Practitioner Protocols Privacy Policy

Last updated: November 2026

Practitioner Protocols is built with privacy by design. Our architecture ensures that shoppers and clients can receive recommendations and purchase retail products with zero personal or health data collected or stored by default. No shopper personal data is stored unless the shopper explicitly opts in.

1. What the App Stores

To operate recommendation workflows for direct-to-consumer and professional brands, the application stores only:

• Shop Domain: The store domain (e.g. example.myshopify.com) to scope protocols and settings.
• Offline Access Token: The app holds a short-lived (1 hour) offline access token, acquired through Shopify managed installation using App Bridge token exchange (RFC 8693) and re-acquired on admin load. Stored encrypted at rest using AES-256-GCM when SESSION_ENCRYPTION_KEY is configured, and deleted immediately on app uninstallation. No refresh token is stored.
• Practitioner Approval Records: Professional practice names and approval statuses as authorized by the merchant.
• Protocols and Share Tokens: Protocol titles, intro messages, selected product variant identifiers (GIDs and handles), recommended quantities, usage directions, and unguessable cryptographic share tokens.
• Aggregate Attribution Counts: Monthly aggregate order counts and attributed gross revenue per protocol and practice.
• Opted-In Shopper Contacts: If and only if a shopper explicitly opts in via the "Stay in touch" form on a protocol recommendation page, the app stores their email address, optional first name, the exact canonical consent text, consent version, timestamp, and the associated practice. Purpose: to enable the merchant or practice to send product recommendations and offers directly through their own communication tools (emails are never sent by this application). Legal basis: explicit consent. The app stores NO protocolId, NO order ID, NO purchased product data, NO IP address, and NO user agent with the contact. Note: The application does not send email or perform email verification; merchants and practitioners export contacts to confirm via double opt-in in their own email marketing systems.
• Merchant Store Profile & Feedback: Basic store profile details (shop name, owner name, contact email, plan name, store country from the shop address) retrieved via the Shopify Admin API. If the merchant opts in via Settings ("Contact & feedback"), we record their marketing consent and timestamp to reach out about feedback, custom work, and product updates. Merchants can also submit ratings (1–5) and feedback messages.
• Merchant Custom Feature Requests: When a merchant submits a feature request in the admin Settings tab, we store the message and optional reply email. This counts as consent to reply strictly to that inquiry and never turns on marketing opt-in.

2. What the App Does NOT Store

The application strictly enforces a privacy-first barrier:

• No Shopper Identifying Data Without Consent: Browsing shoppers have zero personal data collected or stored. We never track shoppers across sessions, nor do we store browsing history, IP addresses, user agents, phone numbers, or physical addresses.
• No Patient or Health Information: The application does not store diagnostic records, medical conditions, health notes, or patient charts. Protocols are general retail product recommendation lists.
• Aggregate-Only Order Attribution: Orders are read with the read_orders permission solely to match the hidden line-item property (_protocol_token) against active protocols and increment aggregate monthly counters. Individual order IDs and customer identifiers are never retained.

3. Data Retention and Deletion

We comply fully with platform data protection standards and mandatory compliance webhooks:

• How to Withdraw Consent or Request Deletion: Shoppers can withdraw consent or request deletion at any time by contacting the store or practice. Practitioners can delete contacts from their portal, merchants can delete individual contacts or entire practice contact lists in the admin dashboard, and platform data privacy requests are honored automatically.
• Customer Data Requests (customers/data_request): Reports any matching practitioner profile records and opted-in shopper contact records.
• Customer Redaction (customers/redact): Automatically and permanently deletes matching opted-in shopper contacts by email and removes practitioner profile records.
• Shop Redaction (shop/redact): Immediately and permanently deletes all protocols, line items, practice profiles, settings, sessions, attribution records, shopper contacts, merchant feedback, and store profiles associated with the store upon receipt.
• App Uninstallation (app/uninstalled): Immediately revokes and removes all stored offline access tokens and merchant sessions, and records the uninstallation timestamp on the store profile. Store data is retained during the 48-hour platform grace period in case of reinstallation, then permanently deleted upon receipt of shop/redact.

4. Sub-Processors

The application relies on the following infrastructure sub-processors:

• Railway: Application hosting, compute execution, and internal PostgreSQL database persistence.
• Shopify: Core commerce platform, App Bridge embedded interface, storefront App Proxy, and webhook delivery.

5. Contact Us

If you have any questions about this Privacy Policy or data handling practices, please contact the store administrator.