnout scores
• Facilitate Applications: Share your information with employers when you apply to jobs
• Personalize Experience: Recommend jobs based on your preferences and search history
• Send Communications: Job alerts, application updates, newsletters, promotional emails
• Improve the Service: Analyze usage patterns, fix bugs, develop new features
• Ensure Security: Detect fraud, prevent abuse, protect user accounts
• Comply with Legal Obligations: Respond to legal requests, enforce our Terms of Service
• Business Operations: Process payments, provide customer support, conduct research

3. How We Share Your Information

We do NOT sell your personal information to third parties.

We may share your information in the following circumstances:

With Your Consent

• Employers: When you apply to a job, we share your application materials and contact information with the employer
• Recruiters: If you opt in to be contacted by third-party recruiters

Service Providers

• Cloud Infrastructure: Vercel (hosting), Supabase (database)
• Payment Processing: Stripe (employer payments)
• Email Services: Resend (transactional emails)
• Analytics: Google Analytics, PostHog (aggregated usage data only)
• AI Services: OpenAI, Anthropic (anonymous data for scoring and matching)

Legal Requirements

We may disclose your information if required by law, including:

• In response to subpoenas, court orders, or legal process
• To comply with government investigations
• To protect our rights, property, or safety
• To prevent fraud or security threats

Business Transfers

If WeekdayDoc is acquired, merged, or sells assets, your information may be transferred to the acquiring entity.

4. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction, including:

• Encryption: Data encrypted in transit (HTTPS/TLS 1.3) and at rest (AES-256)
• Access Controls: Role-based access, multi-factor authentication for admin accounts
• Secure Infrastructure: Enterprise-grade cloud hosting with SOC 2 Type II compliance
• Regular Audits: Quarterly security reviews and vulnerability assessments
• Employee Training: Mandatory annual privacy and security certification
• Data Minimization: We collect only the minimum data necessary for our Service
• Vendor Security: All third-party vendors undergo security audits and sign BAAs where applicable
• Incident Response: 24/7 security monitoring with documented incident response procedures

DISCLAIMER: No method of transmission over the Internet is 100% secure. While we implement industry-standard security measures, we cannot guarantee absolute security. You use the Service at your own risk.

Data Breach Notification

In the event of a data breach that affects your personal information, we will:

• Notify affected users via email within 72 hours of discovering the breach
• Report the breach to relevant regulatory authorities as required by law
• Provide details about what data was compromised and steps we're taking to remediate
• Offer credit monitoring or identity protection services if sensitive data was exposed

5. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience and analyze usage patterns.

Types of Cookies We Use

• Essential Cookies: Required for the Service to function (authentication, security)
• Analytics Cookies: Help us understand how users interact with the Service
• Preference Cookies: Remember your settings and preferences
• Advertising Cookies: Used for targeted advertising (you can opt out)

You can control cookies through your browser settings. Note that disabling cookies may affect your ability to use certain features of the Service.

6. Your Privacy Rights

Depending on your location, you may have the following rights:

For All Users

• Access: Request a copy of your personal information
• Correction: Update or correct inaccurate information
• Deletion: Request deletion of your account and data
• Opt-Out: Unsubscribe from marketing emails
• Data Portability: Export your data in a portable format

California Residents (CCPA)

Under the California Consumer Privacy Act, you have additional rights:

• Right to know what personal information we collect and how it's used
• Right to delete personal information (with certain exceptions)
• Right to opt-out of the "sale" of personal information (we don't sell data)
• Right to non-discrimination for exercising your privacy rights

European Residents (GDPR)

Under the General Data Protection Regulation, you have additional rights:

• Right to object to processing of your data
• Right to restrict processing
• Right to data portability
• Right to withdraw consent
• Right to lodge a complaint with a supervisory authority

To exercise any of these rights, contact us at riley@weekdaydoc.com. We will respond within 30 days.

7. Automated Decision-Making and Profiling

We use automated systems and artificial intelligence to:

• Calculate burnout scores based on job attributes
• Match you with relevant job opportunities
• Analyze job descriptions and extract structured data
• Generate personalized job recommendations

IMPORTANT: These automated decisions do NOT have legal or similarly significant effects on you. They are informational tools to help you make career decisions. We do not use automated decision-making to deny access to jobs or make employment decisions on behalf of employers.

Under GDPR, you have the right to contest automated decisions and request human review. Contact us at support@weekdaydoc.com to exercise this right.

8. Sensitive Data Disclaimer

WE DO NOT COLLECT BIOMETRIC DATA, HEALTH INFORMATION, OR OTHER SPECIAL CATEGORIES OF PERSONAL DATA.

WeekdayDoc does not collect or process:

• Biometric identifiers (fingerprints, facial recognition, etc.)
• Health or medical information (other than your medical specialty/credentials)
• Genetic or biometric data
• Social security numbers or government IDs
• Financial account information (except as processed by Stripe for payments)
• Race, ethnicity, religion, or political affiliations

If you voluntarily include such information in your resume or communications, we cannot guarantee it will not be processed. We recommend excluding sensitive information from your application materials.

9. Data Retention

We retain your personal information for as long as necessary to provide the Service and comply with legal obligations:

• Active Accounts: Data retained while your account is active
• After Account Closure: Most data deleted within 90 days
• Legal Requirements: Some data retained longer to comply with tax, employment, or other laws
• Anonymized Data: May retain anonymized analytics data indefinitely

10. Children's Privacy

Our Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children under 18. If you believe we have collected information from a child, please contact us immediately, and we will delete it.

11. International Data Transfers

WeekdayDoc is based in the United States. If you access the Service from outside the U.S., your information may be transferred to, stored, and processed in the U.S. and other countries.

For European users, we rely on the following legal mechanisms:

• Standard Contractual Clauses (SCCs): EU-approved model contracts for data transfers
• Data Processing Agreements: Written agreements with all data processors
• Adequacy Decisions: Where available from the European Commission
• Privacy Shield Successor Frameworks: If and when approved

You have the right to obtain a copy of the safeguards we have in place for international data transfers. Contact support@weekdaydoc.com for more information.

12. Do Not Track Signals

Some browsers include a "Do Not Track" (DNT) feature. Because there is no common understanding of how to interpret DNT signals, we do not currently respond to DNT signals. We will update this policy if industry standards emerge.

13. Data Controller and Legal Basis

Data Controller: Konara Enterprises LLC d/b/a WeekdayDoc is the data controller responsible for your personal information.

Legal Basis for Processing (GDPR):

• Contractual Necessity: Processing necessary to provide the Service you requested
• Legitimate Interests: Improving our Service, preventing fraud, ensuring security
• Consent: Marketing communications, optional features (you can withdraw consent anytime)
• Legal Obligations: Compliance with applicable laws and regulations

14. Limitations of Liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, WE ARE NOT LIABLE FOR ANY DAMAGES ARISING FROM DATA BREACHES, UNAUTHORIZED ACCESS, OR PRIVACY VIOLATIONS CAUSED BY THIRD PARTIES OR CIRCUMSTANCES BEYOND OUR CONTROL.

While we implement reasonable security measures, you acknowledge that:

• Internet transmissions are never completely secure or error-free
• You are responsible for maintaining the security of your account credentials
• We are not responsible for data breaches caused by your own negligence or misconduct
• Third-party services (employers, recruiters) are responsible for their own data practices

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes by:

• Sending an email to your registered address
• Posting a prominent notice on the Service
• Updating the "Last updated" date at the top of this policy

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

16. Contact Us & Data Protection Officer

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us: