Get Early Access

Privacy Policy

Last updated

This Privacy Policy explains how NPAmplify (“NPAmplify,” “we,” “us,” or “our”) collects, uses, shares, and protects information when you visit our website, create an account, or use the NPAmplify content platform and related services (together, the “Services”).

NPAmplify helps healthcare practices plan, generate, and publish social media content. The Services are not designed to receive protected health information (PHI), and our Terms of Use prohibit you from entering it. See Section 6 for details.

If you have questions, contact us at [email protected].

1. Who this policy applies to

This policy applies to:

  • Visitors who browse our website or read our content.
  • Customers: practices, clinics, and individual providers who hold an NPAmplify subscription, along with the team members they invite to a workspace.
  • Partners who take part in the NPAmplify Partner Program.

This policy does not cover the social media platforms you connect to NPAmplify, such as Facebook, Instagram, LinkedIn, or Google Business Profile. Their own privacy policies govern how they handle your data.

2. Information we collect

Information you give us

  • Account information: name, email address, password (stored only in hashed form), job title, and the name of your practice.
  • Practice and brand information: practice location, services offered, specialties, target audience, brand voice preferences, logos, images, and any other material you upload to guide content generation.
  • Content: prompts, drafts, generated posts, captions, images, schedules, and edits you create or store in the Services (“Customer Content”).
  • Billing information: billing contact and address. A third-party payment processor handles card details. We never see or store your full card number.
  • Communications: messages you send to support, survey responses, and feedback.
  • Partner information: payout details, tax forms, and the websites or channels where you promote NPAmplify.

Information from connected accounts

When you connect a social media account, we receive the access tokens and profile information needed to publish on your behalf and show basic account details, such as page name, profile image, and account ID. We may also receive post-level performance metrics if the platform provides them. We request only the permissions the Services need.

Information collected automatically

  • Usage data: the features you use, the pages you view, the actions you take, and the times you take them.
  • Device and log data: IP address, browser type, operating system, referring URL, and error logs.
  • Cookies and similar technologies: see Section 9.

3. How we use information

We use information to:

  1. Provide the Services. This includes creating and securing accounts, generating and scheduling content, publishing to connected platforms, and sending the reminders and notifications you’ve turned on.
  2. Generate content with AI. We send the relevant inputs (your practice profile, brand settings, and prompts) to AI model providers, which return draft text for you to review. See Section 5.
  3. Process payments and manage subscriptions.
  4. Communicate with you about your account, security, billing, product changes, and support requests.
  5. Improve and troubleshoot the Services. For example, we review aggregated usage patterns and investigate errors.
  6. Send marketing, such as product updates and tips. You can unsubscribe at any time.
  7. Run the Partner Program, including tracking referrals and paying commissions.
  8. Protect NPAmplify and our users by detecting abuse, fraud, and security incidents, enforcing our Terms, and meeting legal obligations.

We do not sell your personal information, and we do not use Customer Content for third-party advertising.

4. How we share information

We share information only in these situations:

  • Service providers that host, store, or process data for us under contracts that limit how they may use it. These include providers of:
    • database, authentication, and file storage;
    • application hosting;
    • AI content generation (see Section 5);
    • email delivery;
    • payment processing;
    • analytics and error monitoring.
  • Connected platforms, when you direct us to publish content or retrieve information from an account you’ve connected.
  • Your workspace. Information and content in a workspace can be seen by the other members of that workspace, according to the roles the workspace owner sets.
  • Business transfers. Information may be transferred as part of a merger, acquisition, financing, or sale of assets. If so, it stays subject to protections at least as strong as this policy.
  • Legal and safety reasons, when we believe in good faith that disclosure is required by law or is needed to protect the rights, property, or safety of NPAmplify, our users, or others.
  • With your consent, or at your direction.

Business customers may request a list of our current subprocessors by emailing [email protected].

5. AI processing

NPAmplify uses large language models from OpenAI and Anthropic to draft content. Here is how that works:

  • The app decides the structure of each post (topic, format, compliance rules, and schedule). The AI provider is only asked to write the wording.
  • We send a model only the inputs needed to generate the content you requested.
  • We use these providers through their business APIs. Under their current policies, data sent through those APIs, including inputs and outputs, is not used to train their models by default. You can read the details in OpenAI’s business data policy and in Anthropic’s policy on model training. Each provider’s own privacy policy and terms govern how it processes data.
  • NPAmplify does not use your Customer Content to train AI models.
  • AI output can be inaccurate. You are responsible for reviewing every piece of content before it is published.

6. Healthcare information and HIPAA

NPAmplify is a marketing tool, not a clinical system. We are not a HIPAA business associate, and we do not sign Business Associate Agreements.

Do not enter PHI into the Services. That includes patient names, photos, stories, testimonials, dates of service, or any other information that identifies a patient in connection with their care. If we learn that PHI has been entered, we may delete it and may suspend the account involved.

7. Data retention

We keep information for as long as your account is active and as long as needed to provide the Services. After you close your account:

  • Customer Content and account data are deleted or de-identified within 90 days, unless we must keep them longer by law.
  • Backups are overwritten on a rolling schedule of about 30 days.
  • Billing and tax records are kept for as long as the law requires.
  • Partner payout records are kept for as long as tax and accounting rules require.

You can delete individual posts or disconnect social accounts at any time. Disconnecting an account revokes our stored access token for it.

8. Security

We protect information with technical and organizational safeguards, including:

  • encryption in transit (TLS) and at rest;
  • row-level access controls that keep each workspace’s data separate;
  • restricted internal access based on need;
  • secure handling of third-party access tokens.

No system is perfectly secure. If you believe your account has been compromised, contact [email protected] right away. To report a security vulnerability, see our Security Policy.

9. Cookies and similar technologies

We use cookies and similar technologies to:

  • keep you signed in and keep your session secure (essential);
  • remember your preferences (functional);
  • understand how the app is used (analytics);
  • attribute sign-ups to partners and measure campaigns (referral/marketing).

Your browser settings let you block or delete cookies. If you block essential cookies, parts of the Services may not work. Where the law requires it, we ask for your consent before setting non-essential cookies. For more detail, see the Cookie Statement in our GDPR Information page.

Our public website

Our public website, npamplify.com, does not set analytics or marketing cookies, and its analytics store nothing in your browser.
  • Website analytics. We use PostHog, an analytics service, in a cookieless mode to count visits and to see which pages and campaigns bring people to the site. When you load a page, your browser sends PostHog the page address — with any query parameters other than campaign tags (utm_…) removed — the referring website, your browser, operating system, device type, screen size, language, and time zone, and, as part of the request, your IP address and user agent. PostHog combines your IP address, user agent, our website’s address, and a value that changes every day into a one-way hash, so it can count repeat visits on the same day without storing anything on your device. PostHog states that it removes your IP address and user agent from the event once the hash is calculated. We also record that a contact message or early-access signup went through, and which form was used, but never what you typed. If a script on a page fails, we record the error and where it happened, with email addresses and query parameters removed. We do not use this information to identify you. PostHog processes it for us in the United States.
  • Hosting and performance. Cloudflare, which hosts the website, measures page views and loading performance with Cloudflare Web Analytics. Cloudflare states that this does not use cookies or local storage.
  • Form security. Our contact and early-access forms use Cloudflare Turnstile to tell people apart from automated abuse. Turnstile checks signals from your browser, such as your IP address and browser characteristics. Cloudflare states that Turnstile does not use cookies. It does keep a small value in your browser’s local storage under Cloudflare’s own domain (challenges.cloudflare.com).

10. Your rights and choices

Depending on where you live, you may have the right to:

  • access the personal information we hold about you;
  • correct inaccurate information;
  • delete your information;
  • receive a copy in a portable format;
  • object to or limit certain processing, or withdraw consent;
  • opt out of targeted advertising or profiling (we do not sell personal information).

These rights can come from laws such as the Texas Data Privacy and Security Act, the California Consumer Privacy Act, other U.S. state privacy laws, and the GDPR.

To make a request, email [email protected]. We may need to verify your identity before we act on it. We will not discriminate against you for exercising your rights. If we deny your request, you may appeal by replying to our decision. Unsubscribe links in marketing emails opt you out of marketing messages.

Workspace members: if a practice invited you to its workspace, that practice controls the workspace’s content. We may refer requests about that content to the practice.

Where the GDPR or UK GDPR applies, we rely on these legal bases:

  • contract: to provide the Services;
  • legitimate interests: to improve and secure the Services and to market to business customers;
  • consent: for non-essential cookies and certain marketing;
  • legal obligation: for tax, accounting, and compliance.

Right to complain to a regulator. If you are in the EEA or UK and believe we have processed your personal data unlawfully, you may lodge a complaint with your local data protection supervisory authority. We would appreciate the chance to address your concern first, so please contact us at [email protected].

For more about how we meet GDPR requirements, see our GDPR Information page. Business customers that need a Data Processing Agreement can review ours at /dpa/.

12. International transfers

NPAmplify is based in the United States, and we process information there. If you access the Services from outside the U.S., your information will be transferred to the U.S. When required, we rely on appropriate safeguards for those transfers, such as Standard Contractual Clauses.

13. Children

The Services are intended for businesses and are not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child has given us information, contact us and we will delete it.

14. Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify you by email or in the app before the changes take effect. The “Last updated” date at the top shows when the policy last changed.

16. Contact us

Email: [email protected]