GDPR Information and Cookie Statement
The General Data Protection Regulation (“GDPR”) and the UK GDPR protect the personal data of people in the European Economic Area (“EEA”) and the United Kingdom.
This page explains how NPAmplify supports those rights, how to make a request, and how we use cookies. It supplements our Privacy Policy.
1. Our role
- NPAmplify as controller. We are the controller of personal data we collect for our own purposes. This includes account and billing information, website visitor data, and Partner data.
- NPAmplify as processor. When a practice uses the Services, we process personal data contained in its workspace, such as team member details and any personal data in Customer Content, on that practice’s behalf. The practice is the controller. Our Data Processing Agreement governs that processing.
Reminder: protected health information and patient data must never be entered into NPAmplify. See Section 5 of our Terms of Use.
2. Your rights and how to use them
Deletion
You can delete individual posts, uploads, and connected accounts at any time in the app. To delete your entire account and associated personal data:
- close your account from your account settings in the app; or
- email [email protected].
We complete deletion within 30 days, except for data we must keep by law, such as invoices. Backups are overwritten on a rolling schedule.
Access and portability
You can request a copy of the personal data we hold about you. We provide it in a commonly used, machine-readable format, such as JSON or CSV. Workspace owners can also export Customer Content from the app.
Modification
You can update most account information directly in your account settings. For anything you cannot change yourself, email [email protected] and we will correct it.
Objection and restriction
You may object to processing based on our legitimate interests, or ask us to restrict processing while a concern is being resolved. You can withdraw consent for marketing emails or non-essential cookies at any time.
Response time
We respond to requests within one month. We may extend this by up to two more months for complex requests, and we will tell you if we do. We may need to verify your identity first.
3. Data Processing Agreement
Business customers that act as controllers can review our Data Processing Agreement. It includes the EU Standard Contractual Clauses and the UK Addendum for international transfers. The DPA becomes part of your agreement with us when you accept our Terms of Use.
If you need a countersigned copy, email [email protected].
4. Subprocessors
We use a limited number of third-party subprocessors to deliver the Services. Business customers may request the current list by emailing [email protected]. We notify customers of changes as described in our Data Processing Agreement.
5. International transfers
NPAmplify is based in the United States. When we transfer personal data from the EEA, UK, or Switzerland to the U.S., we rely on:
- the European Commission’s Standard Contractual Clauses;
- the UK International Data Transfer Addendum; and
- supplementary measures, such as encryption in transit and at rest.
6. Cookie statement
Cookies are small text files stored on your device. We also use similar technologies, such as local storage and pixels. We use them in these categories:| Category | Purpose | Examples | Consent needed? |
|---|---|---|---|
| Strictly necessary | Sign-in, session security, load balancing, fraud prevention | Authentication session cookies | No |
| Functional | Remembering preferences such as the selected workspace or interface settings | Preference cookies, local storage | Yes, where required |
| Analytics | Understanding how the app is used, so we can improve it | Product analytics cookies | Yes |
| Referral and marketing | Attributing sign-ups to Partners and measuring campaigns | Partner referral cookie (60-day duration) | Yes |
- Our public website. npamplify.com does not set analytics or marketing cookies, and its analytics store nothing in your browser: it uses PostHog in a cookieless mode and Cloudflare Web Analytics. Its forms use Cloudflare Turnstile against automated abuse, which keeps a small value in local storage under Cloudflare’s own domain. What each one receives is described in our Privacy Policy.
- Managing cookies. Where the law requires it, we ask for your consent before setting non-essential cookies. Our public website sets none and does not show a cookie banner. You can block or delete cookies at any time in your browser settings. Blocking strictly necessary cookies may stop parts of the Services from working.
- Do Not Track. Browsers send Do Not Track signals inconsistently, so we do not respond to them. We do honor Global Privacy Control (GPC) signals where the law requires it.
7. Complaints and dispute resolution
If you have a concern about how we handle your personal data, please contact us first at [email protected]. We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days.
If you are not satisfied, you have the right to lodge a complaint with a data protection supervisory authority:
- EEA: the authority in the member state where you live or work, or where the alleged infringement occurred. A list is available from the European Data Protection Board.
- UK: the Information Commissioner’s Office.
- Switzerland: the Federal Data Protection and Information Commissioner.
8. Frequently asked questions
Does NPAmplify sell personal data? No.
Does NPAmplify use my content to train AI models? No. We also use our AI providers’ business APIs, which by default do not train on API data. See Section 5 of our Privacy Policy.
Where is my data stored? In the United States, with our hosting and database providers.
Can I use NPAmplify for patient information? No. NPAmplify is a marketing tool and must not be used for patient data or PHI.
Do I need to sign a DPA? Our DPA applies automatically when you accept our Terms of Use. If your organization requires a signed copy, contact us.
Who do I contact about privacy? Email [email protected].