Privacy Policy

Effective September 10, 2026

This Privacy Policy explains how healthcare-report.com (the “Site”) handles information related to the Site and its visitors.

1. What we don’t do

We do not sell, license, rent, or trade any data displayed on or collected through the Site. We do not run advertising networks, marketing pixels, or third-party analytics or advertising trackers. We do not track you across other websites. We do not require an account to view the Site.

We do not store your full IP address. See section 3.

2. Cookies we set

The Site sets two first-party cookies. Both hold a random identifier and nothing else — no name, email, or other personal detail is encoded in them. Both arehttpOnly, so no script on the page can read them, andSameSite=Lax, so they are not sent from other sites.

• hc_vid — distinguishes returning browsers from new ones. Expires 1 year after your most recent visit.
• hc_sid — groups the pages you view into a single visit. Expires after 30 minutes of inactivity.

Signed-in administrators also receive session cookies (hc_id, hc_refresh) which hold authentication tokens. Those are strictly necessary for signing in.

3. What the analytics records

The Site runs its own analytics, hosted entirely in the operator’s AWS account. No third party receives this data. For each page view and interaction we record:

• The network you connect from, not your address. IPv4 addresses are truncated to the first three octets (a /24 block) and IPv6 to a/48 block before anything is written. The full address is never stored. A salted, truncated hash of it may be stored to tell otherwise-identical visitors apart.
• Device and software: device class (desktop, phone, tablet), browser family and major version, operating system, and the user-agent string.
• Country, derived either from your browser’s reported timezone or, where available, from network geolocation. A state or region may be recorded where the connection resolves to one.
• What you looked at: the page path, page title, the referring site’s hostname (never the full referring URL), any campaign parameters in the link you arrived through, time spent on a page, and which filters, sorts, and pagination controls you used.
• Browser environment: window and screen dimensions, language, and timezone.
• The two identifiers from the cookies described in section 2.

Requests to the Site’s API are recorded separately, with the method, route, response status, and how long the request took.

If you are signed in as an administrator, your account identifier, email address, and roles are attached to your own events.

The purpose is to understand how the Site is used and to detect abuse. It is not used to build advertising profiles, and it is not shared.

4. How long it is kept, and who can see it

Individual event records are deleted automatically 90 days after they are recorded. Aggregate daily counts — totals by page, country, device, and similar, with no identifiers attached — are kept for approximately 400 days so that trends over time remain visible.

This data is stored in a private DynamoDB table in a single AWS account owned by the operator, and is visible only to signed-in administrators of the Site.

Separately, Amazon Web Services may retain standard server request logs — including full IP address, user-agent, and timestamp — for security, abuse prevention, and infrastructure operations. Those are AWS platform logs rather than analytics, and are not sold or shared for marketing.

5. Your choices

You can block or delete the cookies in section 2 in your browser settings at any time. The Site works normally without them; visits simply stop being grouped together, and repeat visits are counted as new ones.

Browsers that send a Do Not Track or Sec-GPC signal are not currently treated differently. If you would like your data removed, contact the operator using the address in the final section.

6. Information about providers

The Site displays information about healthcare providers (name, practice, address, specialty, network status, and preferred designation) obtained from Clover Health’s publicly-available provider-search API. This is the same information Clover Health publishes for members and prospective members to search its network.

We do not collect, store, or process protected health information (PHI) as defined under HIPAA. The Site handles only provider directory information, not patient records.

7. What we do with provider data

Provider records are aggregated into snapshot-level statistics — counts by state, practice, specialty, and Clover Assistant adoption over time. The purpose is to support public understanding and independent research on the size and evolution of Clover Health’s network. Individual provider records may be shown alongside aggregate figures for context.

8. Data sharing

We do not share visitor, provider, or aggregate data with third parties for commercial purposes. Data on the Site is displayed publicly for informational use only, subject to the Terms of Use. If required by law, valid legal process, or to protect the safety and rights of others, we may disclose limited information.

9. Third-party services

The Site is hosted on Amazon Web Services (AWS). Data is stored in a private DynamoDB database in a single AWS account owned by the operator. No third-party analytics, advertising, marketing, or tracking services are integrated — the analytics described in section 3 is first-party and stays within that account. If a network-geolocation service is ever enabled to resolve country and region, it receives only a truncated network block (for example 203.0.113.0), never a visitor’s address.

10. Security

The Site uses HTTPS in transit. Access to the underlying database is limited to the operator via IAM credentials. No security measure is perfect; the operator makes no guarantee against unauthorized access.

11. Children’s privacy

The Site is not directed at children under 13 and does not knowingly collect information from them.

12. Providers listed on the Site

If you are a healthcare provider listed on the Site and believe your information is inaccurate or wish to have it removed from display, please contact us. Because the Site sources data from Clover Health’s public directory, corrections at the source will flow through on the next nightly snapshot. Removal requests will be honored on a best-effort basis.

13. Changes to this policy

We may update this policy from time to time. Material changes will be reflected in the “Effective” date above. Continued use of the Site after a change constitutes acceptance of the revised policy.

14. Contact

Questions, concerns, or removal requests? Contact kylepetos@gmail.com.